📝 AWS Account IAM Password Policy Number of passwords to remember is not set to 24 🟢

• Contextual name: 📝 IAM Password Policy Number of passwords to remember is not set to 24 🟢
• ID: /ce/ca/aws/account/password-policy-number-of-passwords-to-remember-24
• Located in: 📁 AWS Account

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • IAM Password Policy
• Internal
  • dec-x-f7c2faac

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-f7c2faac	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 AWS Account
  • 🔌 AWS IAM Password Policy - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.

Rationale

Preventing password reuse increases account resiliency against brute force login attempts.

Audit

Perform the following to ensure the password policy is configured as prescribed:

From Console

1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings).
2. Go to IAM Service on the AWS Console.
3. Click on Account Settings on the Left Pane.
4. Ensure Prevent password reuse is checked.
5. Ensure Number of passwords to remember is set to 24.

From Command Line

1. Run the following command:

aws iam get-account-password-policy

Ensure the output of the above command includes "PasswordReusePrevention": 24.

References

1. CCE-78908-1
2. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html
3. https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#configure-strong-password-policy

Remediation

Open File

Remediation

Perform the following to set the password policy as prescribed:

From Console

1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings).
2. Go to IAM Service on the AWS Console.
3. Click on Account Settings on the Left Pane.
4. Check Prevent password reuse.
5. Set Number of passwords to remember is set to 24.

From Command Line

1. Run the following command:

aws iam update-account-password-policy --password-reuse-prevention 24

Note: All commands starting with aws iam update-account-password-policy can be combined into a single command.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 4 Regulated entities would typically put in place processes to ensure that identities and credentials are issued, managed, verified, revoked and audited for authorised devices, users and software/processes.		8	8
💼 APRA CPG 234 → 💼 5 The strength of identification and authentication would typically be commensurate with the impact should an identity be falsified. Common techniques for increasing the strength of identification and authentication include the use of strong password techniques (i.e. length, complexity, re-use limitations and frequency of change), utilisation of cryptographic techniques and increasing the number and type of authentication factors used. Authentication factors include something an individual: a. knows - for example, user IDs and passwords; b. has - for example, a security token or other devices in the person’s possession used for the generation of one-time passwords; c. is - for example, retinal scans, hand scans, signature scans, digital signature, voice scans or other biometrics.		3	3
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [IAM.7] Password policies for IAM users should have strong configurations		1	2
💼 CIS AWS v1.2.0 → 💼 1.10 Ensure IAM password policy prevents password reuse		1	1
💼 CIS AWS v1.3.0 → 💼 1.9 Ensure IAM password policy prevents password reuse		1	1
💼 CIS AWS v1.4.0 → 💼 1.9 Ensure IAM password policy prevents password reuse		1	1
💼 CIS AWS v1.5.0 → 💼 1.9 Ensure IAM password policy prevents password reuse - Level 1 (Automated)		1	1
💼 CIS AWS v2.0.0 → 💼 1.9 Ensure IAM password policy prevents password reuse - Level 1 (Automated)		1	1
💼 CIS AWS v3.0.0 → 💼 1.9 Ensure IAM password policy prevents password reuse - Level 1 (Automated)		1	1
💼 CIS AWS v4.0.0 → 💼 1.9 Ensure IAM password policy prevents password reuse (Automated)			1
💼 CIS AWS v4.0.1 → 💼 1.9 Ensure IAM password policy prevents password reuse (Automated)			1
💼 CIS AWS v5.0.0 → 💼 1.8 Ensure IAM password policy prevents password reuse (Automated)			1
💼 Cloudaware Framework → 💼 Credential Lifecycle Management			17
💼 FedRAMP High Security Controls → 💼 AC-2(1) Automated System Account Management (M)(H)			16
💼 FedRAMP High Security Controls → 💼 AC-2(3) Disable Accounts (M)(H)			4
💼 FedRAMP High Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	6	14	20
💼 FedRAMP High Security Controls → 💼 IA-5(1) Password-based Authentication (L)(M)(H)		1	4
💼 FedRAMP Low Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	1		20
💼 FedRAMP Low Security Controls → 💼 IA-5(1) Password-based Authentication (L)(M)(H)			4
💼 FedRAMP Moderate Security Controls → 💼 AC-2(1) Automated System Account Management (M)(H)			16
💼 FedRAMP Moderate Security Controls → 💼 AC-2(3) Disable Accounts (M)(H)			4
💼 FedRAMP Moderate Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	4		20
💼 FedRAMP Moderate Security Controls → 💼 IA-5(1) Password-based Authentication (L)(M)(H)			4
💼 GDPR → 💼 Art. 25 Data protection by design and by default		10	10
💼 ISO/IEC 27001:2013 → 💼 A.9.3.1 Use of secret authentication information		3	3
💼 ISO/IEC 27001:2013 → 💼 A.9.4.3 Password management system		1	1
💼 ISO/IEC 27001:2022 → 💼 5.17 Authentication information		1	1
💼 NIST CSF v1.1 → 💼 PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes		19	22
💼 NIST CSF v1.1 → 💼 PR.AC-6: Identities are proofed and bound to credentials and asserted in interactions		4	8
💼 NIST CSF v1.1 → 💼 PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks)		19	22
💼 NIST CSF v2.0 → 💼 PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization			23
💼 NIST CSF v2.0 → 💼 PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions			8
💼 NIST CSF v2.0 → 💼 PR.AA-03: Users, services, and hardware are authenticated			22
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties			58
💼 NIST SP 800-53 Revision 4 → 💼 IA-5 AUTHENTICATOR MANAGEMENT	15	2	2
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(1) Account Management _ Automated System Account Management		4	16
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(3) Account Management _ Disable Accounts		1	4
💼 NIST SP 800-53 Revision 5 → 💼 AC-3(15) Access Enforcement _ Discretionary and Mandatory Access Control			10
💼 NIST SP 800-53 Revision 5 → 💼 IA-5(1) Authenticator Management _ Password-based Authentication			4
💼 PCI DSS v3.2.1 → 💼 8.2.3 Passwords/passphrases must have complexity and strength.		1	2
💼 PCI DSS v3.2.1 → 💼 8.2.5 Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used.		1	2
💼 PCI DSS v4.0.1 → 💼 8.3.6 If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they meet the minimum level of complexity.			2
💼 PCI DSS v4.0.1 → 💼 8.3.7 Individuals are not allowed to submit a new password/passphrase that is the same as any of the last four passwords/passphrases used.			2
💼 PCI DSS v4.0 → 💼 8.3.6 If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they meet the minimum level of complexity.			2
💼 PCI DSS v4.0 → 💼 8.3.7 Individuals are not allowed to submit a new password/passphrase that is the same as any of the last four passwords/passphrases used.			2
💼 UK Cyber Essentials → 💼 2.1.2 Change any default or guessable account passwords		2	3
💼 UK Cyber Essentials → 💼 4.2.2 Use technical controls to manage the quality of passwords.		2	3
💼 UK Cyber Essentials → 💼 4.2.3 Support users to choose unique passwords for their work accounts		1	1
💼 UK Cyber Essentials → 💼 4.2.4 The password element of the multi-factor authentication		2	3