A RAM user is compliant if the user does not have both console access and API call access enabled at the same time.
Risk level
Default risk level: Low.
You can change the risk level based on your business requirements.
Detection logic
A RAM user is compliant when one of the following conditions is met. For console access, which covers single sign-on (SSO) and console logon: if SSO is enabled, the user is compliant when the last logon was more than seven days ago; if SSO is not enabled, the user is compliant when console access is disabled. For API call access: the user is compliant when no AccessKeys exist.
Rule details
|
Parameter |
Description |
|
Rule name |
Check that a RAM user does not have both a human identity and a program identity |
|
Rule identifier |
|
|
Automatic remediation |
Not supported |
|
Rule trigger |
Configuration changes |
|
Supported resource types |
ACS::RAM::User |
|
Input parameters |
None |
Remediation
For remediation steps, see Log on to the Alibaba Cloud console as a RAM user.