Control: 1.14 Ensure RAM password policy temporarily blocks logon after 5 incorrect logon attempts within an hour

Description

RAM password policies can temporarily block logon after several incorrect logon attempts within an hour. It is recommended that the password policy is set to temporarily block logon after 5 incorrect logon attempts within an hour.

Remediation

Perform the following to set the password policy as expected:

Using the management console:

Logon to RAM console.
Choose Settings.
In the Password section, click Modify.
In the Max Attempts field, check the box next to Enable and enter 5 in the field.
Click OK.

Using the CLI:

aliyun ram SetPasswordPolicy --MaxLoginAttempts 5

Default Value:

The default password policy does not define Max Attempts.

Usage

Run the control in your terminal:

powerpipe control run alicloud_compliance.control.cis_v200_1_14

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run alicloud_compliance.control.cis_v200_1_14 --share

SQL

This control uses a named query:

select
  'acs:ram::' || a.account_id as resource,
  case
    when max_login_attempts <= 5 then 'ok'
    else 'alarm'
  end as status,
  case
    when max_login_attempts is null then 'Max login attempts not set.'
    else 'Max login attempts set to ' || max_login_attempts || '.'
  end as reason
  , a.account_id as account_id
from
  alicloud_account as a
  left join alicloud_ram_password_policy as pol on a.account_id = pol.account_id;