# Ensure IAM password policy expires passwords within 90 days or less

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292212288290-ensure-iam-password-policy-expires-passwords-within-90-days-or-less
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that the AWS account's IAM password policy enables password expiration and sets the password expiration period to 90 days or less. The password policy applies to all IAM users who sign in to the AWS Management Console with a password.

**Rationale**

Passwords that never expire can stay valid for years, so a leaked, reused or guessed password remains useful to an attacker indefinitely. A compromised IAM user password gives console access to the account, allowing data exfiltration, privilege escalation and unauthorized changes. Rotating passwords at least every 90 days, together with password reuse prevention, MFA and strong length and complexity rules, limits how long a compromised password can be used.

**Impact**

-   Limits how long a compromised password can be used
    
-   Users must set a new password when their current password reaches the expiration period, which may require communicating the change in advance
    
-   Passwords older than the new expiration period expire immediately, and those users must change their password at their next sign-in
    
-   If **Require administrator reset** (hard expiry) is enabled, users with expired passwords cannot sign in until an administrator resets their password
    

**Default Value**

No custom password policy is set by default. Without a custom policy, passwords do not expire.

**Pre-Requisites**

-   IAM permissions: iam:GetAccountPasswordPolicy and iam:UpdateAccountPasswordPolicy
    
-   Agreement on the other password policy settings to keep (for example, minimum length, character types and password reuse), because updating the policy replaces all of its settings
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the IAM console and select **Account settings** in the left menu.
    
3.  In the **Password policy** section, check whether password expiration is enabled and the expiration period in days.
    
4.  If no custom password policy is set, password expiration is not enabled, or the expiration period is more than 90 days, follow the implementation steps.
    

**CLI:**

Show the current password policy:

aws iam get-account-password-policy

The account fails if MaxPasswordAge is missing or greater than 90, or if the command returns a NoSuchEntity error (no custom policy is set, so passwords do not expire).

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the IAM console and select **Account settings** in the left menu.
    
3.  In the **Password policy** section, choose **Edit**.
    
4.  Select **Custom** (if the default policy is in use).
    
5.  Select **Enable password expiration** and set **Expiration period (in days)** to 90 or less.
    
6.  Leave the other password settings as they are, unless they also need to be changed.
    
7.  Choose **Save changes**.
    

**CLI:**

Set passwords to expire after 90 days:

aws iam update-account-password-policy --max-password-age 90

This command replaces the whole password policy, and any setting not included reverts to its default. To keep the existing settings, add the matching options from the Test Plan output, for example:

aws iam update-account-password-policy --max-password-age 90 --minimum-password-length 14 --require-uppercase-characters --require-lowercase-characters --require-numbers --require-symbols --allow-users-to-change-password --password-reuse-prevention 24

**Backout Plan**

Before making changes, save the current password policy:

aws iam get-account-password-policy > password-policy-backup.json

To roll back:

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the IAM console and select **Account settings** in the left menu.
    
3.  In the **Password policy** section, choose **Edit**.
    
4.  Set the password expiration and the other settings back to the values in the saved backup. If no custom policy existed before, select **IAM default** instead.
    
5.  Choose **Save changes**.
    

Note: rolling back allows passwords to remain valid for longer, or indefinitely. Use it only as a temporary measure.

**Reference**

-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_credentials\_passwords\_account-policy.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/iam/update-account-password-policy.html](https://docs.aws.amazon.com/cli/latest/reference/iam/update-account-password-policy.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/iam/get-account-password-policy.html](https://docs.aws.amazon.com/cli/latest/reference/iam/get-account-password-policy.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.