IAM password policy prevents reuse of the last 24 passwords

Check ID: iam_password_policy_reuse_24
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: AwsIamPolicy

What this check verifies

IAM account password policy uses password reuse prevention set to 24 remembered passwords (maximum history) for IAM users

Risk

If fewer than 24 passwords are remembered, users can cycle back to recent secrets, undermining rotation. Attackers with previously exposed passwords can regain console access after a change, reducing confidentiality and integrity and increasing success of credential-stuffing with known credentials.

Recommendation

Set the password policy to remember 24 previous passwords to block reuse. Combine with MFA, strong length and complexity, and avoid rotation practices that encourage predictable patterns. Apply least privilege and monitor authentication events as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam update-account-password-policy —password-reuse-prevention 24

resource "aws_iam_account_password_policy" "<example_resource_name>" {
  password_reuse_prevention = 24  # Critical: require last 24 passwords cannot be reused
}

Resources:
  <example_resource_name>:
    Type: AWS::IAM::AccountPasswordPolicy
    Properties:
      PasswordReusePrevention: 24  # Critical: prevents reuse of the last 24 passwords

References

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_password_policy_reuse_24. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

IAM password policy requires at least one number IAM password policy requires at least one symbol

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires