Back to Checks
huaweicloud

IAM password policy requires a minimum length of 14 or greater

iam_account_password_policy
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Huawei Cloud IAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require a minimum of 14 or greater characters for any password. Longer passwords provide exponentially more security against automated password cracking, as the keyspace increases dramatically with each additional character.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Short passwords significantly reduce the effort required for brute force attacks. Passwords shorter than 14 characters can be cracked much faster, potentially compromising confidentiality of user accounts. This can lead to unauthorized access to cloud resources and sensitive data, affecting the integrity and availability of the environment.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks iam_account_password_policy

Recommendation

Configure the IAM password policy to require a minimum password length of 14 characters or greater.

Remediation

CLI

hcloud IAM UpdateDomainPasswordPolicy --domain_id=<domain_id> --password_policy.minimum_password_length=14

Other

1Log on to the **Huawei Cloud console**.
2Choose **IAM & Security**.
3Click the **Password Policy** tab.
4Set **Minimum Password Length** to `14` or greater.
5Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.iam.iam_client import iam_client


class iam_account_password_policy(Check):
    """Check if Huawei Cloud IAM password policy requires minimum length of 14 or greater."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        if iam_client.password_policy:
            report = CheckReportHuaweiCloud(
                metadata=self.metadata(), resource=iam_client.password_policy
            )
            report.region = iam_client.region
            report.resource_id = f"{iam_client.audited_account}-password-policy"
            report.resource_name = report.resource_id
            report.resource_arn = (
                f"HUAWEICLOUD::IAM::{iam_client.audited_account}:password-policy"
            )

            if iam_client.password_policy.minimum_password_length >= 14:
                report.status = "PASS"
                report.status_extended = f"IAM password policy requires minimum length of {iam_client.password_policy.minimum_password_length} characters."
            else:
                report.status = "FAIL"
                report.status_extended = f"IAM password policy requires minimum length of {iam_client.password_policy.minimum_password_length} characters, which is less than the recommended 14 characters."

            findings.append(report)

        return findings

References