Alibaba Cloud RAM does not enforce MFA misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_ALI_24
Category - Subcategory	IAM - Mfa
Provider	ALIBABA_CLOUD
Severity	LOW
Framework	Terraform

Impact

This rule ensures that Multi-Factor Authentication (MFA) is enforced for Alibaba Cloud RAM (Resource Access Management) accounts. Enforcing MFA significantly strengthens account security by requiring a second form of authentication, in addition to a password, to access resources. This prevents unauthorized access even if the password is compromised.

Failing to enforce MFA increases the risk of unauthorized access, which can lead to potential data breaches or misuse of cloud resources.

How to Fix

Resource: alicloud_ram_security_preference

• Arguments: enforce_mfa_for_login

To mitigate this issue, ensure the enforce_mfa_for_login attribute in the alicloud_ram_security_preference resource is set to true.

Example: [source,go]

resource "alicloud_ram_security_preference" "example" { ...

• enforce_mfa_for_login = true }

---