Policy Packs

guardrails-samples

Ensure that passwords meet specific complexity, length, and rotation requirements, reducing the risk of unauthorized access and aligning with best practices and regulatory compliance.

Enforce AWS IAM Account Password Policy Settings

main

aws_iam_account_password_policy_settings

Check if the IAM account password policy is in sync with the account password settings policies.

accountPasswordPolicySettings

AWS > IAM > Account Password Policy > Settings

aws_iam_account_password_policy_settings_allow_users_to_change

You can permit all IAM users in your account to use the IAM console to change their own passwords, as described in [Permitting IAM users to change their own passwords](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_enable-user-change.html).&#92;n&#92;nRefer to [Setting an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) for more information on account password policies.&#92;n

accountPasswordPolicySettingsAllowUsersToChange

AWS > IAM > Account Password Policy > Settings > Allow Users to Change

aws_iam_account_password_policy_settings_hard_expiry

You can prevent IAM users from choosing a new password after their current password has expired. For example, a password policy can specify a password expiration period. If an IAM user fails to choose a new password before the expiration period ends, the IAM user cannot set a new password. In that case, the IAM user must request a password reset from an account administrator in order to regain access to the AWS Management Console. You can also leave this check box cleared. If an IAM user allows his or her password to expire, the user in this scenario is required to set a new password before accessing the AWS Management Console.&#92;n&#92;nRefer to [Setting an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) for more information on account password policies.&#92;n

accountPasswordPolicySettingsHardExpiry

AWS > IAM > Account Password Policy > Settings > Hard Expiry

iam_account_password_policy_settings_lowercase_characters

You can require that IAM user passwords contain at least one lowercase character from the ISO basic Latin alphabet (a to z).&#92;n&#92;nRefer to [Setting an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) for more information on account password policies.&#92;n

accountPasswordPolicySettingsRequireLowercaseCharacters

AWS > IAM > Account Password Policy > Settings > Require Lowercase Characters

iam_account_password_policy_settings_max_age

You can set IAM user passwords to be valid for only the specified number of days. You specify the number of days that passwords remain valid after they are set. For example, when you enable password expiration and set the password expiration period to 90 days, an IAM user can use a password for up to 90 days. After 90 days, the password expires and the IAM user must set a new password before accessing the AWS Management Console. You can choose a password expiration period between 1 and 1095 days, inclusive.&#92;n&#92;nRefer to [Setting an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) for more information on account password policies.&#92;n

accountPasswordPolicySettingsMaxAge

AWS > IAM > Account Password Policy > Settings > Max Age

iam_account_password_policy_settings_minimum_length

You can specify the minimum number of characters allowed in an IAM user password. You can type any number from 6 to 128.&#92;n&#92;nRefer to [Setting an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) for more information on account password policies.&#92;n

accountPasswordPolicySettingsMinimumLength

AWS > IAM > Account Password Policy > Settings > Minimum Length

iam_account_password_policy_settings_require_numbers

You can require that IAM user passwords contain at least one numeric character (0 to 9).&#92;n&#92;nRefer to [Setting an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) for more information on account password policies.&#92;n

accountPasswordPolicySettingsRequireNumbers

AWS > IAM > Account Password Policy > Settings > Require Numbers

iam_account_password_policy_settings_require_symbols

You can require that IAM user passwords contain at least one of the following nonalphanumeric characters:&#92;n`! @ # $ % ^ &amp; * ( ) _ + - = [ ] { } | &#39;`&#92;n&#92;nRefer to [Setting an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) for more information on account password policies.&#92;n

accountPasswordPolicySettingsRequireSymbols

AWS > IAM > Account Password Policy > Settings > Require Symbols

iam_account_password_policy_settings_require_uppercase_characters

You can require that IAM user passwords contain at least one uppercase character from the ISO basic Latin alphabet (A to Z).&#92;n&#92;nRefer to [Setting an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) for more information on account password policies.&#92;n

accountPasswordPolicySettingsRequireUppercaseCharacters

AWS > IAM > Account Password Policy > Settings > Require Uppercase Characters

iam_account_password_policy_settings_reuse_prevention

You can prevent IAM users from reusing a specified number of previous passwords. You can set the number of previous passwords from 1 to 24, inclusive.&#92;n&#92;nRefer to [Setting an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) for more information on account password policies.&#92;n

accountPasswordPolicySettingsReusePrevention

AWS > IAM > Account Password Policy > Settings > Reuse Prevention

turbot_policy_setting.aws_iam_account_password_policy_settings

turbot_policy_setting.aws_iam_account_password_policy_settings_allow_users_to_change

turbot_policy_setting.aws_iam_account_password_policy_settings_hard_expiry

turbot_policy_setting.iam_account_password_policy_settings_max_age

turbot_policy_setting.iam_account_password_policy_settings_minimum_length

turbot_policy_setting.iam_account_password_policy_settings_lowercase_characters

turbot_policy_setting.iam_account_password_policy_settings_require_numbers

turbot_policy_setting.iam_account_password_policy_settings_require_symbols

turbot_policy_setting.iam_account_password_policy_settings_require_uppercase_characters

turbot_policy_setting.iam_account_password_policy_settings_reuse_prevention

Policy	Setting	Note
AWS > IAM > Account Password Policy > Settings	Check: Configured
AWS > IAM > Account Password Policy > Settings > Allow Users to Change	Enabled
AWS > IAM > Account Password Policy > Settings > Hard Expiry	Enabled
AWS > IAM > Account Password Policy > Settings > Max Age	90
AWS > IAM > Account Password Policy > Settings > Minimum Length	14
AWS > IAM > Account Password Policy > Settings > Require Lowercase Characters	Enabled
AWS > IAM > Account Password Policy > Settings > Require Numbers	Enabled
AWS > IAM > Account Password Policy > Settings > Require Symbols	Enabled
AWS > IAM > Account Password Policy > Settings > Require Uppercase Characters	Enabled
AWS > IAM > Account Password Policy > Settings > Reuse Prevention	5