Control: 2.7 Ensure IAM password policy requires minimum length of 14 or greater

Description

Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure passwords are at least a given length. It is recommended that the password policy require a minimum password length 14.

Remediation

Perform the following to set the password policy as prescribed:

From Console:

Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings).
Go to IAM Service on the AWS Console.
Select Account Settings on the Left Pane.
Set "Minimum password length" to 14 or greater.
Select "Apply password policy".

From Command Line:

aws iam update-account-password-policy --minimum-password-length 14

Note: All commands starting with "aws iam update-account-password-policy" can be combined into a single command.

Default Value:

By default, the AWS IAM account password policy does not enforce any minimum password length. If configured, the default minimum length is 6 characters.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cis_v600_2_7

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cis_v600_2_7 --share

SQL

This control uses a named query:

select
  'arn:' || a.partition || ':::' || a.account_id as resource,
  case
    when minimum_password_length >= 14 then 'ok'
    else 'alarm'
  end as status,
  case
    when minimum_password_length is null then 'No password policy set.'
    else 'Minimum password length set to ' || minimum_password_length || '.'
  end as reason
  , a.account_id
from
  aws_account as a
  left join aws_iam_account_password_policy as pol on a.account_id = pol.account_id;