Back to Checks
alibabacloud

RAM user not logged on for 90 days or longer has console logon disabled

ram_user_console_access_unused
Service: ramSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:ALIYUN::RAM::User

Alibaba Cloud RAM users can log on to the console by using their username and password. If a user has not logged on for 90 days or longer, it is recommended to disable the console access of the user. Disabling unused console access reduces the attack surface by removing unnecessary logon capabilities from potentially abandoned or dormant accounts.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Inactive accounts with console access are common targets for account takeover. An abandoned account or one with a compromised password unused for over 90 days may go unmonitored, allowing undetected unauthorized access. This risks the confidentiality and integrity of cloud resources accessible through the account.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ram_user_console_access_unused

Recommendation

Disable console access for RAM users that have not logged on for 90 days or longer to reduce the attack surface.

Remediation

CLI

aliyun ram DeleteLoginProfile --UserName <ram_user>

Other

1Log on to the **RAM Console**.
2Choose **Identities** > **Users**.
3In the User Logon Name/Display Name column, click the username of the target RAM user.
4In the Console Logon Management section, click **Modify Logon Settings**.
5In the Console Password Logon section, select **Disabled**.
6Click **OK**.

Check Code

import datetime

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ram.ram_client import ram_client


class ram_user_console_access_unused(Check):
    """Check if RAM users with console access have logged in within the configured days."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        maximum_unused_days = ram_client.audit_config.get("max_console_access_days", 90)
        findings = []
        for user in ram_client.users:
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=user)
            report.region = ram_client.region
            report.resource_id = user.name
            report.resource_arn = (
                f"acs:ram::{ram_client.audited_account}:user/{user.name}"
            )
            if user.has_console_access:
                if user.password_last_used:
                    time_since_insertion = (
                        datetime.datetime.now()
                        - datetime.datetime.strptime(
                            str(user.password_last_used), "%Y-%m-%d %H:%M:%S+00:00"
                        )
                    )
                    if time_since_insertion.days > maximum_unused_days:
                        report.status = "FAIL"
                        report.status_extended = (
                            f"RAM user {user.name} has not logged in to the console "
                            f"in the past {maximum_unused_days} days "
                            f"({time_since_insertion.days} days)."
                        )
                    else:
                        report.status = "PASS"
                        report.status_extended = (
                            f"RAM user {user.name} has logged in to the console "
                            f"in the past {maximum_unused_days} days "
                            f"({time_since_insertion.days} days)."
                        )
                else:
                    # User has console access but has never logged in
                    report.status = "FAIL"
                    report.status_extended = (
                        f"RAM user {user.name} has console access enabled "
                        "but has never logged in to the console."
                    )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"RAM user {user.name} does not have console access enabled."
                )

            findings.append(report)
        return findings

References