# 1.8 Ensure IAM Password Policy Requires Minimum Length of 14 or Greater (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233153-1-8-ensure-iam-password-policy-requires-minimum-length-of-14-or-greater-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 1](https://support.icompaas.com/support/solutions/folders/62000169194) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) # **Profile Applicability:** **Level 1** ## **Description:** AWS IAM password policies enforce password complexity requirements for users. It is recommended that the password policy require a minimum password length of 14 characters to enhance security against brute-force attacks. # Rationale: A strong password policy significantly reduces the risk of brute force login attempts and unauthorized access to AWS resources. Enforcing a minimum password length of 14 characters increases password entropy, making them more resistant to attacks. ## Impact: Benefits of a Strong Password Policy: - Increases password security against brute force attacks. - Helps in meeting compliance requirements (CIS, SOC 2, HIPAA, PCI-DSS). - Reduces risk of unauthorized access. **Potential Challenges**: - User convenience: Users may find longer passwords difficult to remember. - Password management complexity: Organizations may need password managers or SSO solutions to handle long passwords securely. ## Default Value: - AWS IAM password policy does not enforce a minimum password length by default. - Without a password policy, users can set passwords with weak or easily guessable patterns. ![](https://support.icompaas.com/assets/kb/5287986211cc2be1.png) ## Pre-Requisites: AWS Account Access: - IAM user with Administrator privileges or IAM policy allowing password policy modifications. AWS CLI Installed (for automation purposes): - Ensure AWS CLI is configured with appropriate IAM permissions. Organizational Approval: - Verify that IT/security teams agree to enforce a 14-character minimum password policy. Remediation: ### Test Plan: Ensure that IAM password policies enforce a minimum password length of 14 characters. ## Using AWS Console: 1. Login to AWS Console with IAM permissions. 2. Navigate to IAM Service: [AWS IAM Console](https://console.aws.amazon.com/iam/). 3. Click on Account Settings in the left navigation panel.                                               ![](https://support.icompaas.com/assets/kb/2fe027c7fbdfc528.png) 4. Locate Minimum password length and ensure it is set to 14 or greater.     ![](https://support.icompaas.com/assets/kb/36f0c55ee3a0fff1.png) 5. If the setting is not configured correctly, proceed with remediation. ## Using AWS CLI: - Run the following command to check the existing password policy: aws iam get-account-password-policy - Ensure the output contains: { "MinimumPasswordLength": 14 } - If "MinimumPasswordLength" is less than 14, proceed with remediation. ## Implementation Steps: Using AWS Console: 1. Login to AWS Console with IAM permissions. 2. Navigate to IAM Service: [AWS IAM Console](https://console.aws.amazon.com/iam/). 3. Click Account Settings in the left panel.                                                  ![](https://support.icompaas.com/assets/kb/3f8f16dac5636c31.png) 4. Set Minimum password length to 14 or greater.                 ![](https://support.icompaas.com/assets/kb/4dd697d707c14f79.png) 5. Click Apply password policy to enforce the new settings.                            **Using AWS CLI**: - Run the following command to enforce a 14-character minimum password length: aws iam update-account-password-policy --minimum-password-length 14 - To further strengthen password security, enforce additional complexity requirements: aws iam update-account-password-policy \\ --minimum-password-length 14 \\ --require-uppercase-characters \\ --require-lowercase-characters \\ --require-numbers \\ --require-symbols This command ensures that IAM passwords: - Are at least 14 characters long. - Contain uppercase and lowercase letters. - Include numbers and special characters for added security. ## Backout Plan - If enforcing a 14-character password policy causes issues: Temporarily reduce the length requirement using the following command: aws iam update-account-password-policy --minimum-password-length 12 - Disable the policy update if required: aws iam delete-account-password-policy - Warning: Deleting the password policy will remove all password complexity requirements. ## References: - [AWS IAM Password Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) - [AWS Security Best Practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/bestpractices.html#configure-strong-password-policy) ## CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

5.2

Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using MFA and a 14-character password for accounts not using MFA.

CIS v7

16.1

Maintain an inventory of each of the organization's authentication systems, including those located onsite or at a remote service provider.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.