Back to Checks
huaweicloud

IAM password policy requires passwords to expire

iam_password_policy_expires_passwords
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Huawei Cloud IAM password policies can enforce password expiration. It is recommended that the password validity period be set to a non-zero value so that passwords must be rotated periodically, reducing the window of opportunity for compromised credentials.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Without password expiration, compromised passwords can be used indefinitely. Passwords that never expire increase the risk of long-term credential exposure, especially if credentials are leaked but not detected immediately.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks iam_password_policy_expires_passwords

Recommendation

Configure the IAM password policy to require password expiration by setting a non-zero password validity period.

Remediation

CLI

hcloud IAM UpdateDomainPasswordPolicy --domain_id=<domain_id> --password_policy.password_validity_period=90

Other

1Log on to the **Huawei Cloud console**.
2Choose **IAM & Security**.
3Click the **Password Policy** tab.
4Set **Password Validity Period** to a non-zero value (e.g., `90 days`).
5Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.iam.iam_client import iam_client


class iam_password_policy_expires_passwords(Check):
    """Check if Huawei Cloud IAM password policy requires passwords to expire."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        if iam_client.password_policy:
            report = CheckReportHuaweiCloud(
                metadata=self.metadata(), resource=iam_client.password_policy
            )
            report.region = iam_client.region
            report.resource_id = f"{iam_client.audited_account}-password-policy"
            report.resource_name = report.resource_id
            report.resource_arn = (
                f"HUAWEICLOUD::IAM::{iam_client.audited_account}:password-policy"
            )

            if iam_client.password_policy.password_validity_period > 0:
                report.status = "PASS"
                report.status_extended = f"IAM password policy requires passwords to expire after {iam_client.password_policy.password_validity_period} days."
            else:
                report.status = "FAIL"
                report.status_extended = "IAM password policy does not require passwords to expire (password_validity_period is 0)."

            findings.append(report)

        return findings

References