Control: AWS > NIST 800-53 > IAM > IAM password policies for users should have strong configurations

The identities and the credentials are issued, managed, and verified based on an organizational IAM password policy.

IAM password policy is considered to have a strong configuration when: - Minimum password length is greater than or equal to 14 characters - Require at least one uppercase letter from the Latin alphabet (A-Z) - Require at least one lowercase letter from the Latin alphabet (a-z) - Require at least one number - Require at least one non-alphanumeric character - Password should expire in at least 90 days - Remember at least the last 24 passwords and prevent reuse