Detects whether any AccessKey pairs are attached to an Alibaba Cloud account.
Scenario
An Alibaba Cloud account has full administrative permissions over all cloud resources. An exposed AccessKey pair for the account gives an attacker unrestricted access to those resources. To reduce this risk, avoid creating AccessKey pairs for the Alibaba Cloud account and use RAM users instead.
Risk level
Default risk level: high.
You can change the risk level when you apply this rule.
Compliance evaluation logic
If no AccessKey pairs exist in the Alibaba Cloud account, the evaluation result is compliant.
If an AccessKey pair exists in the Alibaba Cloud account, the evaluation result is non-compliant. See Non-compliance remediation.
Rule details
|
Item |
Description |
|
Rule name |
root-ak-check |
|
Rule ID |
root-ak-check |
|
Tag |
RAM |
|
Automatic remediation |
Not supported |
|
Trigger type |
Periodic execution |
|
Evaluation frequency |
24 hours |
|
Supported resource type |
Alibaba Cloud account |
|
Input parameter |
None |
Non-compliance remediation
Call the DeleteAccessKey operation to delete the AccessKey pair from the Alibaba Cloud account.