Ensure access keys are rotated every 90 days or less

SedangLevel 1Otomatisalibaba

Deskripsi

An access key consists of an access key ID and a secret, which are used to sign programmatic requests that you make to Alibaba Cloud. RAM users need their own access keys to make programmatic calls to Alibaba Cloud from the Alibaba Cloud SDKs, CLIs, or direct HTTP/HTTPS calls using the APIs for individual Alibaba ... Access keys might be compromised by leaving them in codes, configuration files, on premise and cloud storages, and then stolen by attackers. No Active access key of any RAM user may have a CreateDate older than 90 days. Read-only aliyun CLI calls; credentials and default region come from the CLI's normal profile (aliyun configure, ~/.aliyun/config.json or ALIBABA_CLOUD_* environment variables). JSON output is parsed with sed/awk. A missing CLI or credential fails the check.

Cara pemeriksaan

Metode audit: Perintah shell

shell

cutoff=$(date -u -d '90 days ago' +%Y-%m-%dT%H:%M:%S 2>/dev/null || date -u -v-90d +%Y-%m-%dT%H:%M:%S 2>/dev/null) || exit 1
out=$(aliyun ram ListUsers --MaxItems 1000 2>/dev/null) || exit 1
users=$(printf '%s\n' "$out" | sed -n 's/.*"UserName"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
bad=0
for u in $users; do
  ks=$(aliyun ram ListAccessKeys --UserName "$u" 2>/dev/null) || exit 1
  old=$(printf '%s\n' "$ks" | awk -v c="$cutoff" '
/\{/ { st = ""; cd = "" }
/"Status"/ { st = $0 }
/"CreateDate"/ { cd = $0; sub(/^[^:]*:[[:space:]]*"/, "", cd); sub(/".*/, "", cd) }
/\}/ { if (st ~ /Active/ && cd != "" && cd < c) n++; st = ""; cd = "" }
END { print n + 0 }')
  [ "$old" -eq 0 ] || { echo "access key older than 90 days: $u"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

For each listed user create a new key (aliyun ram CreateAccessKey --UserName <u>), move applications to it, then disable and delete the old key (aliyun ram UpdateAccessKey --Status Inactive / DeleteAccessKey).

Properti

Sistem operasi: Apa saja
Tag: alibabaram
Referensi: CIS Alibaba Cloud Foundation Benchmark v2.0.1 - 1.6 Ensure access keys are rotated every 90 days or less

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target alibaba