AWS IAM Account Password Policy

aws_iam_account_password_policy (Terraform)

The Account Password Policy in IAM can be configured in Terraform with the resource name aws_iam_account_password_policy. The following sections describe 5 examples of how to use the resource and its parameters.

Example Usage from GitHub

storebot/pr_demo_flat

resource "aws_iam_account_password_policy" "passwordRequireMinLength" {
  minimum_password_length = 5
}

resource "aws_iam_account_password_policy" "passwordRequireMinLength14" {
  minimum_password_length = 14

kanchwala-yusuf/aws-terraform

resource "aws_iam_account_password_policy" "passwordRequireMinLength" {
  minimum_password_length        = 6
}

resource "aws_iam_account_password_policy" "passwordRequireMinLength14" {
  minimum_password_length        = 13

snyk-labs/infrastructure-as-code-goof

resource "aws_iam_account_password_policy" "uppercase" {
  minimum_password_length        = 14
  require_lowercase_characters   = true
  require_numbers                = true
  require_uppercase_characters   = false
  require_symbols                = true

commitdev/zero-aws-eks-stack

resource "aws_iam_account_password_policy" "account_password_policy" {
  minimum_password_length        = 14
  require_numbers                = true
  require_symbols                = true
  require_lowercase_characters   = true
  require_uppercase_characters   = true

gustcol/Canivete

resource "aws_iam_account_password_policy" "valid" {
  minimum_password_length = 8
}

resource "aws_iam_account_password_policy" "invalid_1" {
  minimum_password_length = 4

Security Best Practices for aws_iam_account_password_policy

There are 6 settings in aws_iam_account_password_policy that should be taken care of for security reasons. The following section explain an overview and example code.

Ensure AWS IAM account password policies requires long passwords

It's better to enforce the use of long and complex passwords to reduce the risk of bruteforce attacks.

Ensure to require lowercase characters in AWS IAM account password policies

It's better to enforce the use of complex passwords to reduce the risk of bruteforce attacks.

Ensure to require numbers in AWS IAM account password policies

It is better to enforce the use of complex passwords to reduce the risk of bruteforce attacks.

Ensure password reuse of AWS IAM User is prohibited

It's better to prohibit the reuse in order to reduce the risk of compromised passwords being abused.

Ensure to require symbols in AWS IAM account password policies

It is better to enforce the use of complex passwords to reduce the risk of bruteforce attacks.

Ensure to require uppercase characters in AWS IAM account password policies

It is better to enforce the use of complex passwords to reduce the risk of bruteforce attacks.

Parameters

• allow_users_to_change_password optional - bool
• expire_passwords optional computed - bool
• hard_expiry optional computed - bool
• id optional computed - string
• max_password_age optional computed - number
• minimum_password_length optional - number
• password_reuse_prevention optional computed - number
• require_lowercase_characters optional computed - bool
• require_numbers optional computed - bool
• require_symbols optional computed - bool
• require_uppercase_characters optional computed - bool

Explanation in Terraform Registry

-> Note: There is only a single policy allowed per AWS account. An existing policy will be lost when using this resource as an effect of this limitation. Manages Password Policy for the AWS Account. See more about Account Password Policy in the official AWS docs.