Set Max Password Age | Vulnerability Database

IAM account password policies should have a maximum age specified.

The account password policy should be set to expire passwords after 90 days or less.

Long life password increase the likelihood of a password eventually being compromised

Follow the appropriate remediation steps below to resolve the issue.

Log into the AWS Management Console.
Select the “Services” option and search for IAM.
Scroll down the left navigation panel and choose “Account Settings”.
On the Account Settings page, click on the “Change” under the “Password Policy”.
Under the “Password Policy” configuration panel scroll down and check the “Enable password expiration”. If the “Enable password expiration” checkbox is not ticked then the password won’t reset in any number of days.
If the “Enable password expiration” checkbox is ticked and “Password expiration period (in days)” is set to above 180 days than the allowed age of password might lead to a security threat as the same password will be active for a long period of time.
Click on the “Enable password expiration” checkbox and mention the 180 days under “Password expiration period (in days)” so that the password will be expired after 180 days. After 180 days, the password expires and the IAM user must set a new password before accessing the AWS Management Console.
Click on the “Apply Password Policy” button to make the necessary changes.

Limit the password duration with an expiry in the policy

1
2
3


resource "aws_iam_account_password_policy" "good_example" {
	max_password_age = 90
}