All checks
Low
Ensure IAM password policy expires passwords within 90 days or less
Verifies that the IAM account password policy expires passwords within 90 days or fewer, so a leaked password stops working on its own. Expiry switched off fails, and so does an account that never set a policy, as the AWS default never expires passwords.
- service
- IAM
- severity
- Low
- scope
- evaluated once per account
How to fix it
In the console
IAM → Account settings → Password policy → Edit → Custom
With the AWS CLI
aws iam update-account-password-policy --minimum-password-length 14 --require-uppercase-characters --require-lowercase-characters --require-numbers --require-symbols --password-reuse-prevention 24 --max-password-age 90With Terraform
resource "aws_iam_account_password_policy" "this" {
minimum_password_length = 14
require_uppercase_characters = true
require_lowercase_characters = true
require_numbers = true
require_symbols = true
password_reuse_prevention = 24
max_password_age = 90
}See which of your accounts this check is failing on.
Book a demo