Control: 1.14 Ensure RAM password policy temporarily blocks logon after 5 incorrect logon attempts within an hour
Description
RAM password policies can temporarily block logon after several incorrect logon attempts within an hour. It is recommended that the password policy is set to temporarily block logon after 5 incorrect logon attempts within an hour.
Remediation
Perform the following to set the password policy as expected:
From Console
- Logon to RAM console.
- Choose
Identities > Settings. - In the
Password Strength Settingssection, clickEdit Password Rule. - In the
Password Retry Constraint Policyfield, enter<5>or a smaller number. - Click
OK.
From Command Line
aliyun ram SetPasswordPolicy --MaxLoginAttemps 5
Usage
Run the control in your terminal:
powerpipe control run alicloud_compliance.control.cis_v100_1_14Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run alicloud_compliance.control.cis_v100_1_14 --shareSQL
This control uses a named query:
ram_password_policy_max_login_attempts_5