Ensure IAM password policy expires passwords within 90 days or less.