IAM password policy expires passwords within 90 days

Check ID: iam_password_policy_expires_passwords_within_90_days_or_less
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: AwsIamPolicy

What this check verifies

IAM account password policy sets a password expiration period for IAM user console logins; configuration is aligned when rotation is enabled and set to <= 90 days.

Risk

Without rotation, stale passwords persist, enabling credential stuffing, brute force, and password reuse attacks. A compromised IAM user can retain console access, enabling data exfiltration, privilege escalation, and loss of confidentiality and integrity.

Recommendation

Enforce password rotation at <= 90 days and prevent reuse. Pair with MFA, strong length/complexity, and prefer federation/SSO to reduce static passwords. Apply least privilege, monitor sign-ins, and remove inactive console passwords to limit exposure.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam update-account-password-policy —max-password-age 90

# Enforce IAM password expiration within 90 days
resource "aws_iam_account_password_policy" "example" {
  max_password_age = 90  # Critical: enforces password expiration <= 90 days to pass the check
}

# CloudFormation: Set IAM account password policy to expire passwords within 90 days
Resources:
  ExampleAccountPasswordPolicy:
    Type: AWS::IAM::AccountPasswordPolicy
    Properties:
      MaxPasswordAge: 90  # Critical: enforces password expiration in 90 days or less to pass the check

References

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_password_policy_expires_passwords_within_90_days_or_less. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires