Back to Checks
aws

IAM password policy prevents reuse of the last 24 passwords

iam_password_policy_reuse_24
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamPolicy

IAM account password policy uses password reuse prevention set to 24 remembered passwords (maximum history) for IAM users

Prowler logoProwlerprowler-provider-aws

Risk

If fewer than 24 passwords are remembered, users can cycle back to recent secrets, undermining rotation. Attackers with previously exposed passwords can regain console access after a change, reducing confidentiality and integrity and increasing success of credential-stuffing with known credentials.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_password_policy_reuse_24

Recommendation

Set the password policy to remember 24 previous passwords to block reuse. Combine with MFA, strong length and complexity, and avoid rotation practices that encourage predictable patterns. Apply least privilege and monitor authentication events as part of defense in depth.

Remediation

CLI

aws iam update-account-password-policy --password-reuse-prevention 24

Terraform

resource "aws_iam_account_password_policy" "<example_resource_name>" {
  password_reuse_prevention = 24  # Critical: require last 24 passwords cannot be reused
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::IAM::AccountPasswordPolicy
    Properties:
      PasswordReusePrevention: 24  # Critical: prevents reuse of the last 24 passwords

Other

1Open the AWS Management Console and go to IAM
2In the left menu, select Account settings
3In Password policy, click Edit
4Select Custom (if not already)
5Set Prevent password reuse to 24
6Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_password_policy_reuse_24(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        if iam_client.password_policy:
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=iam_client.password_policy
            )
            report.region = iam_client.region
            report.resource_arn = iam_client.password_policy_arn_template
            report.resource_id = iam_client.audited_account
            # Check if reuse prevention flag is set
            if (
                iam_client.password_policy.reuse_prevention
                and iam_client.password_policy.reuse_prevention == 24
            ):
                report.status = "PASS"
                report.status_extended = (
                    "IAM password policy reuse prevention is equal to 24."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    "IAM password policy reuse prevention is less than 24 or not set."
                )
            findings.append(report)
        return findings

References