| name | cis-aws-foundations-2.8 |
| description | Ensure IAM password policy requires minimum length of 14 or greater |
| category | cis-iam |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","iam","password-policy","minimum-length","brute-force"] |
| cis_id | 2.8 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-2.9"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure IAM password policy requires minimum length of 14 or greater
Description
Password policies are used, in part, to enforce password complexity requirements. IAM password policies can ensure that passwords meet a minimum length. It is recommended that the password policy require a minimum password length of 14 characters.
Rationale
Setting a password policy with sufficient length requirements increases account resilience against brute force login attempts.
Impact
Enforcing a minimum password length of 14 characters enhances security by making passwords more resistant to brute force attacks. However, it may require users to create longer passwords, which could impact user convenience.
Audit Procedure
Using AWS Console
- Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam.
- Select
Account Settings on the left Pane.
- Located the 'Password Policy' section.
- Ensure "Minimum password length" is set to 14 or greater.
Using AWS CLI
- Run the following command:
aws iam get-account-password-policy
- Ensure the output includes:
"MinimumPasswordLength": 14
(or higher)
Expected Result
The IAM password policy has MinimumPasswordLength set to 14 or greater.
Remediation
Using AWS Console
- Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings).
- Go to IAM Service.
- Select
Account Settings on the Left Pane.
- Set "Minimum password length" to
14 or greater.
- Select "Apply password policy".
Using AWS CLI
- Run the following command:
aws iam update-account-password-policy --minimum-password-length 14
Note: All commands starting with "aws iam update-account-password-policy" can be combined into a single command.
Additional Information
Ensure the password policy also includes requirements for password complexity, such as uppercase letters, lowercase letters, numbers, and special characters:
