TMA-ALIBABA-1.2
Ensure no root account access key exists
Mô tả
Access keys provide programmatic access to a given Alibaba Cloud account. It is recommended that all access keys associated with the root account be removed. An Alibaba Cloud account can be viewed as a "root" account. The root account has the highest privilege of an Alibaba Cloud account. Removing access keys associated with the root account limits the opportunity that the ... Reported as a manual review item: the benchmark audit needs console review or organisational judgement.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.
Perform the following to determine if the root account has access keys: Using the management console: 1. Logon to Resource Access Management (RAM) console https://ram.console.aliyun.com/overview by using your Alibaba Cloud account (root account). 2. In the left-side navigation pane, click Overview. 3. In the Security Check section, make sure that No AK for Root Account is marked as Finished.
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Perform the following to delete or disable active root access keys: Using the management console 1. Logon to RAM console by using your Alibaba Cloud account (root account). 2. Move the pointer over the account icon in the upper-right corner and click AccessKey. 3. Click Continue to manage AccessKey. 4. On the Security Management page, find the target access keys and perform the following operations: Click Disable to disable the target access keys temporarily. Click Delete to delete the target access keys permanently.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- alibabaram
- Tham chiếu
- CIS Alibaba Cloud Foundation Benchmark v2.0.1 - 1.2 Ensure no root account access key exists