Control: 1.14 Ensure RAM password policy temporarily blocks logon after 5 incorrect logon attempts within an hour


RAM password policies can temporarily block logon after several incorrect logon attempts within an hour. It is recommended that the password policy is set to temporarily block logon after 5 incorrect logon attempts within an hour.


Perform the following to set the password policy as expected:

From Console

  1. Logon to RAM console.
  2. Choose Identities > Settings.
  3. In the Password Strength Settings section, click Edit Password Rule.
  4. In the Password Retry Constraint Policy field, enter <5> or a smaller number.
  5. Click OK.

From Command Line

aliyun ram SetPasswordPolicy --MaxLoginAttemps 5


Run the control in your terminal:

powerpipe control run alicloud_compliance.control.cis_v100_1_14

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run alicloud_compliance.control.cis_v100_1_14 --share


This control uses a named query: