Back to Checks
alibabacloud

Log monitoring and alerts are set up for RAM Role changes

sls_ram_role_changes_alert_enabled
Service: slsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:ALIYUN::SLS::Alert

Alibaba Cloud SLS should have an alarm configured for RAM Role creation, deletion, and update activities. By directing ActionTrail logs to SLS with alert rules, role changes are monitored in real time. This ensures RAM role modifications are detected promptly, enabling early identification of unauthorized privilege escalation.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without monitoring for RAM role changes, unauthorized creation, modification, or deletion of roles may go undetected, enabling privilege escalation where attackers gain elevated access. Undetected role changes compromise IAM integrity and may result in unauthorized access to sensitive data and services across the cloud environment.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks sls_ram_role_changes_alert_enabled

Recommendation

  1. Log on to the SLS Console
  2. Ensure ActionTrail is enabled
  3. Select Alerts
  4. Ensure alert rule has been enabled for RAM/ResourceManager policy changes

Remediation

CLI

aliyun sls create-alert --project <project-name> --alert-name ram-role-changes --alert-displayname 'RAM Role Changes Alert' --condition 'event.serviceName: Ram and (event.eventName: CreateRole or event.eventName: DeleteRole or event.eventName: UpdateRole or event.eventName: AttachPolicyToRole or event.eventName: DetachPolicyFromRole)' --dashboard <dashboard-name> --schedule '{"type":"FixedRate","interval":"1m"}'

Other

1Log on to the **SLS Console**.
2Ensure **ActionTrail** is enabled and delivering logs to a **Log Service** project.
3Navigate to the project receiving ActionTrail logs.
4Select **Alerts** and click **Create Alert Rule**.
5Configure the query to filter for RAM role changes: `event.serviceName: Ram and (event.eventName: CreateRole or event.eventName: DeleteRole or event.eventName: UpdateRole or event.eventName: AttachPolicyToRole or event.eventName: DetachPolicyFromRole)`.
6Set the alert **schedule**, **notification method**, and **severity**.
7Save and enable the alert rule.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.sls.sls_client import sls_client


class sls_ram_role_changes_alert_enabled(Check):
    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []
        found = False

        for alert in sls_client.alerts:
            # Check configuration for query
            # alert.configuration is a dict. configuration['queryList'] is a list of dicts with 'query'
            query_list = alert.configuration.get("queryList", [])
            if not query_list:
                continue

            for query_obj in query_list:
                query = query_obj.get("query", "")
                # Check for key terms
                # Query: ("event.serviceName": ResourceManager or "event.serviceName": Ram) ...
                if (
                    ("ResourceManager" in query or "Ram" in query)
                    and "CreatePolicy" in query
                    and "DeletePolicy" in query
                ):
                    found = True
                    report = CheckReportAlibabaCloud(
                        metadata=self.metadata(), resource=alert
                    )
                    report.status = "PASS"
                    report.status_extended = (
                        f"SLS Alert {alert.name} is configured for RAM Role changes."
                    )
                    report.resource_id = alert.name
                    report.resource_arn = alert.arn
                    report.region = alert.region
                    findings.append(report)
                    break  # Found one query in this alert

            if found:
                break

        if not found:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=sls_client.provider.identity
            )
            report.status = "FAIL"
            report.status_extended = "No SLS Alert configured for RAM Role changes."
            report.resource_id = sls_client.audited_account
            report.resource_arn = sls_client.provider.identity.identity_arn
            report.region = sls_client.region
            findings.append(report)

        return findings

References