IAM password policy requires 14 or more characters

Check ID: iam_password_policy_minimum_length_14
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: AwsIamPolicy

What this check verifies

IAM password policy is assessed for the minimum password length setting, confirming it meets >= 14 characters for IAM console users.

Risk

Low minimum length reduces entropy, easing brute force and credential stuffing. Compromised IAM users enable console access, unauthorized changes, and lateral movement, leading to data exposure (confidentiality) and tampering (integrity).

Recommendation

Set the minimum password length to >= 14 (prefer 16+).

Require mixed character types and prevent reuse
Enforce MFA for all console users
Prefer SSO over local IAM users
Apply least privilege and monitor authentication events

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam update-account-password-policy —minimum-password-length 14

resource "aws_iam_account_password_policy" "<example_resource_name>" {
  minimum_password_length = 14  # Critical: enforces minimum password length >=14
}

Resources:
  <example_resource_name>:
    Type: AWS::IAM::AccountPasswordPolicy
    Properties:
      MinimumPasswordLength: 14  # Critical: sets minimum password length to 14 to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_password_policy_minimum_length_14. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires