Back to Checks
aws

IAM password policy requires passwords to be at least 14 characters long

iam_password_policy_minimum_length_14
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamPolicy

IAM password policy is assessed for the minimum password length setting, confirming it meets >= 14 characters for IAM console users.

Prowler logoProwlerprowler-provider-aws

Risk

Low minimum length reduces entropy, easing brute force and credential stuffing. Compromised IAM users enable console access, unauthorized changes, and lateral movement, leading to data exposure (confidentiality) and tampering (integrity).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_password_policy_minimum_length_14

Recommendation

Set the minimum password length to >= 14 (prefer 16+).

  • Require mixed character types and prevent reuse
  • Enforce MFA for all console users
  • Prefer SSO over local IAM users
  • Apply least privilege and monitor authentication events

Remediation

CLI

aws iam update-account-password-policy --minimum-password-length 14

Terraform

resource "aws_iam_account_password_policy" "<example_resource_name>" {
  minimum_password_length = 14  # Critical: enforces minimum password length >=14
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::IAM::AccountPasswordPolicy
    Properties:
      MinimumPasswordLength: 14  # Critical: sets minimum password length to 14 to pass the check

Other

1Sign in to the AWS Console and open IAM
2Go to Account settings > Password policy and click Edit
3Set Enforce minimum password length to 14
4Click Save changes (and confirm Set custom if prompted)

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_password_policy_minimum_length_14(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        if iam_client.password_policy:
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=iam_client.password_policy
            )
            report.region = iam_client.region
            report.resource_arn = iam_client.password_policy_arn_template
            report.resource_id = iam_client.audited_account
            # Check password policy length
            if (
                iam_client.password_policy.length
                and iam_client.password_policy.length >= 14
            ):
                report.status = "PASS"
                report.status_extended = (
                    "IAM password policy requires minimum length of 14 characters."
                )
            else:
                report.status = "FAIL"
                report.status_extended = "IAM password policy does not require minimum length of 14 characters."
            findings.append(report)
        return findings

References