IAM Users Password Policy Not Set

AWS accounts should have a custom password policy rather than relying on the default password policy.

Details ¶

AWS Identity and Access Management (IAM) Users represent individuals who log in to AWS either through the console using a username and password, or via IAM User Access Keys for use with the AWS CLI and SDKs. Console access, designed for human users, relies on usernames and passwords, which is the standard login method for various web applications.

The management of console access, including password standards and management, is governed by an account-wide password policy. This policy defines the requirements that passwords must meet to ensure security and operational controls, such as minimum password length, password expiration and required password characters.

AWS provides a default password policy that is generally adequate but does not meet the ideal standards set by the National Institute of Standards and Technology (NIST) Special Publication 800-63B. Additionally, our opinion is that the default password policy does not reflect the data sensitivity and cost implications of large organisations. As such, we recommend that organisations tailor and manage their won password policy to comply with their specific requirements, which may be influenced by data sensitivity, insurance mandates, or other operational considerations.

Additionally, relying on AWS’s default password policy outsources your control over policy updates. When AWS modifies their default policy, you may not have the ability to implement those changes on your terms. A custom password policy allows organisations to define their own standards, control the timing of policy updates and enforce regular password resets for all users to align with their security requirements.

While the default password policy may suffice in some scenarios, most organisations benefit from managing their password policies directly. It’s better to do this sooner rather than later.

Remediations ¶

Managing your password policy is straightforward although can be challenging at scale. We include as part of our automated Cloud Assessments scans for AWS Accounts without password policies as well as policies that can be improved.

Additionally, our general password policy is detailed in our guidance article summarising our enterprise standard password policy.