turbot/aws_compliance
Loading controls...

Control: 1.9 Ensure IAM password policy prevents password reuse

Description

IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.

Preventing password reuse increases account resiliency against unethical password hackers.

Remediation

Perform the following to set the password policy as prescribed:

From Console:

  1. Sign into the AWS console and navigate to the IAM Dashboard.
  2. Choose Account settings.
  3. Click Change or Change password policy (if no password policy set earlier).
  4. Ensure Prevent password reuse is checked.
  5. Ensure Remember password(s) is set to 24 and then choose Save changes.

From Command Line:

aws iam update-account-password-policy --password-reuse-prevention 24

Note: All commands starting with "aws iam update-account-password-policy" can be combined into a single command.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cis_v130_1_9

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cis_v130_1_9 --share

SQL

This control uses a named query:

iam_account_password_policy_reuse_24

Tags