All checks
Medium
Password policies for IAM users should have strong configurations
Checks that the account password policy requires long, complex IAM user passwords that expire and cannot be reused, at the strictest value IAM.7 and IAM.10 to IAM.16 each ask for. An account that never set a policy fails, as the AWS default has no expiry or reuse prevention; length and character rules reach an existing password only when it is next changed.
- service
- IAM
- severity
- Medium
- scope
- evaluated once per account
How to fix it
In the console
IAM → Account settings → Password policy → Edit → Custom
With the AWS CLI
aws iam update-account-password-policy --minimum-password-length 14 --require-uppercase-characters --require-lowercase-characters --require-numbers --require-symbols --password-reuse-prevention 24 --max-password-age 90With Terraform
resource "aws_iam_account_password_policy" "this" {
minimum_password_length = 14
require_uppercase_characters = true
require_lowercase_characters = true
require_numbers = true
require_symbols = true
password_reuse_prevention = 24
max_password_age = 90
}See which of your accounts this check is failing on.
Book a demo