Check provider logo

IAM password policy prevents reuse of the last 24 passwords

iam_password_policy_reuse_24

Severitymedium
Serviceiam
by Prowler
identity-access

IAM account password policy uses password reuse prevention set to 24 remembered passwords (maximum history) for IAM users

Risk

If fewer than 24 passwords are remembered, users can cycle back to recent secrets, undermining rotation. Attackers with previously exposed passwords can regain console access after a change, reducing confidentiality and integrity and increasing success of credential-stuffing with known credentials.

Run this check with Prowler CLI

prowler aws --checks iam_password_policy_reuse_24

Run in Prowler Cloud
Fix finding with Prowler CLI

prowler aws --checks iam_password_policy_reuse_24 --fixer

Recommendation

Set the password policy to remember 24 previous passwords to block reuse. Combine with MFA, strong length and complexity, and avoid rotation practices that encourage predictable patterns. Apply least privilege and monitor authentication events as part of defense in depth.

Remediation

CLI

aws iam update-account-password-policy --password-reuse-prevention 24

Native IaC
Terraform
Other
  1. Open the AWS Management Console and go to IAM
  2. In the left menu, select Account settings
  3. In Password policy, click Edit
  4. Select Custom (if not already)
  5. Set Prevent password reuse to 24
  6. Click Save changes

Source Code

Resource Type

AwsIamPolicy

References