Back to Checks
huaweicloud

IAM password policy requires at least 3 character types

iam_password_policy_char_combination
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Huawei Cloud IAM password policies can enforce character complexity by requiring multiple character types (uppercase, lowercase, digits, special characters). It is recommended that at least 3 character types be required to increase password strength.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Passwords with limited character types are more susceptible to brute force and dictionary attacks. Requiring only 1 or 2 character types significantly reduces the effective keyspace, making passwords easier to crack.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks iam_password_policy_char_combination

Recommendation

Configure the IAM password policy to require at least 3 character types in passwords.

Remediation

CLI

hcloud IAM UpdateDomainPasswordPolicy --domain_id=<domain_id> --password_policy.password_char_combination=3

Other

1Log on to the **Huawei Cloud console**.
2Choose **IAM & Security**.
3Click the **Password Policy** tab.
4Set **Password Character Combination** to `3` or greater.
5Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.iam.iam_client import iam_client


class iam_password_policy_char_combination(Check):
    """Check if Huawei Cloud IAM password policy requires at least 3 character types."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        if iam_client.password_policy:
            report = CheckReportHuaweiCloud(
                metadata=self.metadata(), resource=iam_client.password_policy
            )
            report.region = iam_client.region
            report.resource_id = f"{iam_client.audited_account}-password-policy"
            report.resource_name = report.resource_id
            report.resource_arn = (
                f"HUAWEICLOUD::IAM::{iam_client.audited_account}:password-policy"
            )

            if iam_client.password_policy.password_char_combination >= 3:
                report.status = "PASS"
                report.status_extended = f"IAM password policy requires at least {iam_client.password_policy.password_char_combination} character types in passwords."
            else:
                report.status = "FAIL"
                report.status_extended = f"IAM password policy only requires {iam_client.password_policy.password_char_combination} character type(s), which is less than the recommended 3 (uppercase, lowercase, digits, special characters)."

            findings.append(report)

        return findings

References