turbot/alicloud_compliance

Query: ram_root_account_unused

Usage

powerpipe query alicloud_compliance.query.ram_root_account_unused

SQL

select
'acs:ram::' || account_id || ':user/' || user_name as resource,
case
when user_last_logon is null then 'ok'
else 'alarm'
end as status,
case
when user_last_logon is null then 'Root account not used.'
else 'Root account last used ' || extract(
day
from
current_date - user_last_logon
) || ' days ago.'
end as reason,
account_id as account_id
from
alicloud_ram_credential_report
where
user_name = '<root>';

Controls

The query is being used by the following controls: