Ensure IAM password policy expires passwords within 90 days or less

How to fix it

• Can break clients: Expiry applies at once, so every user whose password is older than the period must set a new one at their next console sign-in.
• Overwrites existing settings: The CLI and Terraform routes replace the whole password policy, so they also set IAM.7's rules; add any other option you rely on, such as Allow users to change their own password.
• Affects another check: IAM.7 checks this same expiry among its rules, and the CLI and Terraform routes here satisfy all of them, so they clear IAM.7 too.

In the console

IAM → Account settings → Password policy → Edit → Custom

Turn on password expiration

Selected, with passwords expiring in 90 days or fewer

With the AWS CLI

aws iam update-account-password-policy --minimum-password-length 14 --require-uppercase-characters --require-lowercase-characters --require-numbers --require-symbols --password-reuse-prevention 24 --max-password-age 90

With Terraform

resource "aws_iam_account_password_policy" "this" {
  minimum_password_length      = 14
  require_uppercase_characters = true
  require_lowercase_characters = true
  require_numbers              = true
  require_symbols              = true
  password_reuse_prevention    = 24
  max_password_age             = 90
}