Back to Checks
alibabacloud

Multi-factor authentication is enabled for all RAM users with console access

ram_user_mfa_enabled_console_access
Service: ramSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:ALIYUN::RAM::User

Alibaba Cloud RAM supports MFA, adding protection on top of username and password. With MFA enabled, console logon requires an authentication code from a virtual MFA device after entering credentials. MFA should be enabled for all RAM users with console passwords to strengthen account security.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without MFA, RAM accounts rely solely on passwords. If compromised through phishing or credential stuffing, an attacker gains full account access. MFA requires an additional factor, making unauthorized access significantly harder even with compromised credentials, protecting confidentiality, integrity, and availability of cloud resources.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ram_user_mfa_enabled_console_access

Recommendation

Enable MFA for all RAM users with console access to add an extra layer of authentication security.

Remediation

Other

1Log on to the **RAM Console**.
2For each user with console access, go to the user's details.
3In the **Console Logon Management** section, click **Modify Logon Settings**.
4For `Enable MFA`, select **Required**.
5Click **OK** to save the settings.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ram.ram_client import ram_client


class ram_user_mfa_enabled_console_access(Check):
    """Check if all RAM users with console access have MFA enabled."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for user in ram_client.users:
            # Only check users with console access
            if user.has_console_access:
                report = CheckReportAlibabaCloud(
                    metadata=self.metadata(), resource=user
                )
                report.region = ram_client.region
                report.resource_id = user.name
                report.resource_arn = (
                    f"acs:ram::{ram_client.audited_account}:user/{user.name}"
                )

                # Check if MFA is required for console access
                # mfa_bind_required indicates whether MFA is required in the login profile
                if user.mfa_bind_required:
                    report.status = "PASS"
                    report.status_extended = (
                        f"RAM user {user.name} has MFA enabled for console access."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = f"RAM user {user.name} has console access but does not have MFA enabled."

                findings.append(report)

        return findings

References