RAM account password policy without reuse prevention

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: terraform-alicloud-ram-account-password-policy-without-reuse-prevention

Provider: Alicloud

Platform: Terraform

Severity: Medium

Category: Secret Management

Learn More

Description

The RAM account password policy attribute password_reuse_prevention should be defined and set to a value between 1 and 24. If password_reuse_prevention is missing, the rule reports a MissingAttribute issue and recommends adding password_reuse_prevention = 24. If it is present but set to 0 (which disables reuse prevention) or to a value greater than 24, the rule reports an IncorrectValue issue and recommends replacing it with 24.

Compliant Code Examples

resource "alicloud_ram_account_password_policy" "corporate" {
  minimum_password_length      = 9
  require_lowercase_characters = false
  require_uppercase_characters = false
  require_numbers              = false
  require_symbols              = false
  hard_expiry                  = true
  max_password_age             = 12
  password_reuse_prevention    = 5
  max_login_attempts           = 3
}

Non-Compliant Code Examples

resource "alicloud_ram_account_password_policy" "corporate" {
  minimum_password_length      = 9
  require_lowercase_characters = false
  require_uppercase_characters = false
  require_numbers              = false
  require_symbols              = false
  hard_expiry                  = true
  max_password_age             = 12
  max_login_attempts           = 3
}

resource "alicloud_ram_account_password_policy" "corporate" {
  minimum_password_length      = 9
  require_lowercase_characters = false
  require_uppercase_characters = false
  require_numbers              = false
  require_symbols              = false
  hard_expiry                  = true
  max_password_age             = 12
  password_reuse_prevention    = 25
  max_login_attempts           = 3
}