Back to Checks
alibabacloud

A log monitoring and alert is set up for Management Console sign-in without MFA

sls_management_console_signin_without_mfa_alert_enabled
Service: slsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:ALIYUN::SLS::Alert

Alibaba Cloud SLS should have an alarm configured for console logins not protected by MFA. By directing ActionTrail logs to SLS with alert rules, single-factor console sign-in events are detected, helping identify accounts that bypass MFA enforcement policies.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without monitoring for single-factor logins, accounts not protected by MFA may go unnoticed, increasing risk of unauthorized access through compromised credentials. Failure to monitor MFA compliance weakens authentication posture and may lead to privilege escalation or data breaches if an attacker accesses an unprotected account.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks sls_management_console_signin_without_mfa_alert_enabled

Recommendation

  1. Log on to the SLS Console
  2. Ensure ActionTrail is enabled
  3. Select Alerts
  4. Ensure alert rule has been enabled for Management Console sign-in without MFA

Remediation

CLI

aliyun sls create-alert --project <project-name> --alert-name console-signin-no-mfa --alert-displayname 'Console Sign-in Without MFA Alert' --condition 'event.eventName: ConsoleSignin and event.additionalEventData.MFAUsed: false' --dashboard <dashboard-name> --schedule '{"type":"FixedRate","interval":"1m"}'

Other

1Log on to the **SLS Console**.
2Ensure **ActionTrail** is enabled and delivering logs to a **Log Service** project.
3Navigate to the project receiving ActionTrail logs.
4Select **Alerts** and click **Create Alert Rule**.
5Configure the query to filter for sign-in without MFA: `event.eventName: ConsoleSignin and event.additionalEventData.MFAUsed: false`.
6Set the alert **schedule**, **notification method**, and **severity**.
7Save and enable the alert rule.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.sls.sls_client import sls_client


class sls_management_console_signin_without_mfa_alert_enabled(Check):
    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []
        found = False

        for alert in sls_client.alerts:
            query_list = alert.configuration.get("queryList", [])
            if not query_list:
                continue

            for query_obj in query_list:
                query = query_obj.get("query", "")
                if (
                    "ConsoleSignin" in query
                    and "addionalEventData.loginAccount" in query
                ):
                    found = True
                    report = CheckReportAlibabaCloud(
                        metadata=self.metadata(), resource=alert
                    )
                    report.status = "PASS"
                    report.status_extended = f"SLS Alert {alert.name} is configured for Management Console sign-in without MFA."
                    report.resource_id = alert.name
                    report.resource_arn = alert.arn
                    report.region = alert.region
                    findings.append(report)
                    break

            if found:
                break

        if not found:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=sls_client.provider.identity
            )
            report.status = "FAIL"
            report.status_extended = (
                "No SLS Alert configured for Management Console sign-in without MFA."
            )
            report.resource_id = sls_client.audited_account
            report.resource_arn = sls_client.provider.identity.identity_arn
            report.region = sls_client.region
            findings.append(report)

        return findings

References