Back to Checks
huaweicloud

IAM password policy enforces a minimum password age

iam_password_policy_minimum_age
Service: iamSeverity: low
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Huawei Cloud IAM password policies can enforce a minimum password age, preventing users from changing passwords too frequently. This works in conjunction with password reuse prevention to ensure users cannot cycle through disallowed passwords to reuse an old one.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Without a minimum password age, users can immediately change their password multiple times to exhaust the reuse prevention list and set their password back to a previously used value, effectively bypassing reuse prevention controls.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks iam_password_policy_minimum_age

Recommendation

Configure the IAM password policy to enforce a minimum password age of at least 1 day.

Remediation

CLI

hcloud IAM UpdateDomainPasswordPolicy --domain_id=<domain_id> --password_policy.minimum_password_age=60

Other

1Log on to the **Huawei Cloud console**.
2Choose **IAM & Security**.
3Click the **Password Policy** tab.
4Set **Minimum Password Age** to at least `1 day`.
5Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.iam.iam_client import iam_client


class iam_password_policy_minimum_age(Check):
    """Check if Huawei Cloud IAM password policy enforces a minimum password age."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        if iam_client.password_policy:
            report = CheckReportHuaweiCloud(
                metadata=self.metadata(), resource=iam_client.password_policy
            )
            report.region = iam_client.region
            report.resource_id = f"{iam_client.audited_account}-password-policy"
            report.resource_name = report.resource_id
            report.resource_arn = (
                f"HUAWEICLOUD::IAM::{iam_client.audited_account}:password-policy"
            )

            if iam_client.password_policy.minimum_password_age > 0:
                report.status = "PASS"
                report.status_extended = f"IAM password policy enforces a minimum password age of {iam_client.password_policy.minimum_password_age} days."
            else:
                report.status = "FAIL"
                report.status_extended = "IAM password policy does not enforce a minimum password age (minimum_password_age is 0), allowing users to change passwords immediately and bypass reuse prevention."

            findings.append(report)

        return findings

References