Control: 1.8 Ensure IAM password policy requires minimum length of 14 or greater
Description
Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure passwords are at least a given length. It is recommended that the password policy require a minimum password length of 14.
Setting a complex password policy increases account resiliency against unethical password hackers.
Remediation
Perform the following to set the password policy is configured as prescribed:
From Console:
- Sign into the AWS console and navigate to the IAM Dashboard.
- Choose Account settings.
- Click Change or Change password policy (if no password policy set earlier).
- Ensure in the
Enforce minimum password lengthfield is set to 14, then choose Save changes.
From Command Line:
aws iam update-account-password-policy --minimum-password-length 14
Note: All commands starting with "aws iam update-account-password-policy" can be combined into a single command.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.cis_v150_1_8Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.cis_v150_1_8 --shareSQL
This control uses a named query:
select 'arn:' || a.partition || ':::' || a.account_id as resource, case when minimum_password_length >= 14 then 'ok' else 'alarm' end as status, case when minimum_password_length is null then 'No password policy set.' else 'Minimum password length set to ' || minimum_password_length || '.' end as reason , a.account_idfrom aws_account as a left join aws_iam_account_password_policy as pol on a.account_id = pol.account_id;