Check provider logo

IAM password policy requires passwords to be at least 14 characters long

iam_password_policy_minimum_length_14

Severitymedium
Serviceiam
by Prowler
identity-access

IAM password policy is assessed for the minimum password length setting, confirming it meets >= 14 characters for IAM console users.

Risk

Low minimum length reduces entropy, easing brute force and credential stuffing. Compromised IAM users enable console access, unauthorized changes, and lateral movement, leading to data exposure (confidentiality) and tampering (integrity).

Run this check with Prowler CLI

prowler aws --checks iam_password_policy_minimum_length_14

Run in Prowler Cloud
Fix finding with Prowler CLI

prowler aws --checks iam_password_policy_minimum_length_14 --fixer

Recommendation

Set the minimum password length to >= 14 (prefer 16+).

  • Require mixed character types and prevent reuse
  • Enforce MFA for all console users
  • Prefer SSO over local IAM users
  • Apply least privilege and monitor authentication events

Remediation

CLI

aws iam update-account-password-policy --minimum-password-length 14

Native IaC
Terraform
Other
  1. Sign in to the AWS Console and open IAM
  2. Go to Account settings > Password policy and click Edit
  3. Set Enforce minimum password length to 14
  4. Click Save changes (and confirm Set custom if prompted)

Source Code

Resource Type

AwsIamPolicy

References