Weak IAM account password policies
What does ZopNight detect here?
AWS accounts whose IAM password policy fails security best practices get flagged by ZopNight as compliance finding RC-1523. The rule reads a single pass-fail bit the discoverer computes, fires only on an explicit fail, and recommends a 14-character minimum, full complexity, 90-day expiration and 24-password reuse prevention.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1523 |
| Category | compliance |
| Severity | medium |
| Metric | none — pure configuration read |
| Source | iam_password_policy.go |
One pass-fail bit for the account’s passwords
An AWS account has exactly one IAM password policy, and every console user’s password answers
to it. ZopNight’s discoverer evaluates that policy against security best practices and stamps
the verdict onto the account as a single boolean, password_policy_compliant. Rule RC-1523
does not re-inspect individual settings. It reads that one bit and raises a medium-severity
compliance finding when the account fails.
Because there is nothing to delete or resize, the finding carries $0 in every cost field. The value is the prompt itself: a weak policy quietly lowers the cost of a brute-force or credential-stuffing attempt against every console user at once.
Why the policy verdict must be an explicit false
The rule fails closed. When the compliance flag is missing from the account’s metadata, or
present but unparseable, it abstains rather than guessing. A security finding raised on
absent evidence would be noise, and noise teaches people to ignore the list. Only an
explicit false fires.
That discipline comes from a real bug: an earlier version read the verdict from a tag no producer ever wrote, so the rule was permanently silent. The current metadata read is the contract the discoverer actually fulfils.
The settings a compliant policy carries
The remediation the finding ships asks for a minimum length of 14 characters or more; required uppercase, lowercase, numbers and symbols; password expiration at 90 days; and reuse prevention remembering the last 24 passwords. It also suggests enforcing MFA for all IAM users, and a separate finding covers users who lack it.
Reading the password policy with the CLI
aws iam get-account-password-policyA configured policy returns its settings as JSON. If the account has never set one, the call
fails with NoSuchEntity, which is itself the answer, since AWS’s defaults on their own do
not satisfy the baseline above.
Tightening rules without locking users out
Raising minimum length and complexity only affects the next password change, so it is safe to apply immediately. Expiration is the disruptive setting: enabling a 90-day rotation forces every console user through a reset on their next expiry, so announce it before turning it on, and pair it with MFA so the rotation pressure does not push people toward predictable password patterns.