Control: 1.12 Ensure RAM password policy prevents password reuse

Description

It is recommended that the password policy prevent the reuse of passwords.

Remediation

Perform the following to set the password policy as expected:

Using the management console:

Logon to RAM console.
Choose Settings.
In the Password section, click Modify.
In the Do Not repeat History section field, enter '5'.
Click OK.

Using the CLI:

aliyun ram SetPasswordPolicy --PasswordReusePrevention 5

Default Value:

The default password policy does not prevent password reuse.

Usage

Run the control in your terminal:

powerpipe control run alicloud_compliance.control.cis_v200_1_12

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run alicloud_compliance.control.cis_v200_1_12 --share

SQL

This control uses a named query:

select
  'acs:ram::' || a.account_id as resource,
  case
    when password_reuse_prevention = 5 then 'ok'
    else 'alarm'
  end as status,
  case
    when minimum_password_length is null then 'No password policy set.'
    when password_reuse_prevention is null then 'Password reuse prevention not set.'
    else 'Password reuse prevention set to ' || password_reuse_prevention || '.'
  end as reason
  , a.account_id as account_id
from
  alicloud_account as a
  left join alicloud_ram_password_policy as pol on a.account_id = pol.account_id;