Description

Ensure that the AWS account's IAM password policy prevents IAM users from reusing any of their last 24 passwords. The password policy applies to all IAM users who sign in to the AWS Management Console with a password.

Rationale

If users can switch back to a recently used password, password changes lose their value. An attacker who has obtained an earlier password, for example from a data breach, can regain console access after the user cycles back to it, allowing unauthorized changes and data exposure. Remembering 24 previous passwords, the maximum IAM allows, blocks this reuse.

Impact

  • Prevents users from cycling back to old, possibly exposed passwords

  • Existing passwords are not changed immediately; the new rule applies the next time each user changes their password

  • Users must choose a password that differs from their last 24, which may require communicating the change to them in advance

Default Value

No custom password policy is set by default. Without a custom policy, AWS applies its default rules, which do not prevent password reuse.

Pre-Requisites

  • IAM permissions: iam:GetAccountPasswordPolicy and iam:UpdateAccountPasswordPolicy

  • Agreement on the other password policy settings to keep (for example, minimum length, character types and expiration), because updating the policy replaces all of its settings

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Account settings in the left menu.

  3. In the Password policy section, check whether Prevent password reuse is enabled and how many passwords are remembered.

  4. If no custom password policy is set, password reuse prevention is disabled, or fewer than 24 passwords are remembered, follow the implementation steps.

CLI:

Show the current password policy:

aws iam get-account-password-policy

The account fails if PasswordReusePrevention is missing or is not 24, or if the command returns a NoSuchEntity error (no custom policy is set, so password reuse is allowed).

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Account settings in the left menu.

  3. In the Password policy section, choose Edit.

  4. Select Custom (if the default policy is in use).

  5. Select Prevent password reuse and set the number of remembered passwords to 24.

  6. Leave the other password settings as they are, unless they also need to be changed.

  7. Choose Save changes.

CLI:

Prevent reuse of the last 24 passwords:

aws iam update-account-password-policy --password-reuse-prevention 24

This command replaces the whole password policy, and any setting not included reverts to its default. To keep the existing settings, add the matching options from the Test Plan output, for example:

aws iam update-account-password-policy --password-reuse-prevention 24 --minimum-password-length 14 --require-uppercase-characters --require-lowercase-characters --require-numbers --require-symbols --allow-users-to-change-password --max-password-age 90

Backout Plan

Before making changes, save the current password policy:

aws iam get-account-password-policy > password-policy-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Account settings in the left menu.

  3. In the Password policy section, choose Edit.

  4. Set Prevent password reuse and the other settings back to the values in the saved backup. If no custom policy existed before, select IAM default instead.

  5. Choose Save changes.

Note: rolling back allows users to reuse recent passwords again. Use it only as a temporary measure.

Reference