Set Minimum Password Length | Vulnerability Database

IAM account password policies should ensure that passwords have a minimum length.

The account password policy should be set to enforce minimum password length of at least 14 characters.

Short, simple passwords are easier to compromise

Follow the appropriate remediation steps below to resolve the issue.

Log into the AWS Management Console.
Select the “Services” option and search for IAM.
Scroll down the left navigation panel and choose “Account Settings”.
Under the “Password Policy” configuration panel scroll down and check the “Minimum Password Length”. If the password length is set less than 8 characters than the password security is at risk.
Click on the “Minimum Password Length” checkbox and mention the minimum characters required to 14. Click the checkbox against “Require at least one uppercase letter” and “Require at least one lowercase letter” to make the password more secure.
Click on the “Apply Password Policy” button to make the necessary changes.
Now “Password Policy” requires at least 14 characters with one uppercase and one lowercase character for a strong and secure password.

Enforce longer, more complex passwords in the policy

1
2
3


resource "aws_iam_account_password_policy" "good_example" {
  minimum_password_length = 14
}