Enforce 14-Character Minimum IAM Password Policy

Overview

Enforce a stronger IAM password policy across your AWS accounts by requiring passwords to be at least 14 characters long. The plan helps you first understand the current password policies in each account, then guides you in approving target settings, applies the updated minimum length while preserving other policy attributes, and finally validates that all accounts meet the new requirement.

By the end, each in-scope AWS account will have a clearly documented password policy with a minimum length of 14 characters or higher, along with reports you can use for audit and future governance.

Execution Details

Assessment

In the assessment phase, you inventory and review the existing IAM password policies across all in-scope AWS accounts.

• Collect a definitive list of AWS accounts where the password policy should be evaluated.
• For each account, retrieve the current IAM account password policy, noting if no policy is set (and therefore no enforced minimum length).
• Capture key attributes for each policy, including:
  • Minimum password length
  • Requirements for uppercase, lowercase, numbers, and non-alphanumeric symbols
  • Password reuse prevention settings (if configured)
  • Maximum password age (if configured)
• Classify each account’s current minimum length as less than 14, exactly 14, or greater than 14 characters.
• Store the policy details in a structured, referenceable format (such as a table or data file), including any retrieval errors or anomalies.
• Guide the user through reviewing this summary and approving the target minimum password length per account, ensuring it is at least 14 characters and within IAM limits.
• If needed, differentiate targets by environment (for example, stricter minimums in production than non-production).
• Document any constraints that might impact raising the minimum length, such as legacy application limits or identity provider integrations.
• Confirm whether other password policy elements (complexity, rotation, reuse prevention) should remain unchanged or be adjusted together with the minimum length.
• Produce and store a final mapping of each account to its approved target minimum length, along with notes on which policy attributes should be preserved or are out of scope.

Configuration

In the configuration phase, the approved minimum lengths are applied to each account’s IAM password policy.

• Retrieve the approved target minimum password length for each in-scope account from the assessment outputs.
• For each account, fetch the latest IAM password policy again to use as an up-to-date baseline.
• Prepare an updated password policy for each account that:
  • Sets the minimum password length to the approved value.
  • Preserves all other existing policy fields unless the user explicitly requested changes.
• For accounts that do not yet have a password policy, define a new policy that:
  • Sets at least the approved minimum password length.
  • Incorporates any default or organization-standard complexity requirements specified by the user.
• Apply the updated password policy to each account.
• After applying changes, retrieve the password policy again to verify that:
  • The minimum password length matches the approved value.
  • Other preserved settings remain as intended.
• Record any accounts where the update could not be completed, along with detailed error information and the currently observed policy.
• Generate a configuration summary that shows, for each account, the previous and new minimum password lengths, whether the update succeeded, and any accounts needing follow-up remediation.

Validation

In the validation phase, you confirm that all targeted accounts now enforce a minimum IAM password length of at least 14 characters and align with the approved targets.

• Retrieve the list of in-scope accounts along with their approved target minimum password lengths.
• For each account, fetch the current IAM password policy.
• Verify that a password policy exists and explicitly sets a minimum password length.
• Compare the configured minimum length to the approved target to ensure:
  • It matches the planned value.
  • It is at least 14 characters.
• Identify and document any accounts where the minimum length is below 14 or does not match the approved target, marking them for remediation.
• Optionally, describe and, if in scope, perform a spot check (for example, in a non-production account) to confirm that attempts to set a password shorter than the minimum are rejected, and capture the results.
• Produce a validation report summarizing, for each in-scope account:
  • The effective minimum password length.
  • Whether it meets or exceeds 14 characters and matches the approved target.
  • Any accounts requiring further remediation or reapplication of the policy.