Control: 1.5 Ensure users not logged on for 90 days or longer are disabled for console logon

Description

Alibaba Cloud RAM users can logon to Alibaba Cloud console by using their user name and password. If a user has not logged on for 90 days or longer, it is recommended to disable the console access of the user.

Remediation

Perform the following to disable console logon for a user:

From Console

Logon to RAM console.
Choose Identities > Users.
In the User Logon Name/Display Name column, click the username of the target RAM user.
In the Console Logon Management section, click Modify Logon Settings.
In the Console Password Logon section, select Disabled.
Click OK.

From Command Line

aliyun ram DeleteLoginProfile --UserName <ram_user>

Usage

Run the control in your terminal:

powerpipe control run alicloud_compliance.control.cis_v100_1_5

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run alicloud_compliance.control.cis_v100_1_5 --share

SQL

This control uses a named query:

select
  'acs:ram::' || account_id || ':user/' || name as resource,
  case
    when last_login_date < current_date - interval '90 days' or last_login_date is null then 'alarm'
    else 'ok'
  end as status,
  case
    when last_login_date is null then name || ' never logged in.'
    else name || ' logged in '|| extract(day from current_date - last_login_date) || ' days ago.'
  end as reason
  , account_id as account_id
from
  alicloud_ram_user;