Description

Ensure that the AWS account's IAM password policy requires IAM user passwords to contain at least one number (0-9). The password policy applies to all IAM users who sign in to the AWS Management Console with a password.

Rationale

Passwords without numbers have fewer possible combinations, which makes brute-force and credential stuffing attacks more effective. A compromised IAM user password gives an attacker console access to the account, allowing unauthorized changes, data exposure and deletion of resources. Requiring at least one number, together with a strong minimum length, mixed-case letters, symbols and password reuse prevention, makes passwords harder to guess.

Impact

  • Strengthens IAM user passwords against brute-force and password-guessing attacks

  • Existing passwords are not changed immediately; the new rule applies the next time each user creates or changes their password

  • Users must include a number in new passwords, which may require communicating the change to them in advance

Default Value

No custom password policy is set by default. Without a custom policy, AWS applies its default rules, which do not require a number.

Pre-Requisites

  • IAM permissions: iam:GetAccountPasswordPolicy and iam:UpdateAccountPasswordPolicy

  • Agreement on the other password policy settings to keep (for example, minimum length, character types, password reuse and expiration), because updating the policy replaces all of its settings

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Account settings in the left menu.

  3. In the Password policy section, check whether Require at least one number is enabled.

  4. If no custom password policy is set, or the number requirement is not enabled, follow the implementation steps.

CLI:

Show the current password policy:

aws iam get-account-password-policy

The account fails if RequireNumbers is false, or if the command returns a NoSuchEntity error (no custom policy is set, so numbers are not required).

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Account settings in the left menu.

  3. In the Password policy section, choose Edit.

  4. Select Custom (if the default policy is in use).

  5. Select Require at least one number.

  6. Leave the other password settings as they are, unless they also need to be changed.

  7. Choose Save changes.

CLI:

Require at least one number in passwords:

aws iam update-account-password-policy --require-numbers

This command replaces the whole password policy, and any setting not included reverts to its default. To keep the existing settings, add the matching options from the Test Plan output, for example:

aws iam update-account-password-policy --require-numbers --minimum-password-length 14 --require-uppercase-characters --require-lowercase-characters --require-symbols --allow-users-to-change-password --password-reuse-prevention 24 --max-password-age 90

Backout Plan

Before making changes, save the current password policy:

aws iam get-account-password-policy > password-policy-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Account settings in the left menu.

  3. In the Password policy section, choose Edit.

  4. Clear Require at least one number and set the other settings back to the values in the saved backup. If no custom policy existed before, select IAM default instead.

  5. Choose Save changes.

Note: rolling back allows weaker passwords without numbers again. Use it only as a temporary measure.

Reference