Cis AWS Foundations 2.8

Ensure IAM password policy requires minimum length of 14 or greater

Description

Password policies are used, in part, to enforce password complexity requirements. IAM password policies can ensure that passwords meet a minimum length. It is recommended that the password policy require a minimum password length of 14 characters.

Rationale

Setting a password policy with sufficient length requirements increases account resilience against brute force login attempts.

Impact

Enforcing a minimum password length of 14 characters enhances security by making passwords more resistant to brute force attacks. However, it may require users to create longer passwords, which could impact user convenience.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam.
2. Select Account Settings on the left Pane.
3. Located the 'Password Policy' section.
4. Ensure "Minimum password length" is set to 14 or greater.

Using AWS CLI

1. Run the following command:

aws iam get-account-password-policy

2. Ensure the output includes:

"MinimumPasswordLength": 14

(or higher)

Expected Result

The IAM password policy has MinimumPasswordLength set to 14 or greater.

Remediation

Using AWS Console

1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings).
2. Go to IAM Service.
3. Select Account Settings on the Left Pane.
4. Set "Minimum password length" to 14 or greater.
5. Select "Apply password policy".

Using AWS CLI

1. Run the following command:

aws iam update-account-password-policy --minimum-password-length 14

Note: All commands starting with "aws iam update-account-password-policy" can be combined into a single command.

Additional Information

Ensure the password policy also includes requirements for password complexity, such as uppercase letters, lowercase letters, numbers, and special characters:

aws iam update-account-password-policy \
  --require-uppercase-characters \
  --require-lowercase-characters \
  --require-numbers \
  --require-symbols

Default Value

By default, the AWS IAM account password policy does not enforce a minimum password length. If configured, the default minimum length is 6 characters.

References

1. CCE-78907-3
2. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html
3. https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#configure-strong-password-policy

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 | Automated