Password policies for IAM users should have strong configurations

How to fix it

• Can break clients: Expiry applies at once, so every user whose password is older than the period must set a new one at their next console sign-in.
• Overwrites existing settings: The CLI and Terraform routes replace the whole password policy, so add any option they leave out, such as Allow users to change their own password, or it is reset.
• Affects another check: Setting expiry to 90 days or fewer also clears IAM.17, which checks that one setting.

In the console

IAM → Account settings → Password policy → Edit → Custom

Password minimum length

14 or more

Password strength

All four selected: uppercase letter, lowercase letter, number, nonalphanumeric character

Turn on password expiration

Selected, with passwords expiring in 90 days or fewer

Prevent password reuse

Selected, remembering 24 passwords (the most AWS allows)

With the AWS CLI

aws iam update-account-password-policy --minimum-password-length 14 --require-uppercase-characters --require-lowercase-characters --require-numbers --require-symbols --password-reuse-prevention 24 --max-password-age 90

With Terraform

resource "aws_iam_account_password_policy" "this" {
  minimum_password_length      = 14
  require_uppercase_characters = true
  require_lowercase_characters = true
  require_numbers              = true
  require_symbols              = true
  password_reuse_prevention    = 24
  max_password_age             = 90
}