Alibaba Cloud RAM password policy maximal login attempts is more than 4 misconfiguration detected in

Rule Details

Cortex AppSec Rule ID	APPSEC_ALI_23
Category - Subcategory	IAM - Authentication Policies
Provider	ALIBABA_CLOUD
Severity	MEDIUM
Framework	Terraform

Impact

This rule ensures that the maximum login attempts in the RAM (Resource Access Management) account password policy are set to no more than 5. Limiting login attempts helps protect accounts from brute-force attacks and unauthorized access attempts. It enforces stricter security controls, ensuring better protection for sensitive resources.

Failing to limit the maximum login attempts can increase the risk of successful brute-force attacks, potentially leading to account compromise.

How to Fix

Resource: alicloud_ram_account_password_policy

• Arguments: max_login_attempts

To mitigate this issue, ensure the max_login_attempts attribute in the alicloud_ram_account_password_policy resource is set to a value no greater than 5.

Example: [source,go]

resource "alicloud_ram_account_password_policy" "example" { ...

• max_login_attempts = 7
• max_login_attempts = 3 }

---