IAM password policy is not set

Severity: Low
Service: IAM
Check ID: PASSWORD_POLICY_NOT_SET

What this check finds

A password policy helps ensure strong passwords are used by IAM Users. Setting a password policy does not impact existing users, so after setting this, you should ensure users reset their passwords so that they are in compliance.

Passing looks like: IAM password policy is set.

How to fix it

Set an account-level IAM password policy.

AWS CLI

aws iam update-account-password-policy --minimum-password-length 14 --require-uppercase-characters --require-lowercase-characters --require-symbols --require-numbers --max-password-age 90 --password-reuse-prevention 24

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

IAM → Account settings → Edit.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to IAM password policy is not set
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	1.7 Ensure IAM password policy requires minimum length of 14 or greater 1.8 Ensure IAM password policy prevents password reuse
PCI-DSS v4.0.1	8.3.6 Passwords/passphrases meet minimum complexity requirements
HIPAA Security Rule	164.312(d) Verify that a person or entity seeking access is the one claimed
SOC 2 — Trust Services Criteria	CC5.2 The entity selects and develops control activities over technology
NIST SP 800-53 Rev5 (Moderate)	IA-5 Authenticator Management
NIST Cybersecurity Framework 2.0	PR.AA-01 Identities and credentials are managed
ISO/IEC 27001:2022 Annex A	A.5.17 Authentication information

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks