RAM Account Password Policy Not Required Symbols
- Query id: 41a38329-d81b-4be4-aef4-55b2615d3282
- Query name: RAM Account Password Policy Not Required Symbols
- Platform: Terraform
- Severity: Medium
- Category: Secret Management
- URL: Github
Description¶
RAM account password security should require at least one symbol
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - tf file
resource "alicloud_ram_account_password_policy" "corporate2" {
minimum_password_length = 9
require_lowercase_characters = false
require_uppercase_characters = false
require_numbers = false
require_symbols = false
hard_expiry = true
max_password_age = 12
password_reuse_prevention = 5
max_login_attempts = 3
}
Code samples without security vulnerabilities¶
Negative test num. 1 - tf file
resource "alicloud_ram_account_password_policy" "corporate1" {
minimum_password_length = 9
require_lowercase_characters = false
require_uppercase_characters = false
require_numbers = false
require_symbols = true
hard_expiry = true
max_password_age = 12
password_reuse_prevention = 5
max_login_attempts = 3
}