Back to Checks
huaweicloud

IAM password policy prevents reuse of at least 3 previous passwords

iam_password_policy_reuse_prevention
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Huawei Cloud IAM password policies can prevent users from reusing recent passwords. It is recommended that the policy disallow reuse of at least the last 3 passwords to ensure users choose new passwords upon rotation.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Without password reuse prevention, users can cycle between a small set of passwords, effectively bypassing password rotation policies. This reduces the security benefit of password expiration and increases the risk of credential compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks iam_password_policy_reuse_prevention

Recommendation

Configure the IAM password policy to disallow reuse of at least the last 3 passwords.

Remediation

CLI

hcloud IAM UpdateDomainPasswordPolicy --domain_id=<domain_id> --password_policy.number_of_recent_passwords_disallowed=5

Other

1Log on to the **Huawei Cloud console**.
2Choose **IAM & Security**.
3Click the **Password Policy** tab.
4Set **Number of Recent Passwords Disallowed** to `3` or greater.
5Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.iam.iam_client import iam_client


class iam_password_policy_reuse_prevention(Check):
    """Check if Huawei Cloud IAM password policy prevents password reuse (at least 3 previous passwords)."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        if iam_client.password_policy:
            report = CheckReportHuaweiCloud(
                metadata=self.metadata(), resource=iam_client.password_policy
            )
            report.region = iam_client.region
            report.resource_id = f"{iam_client.audited_account}-password-policy"
            report.resource_name = report.resource_id
            report.resource_arn = (
                f"HUAWEICLOUD::IAM::{iam_client.audited_account}:password-policy"
            )

            if iam_client.password_policy.number_of_recent_passwords_disallowed >= 3:
                report.status = "PASS"
                report.status_extended = f"IAM password policy disallows reuse of the last {iam_client.password_policy.number_of_recent_passwords_disallowed} passwords."
            else:
                report.status = "FAIL"
                report.status_extended = f"IAM password policy only disallows reuse of the last {iam_client.password_policy.number_of_recent_passwords_disallowed} passwords, which is less than the recommended 3."

            findings.append(report)

        return findings

References