IAM Password Policies Rule

HIPAA Compliant IAM Password Policies

Description

Rule Details

2. 1.
   Password Length: Set a minimum password length of at least 8 characters to create stronger and more secure passwords.
4. 2.
   Password Complexity: Ensure passwords contain a combination of uppercase and lowercase letters, numbers, and special characters to enhance security.
6. 3.
   Password Expiration: Set a maximum password age to ensure regular password changes and reduce the risk of compromised credentials. It is recommended to set it to 90 days.
8. 4.
   Password Reuse: Prevent users from reusing their previous passwords to enhance security. Configure the system to remember a specified number of unique passwords to prevent recycling.
10. 5.
    Account Lockout: Implement an account lockout policy to automatically lock user accounts after a specified number of failed login attempts. This helps protect against brute force attacks.

Troubleshooting Steps (if any)

2. 1.

   Issue: Users can use weak passwords that don't meet the required complexity.

   • Resolution: Update the password policy to enforce password complexity rules and educate users on the importance of strong passwords.
   • Example code:

     aws iam update-account-password-policy --password-policy '{
         "MinimumPasswordLength": 8,
         "RequireUppercaseCharacters": true,
         "RequireLowercaseCharacters": true,
         "RequireNumbers": true,
         "RequireSymbols": true
     }'
     
4. 2.

   Issue: Users' passwords are not expiring regularly.

   • Resolution: Modify the password policy to set a maximum password age to ensure periodic password changes.
   • Example code:

     aws iam update-account-password-policy --password-policy '{
         "MaxPasswordAge": 90
     }'
     
6. 3.

   Issue: Users are reusing their passwords.

   • Resolution: Update the password policy to enforce password history and prevent password reuse.
   • Example code:

     aws iam update-account-password-policy --password-policy '{
         "PasswordReusePrevention": 5
     }'
     
8. 4.

   Issue: Accounts are not being locked out after multiple failed login attempts.

   • Resolution: Adjust the account lockout policy to automatically lock user accounts after a specified number of failed login attempts.
   • Example code:

     aws iam update-account-password-policy --password-policy '{
         "MaxFailedLoginAttempts": 5
     }'
     

Remediation Steps

2. 1.
   Open the AWS Management Console and navigate to the IAM service.
4. 2.
   Select "Account settings" from the left-hand menu.
6. 3.
   Under the "Password policy" section, click on "Customize".
8. 4.
   Configure the password policy as per the following recommendations:

   • Set the "Minimum password length" to 8 characters or more.
   • Enable the options for "Require uppercase characters," "Require lowercase characters," "Require numbers," and "Require symbols".
   • Set the "Number of unique passwords to remember" based on your organization's security policies.
   • Set the "Password expiration" to 90 days or according to your organization's requirements.
   • Configure the "Account lockout threshold" to automatically lock user accounts after a certain number of failed login attempts.
10. 5.
    Click on "Apply password policy" to save the changes.