Description:

This policy ensures that a password policy report is generated and shared with the appropriate stakeholders. This report contains information about the password policy for the AWS account, including the minimum password length, complexity requirements, and expiration period.

Rationale:

The password policy report is a valuable tool for auditing the password policy for the AWS account. By sharing this report with the appropriate stakeholders, organizations can ensure that the password policy is enforced and that users are using strong passwords.

Impact:

Generating the password policy report will have no impact on the availability or performance of the AWS account. However, it may increase the amount of data that is stored in AWS.

Default Value:

AWS does not generate a password policy report by default.

Pre-requisites:

  • The user must have the appropriate permissions to generate the password policy report.
  • The user must have access to the AWS Management Console or the AWS CLI.
  • The user must have a shared folder or S3 bucket where the report can be stored.

Remediation Steps:

To disable this policy, the user can follow these steps:

  1. In the AWS Management Console, navigate to the IAM & Admin page.
  2. Click on the Policies tab.
  3. Select the policy that you want to disable.
  4. Click on the Disable button.

Test Plan:

To test this policy, the user can follow these steps:

  1. Enable the policy.
  2. Generate the password policy report.
  3. Verify that the report is shared with the appropriate stakeholders.

Implementation Plan:

To implement this policy, the user can follow these steps:

  1. Enable the policy.
  2. Generate the password policy report.
  3. Share the report with the appropriate stakeholders.

AWS CLI Process:

To enable this policy using the AWS CLI, the user can run the following command:

aws iam update-policy --policy-name <policy-name> --policy-document file://<policy-document-file>

The policy-document-file file should contain the following JSON:

{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": "iam:GeneratePasswordPolicyReport",      "Resource": "*"    }  ] }

Using AWS GUI:

To enable this policy using the AWS GUI, the user can follow these steps:

  1. In the AWS Management Console, navigate to the IAM & Admin page.
  2. Click on the Policies tab.
  3. Select the policy that you want to enable.
  4. Click on the Edit button.
  5. In the Policy Document section, paste the following JSON:
{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": "iam:GeneratePasswordPolicyReport",      "Resource": "*"    }  ] }
  1. Click on the Save button.

Backout Plan:

To revoke this policy, the user can follow these steps:

  1. In the AWS Management Console, navigate to the IAM & Admin page.
  2. Click on the Policies tab.
  3. Select the policy that you want to revoke.
  4. Click on the Delete button.

Note:

  • This policy is not required for all AWS environments.
  • The user should test the policy to ensure that it is working as expected.
  • The user should revoke this policy if it is no longer needed.

Reference:

  • AWS IAM Policy Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
  • AWS CLI Command Reference: https://docs.aws.amazon.com/cli/latest/reference/iam/

Section 2:

  • Tags: password, policy, report, share
  • Keywords: IAM, policy, audit, compliance