Password Policy

What is a Password Policy?

A Password Policy defines the password requirements that users must follow when creating or resetting their passwords. It helps organizations enforce strong passwords and improve account security.

Password policies are configured at the account level by the Root User. Once configured, the same policy applies to:

• The Root User

• All IAM Users belonging to the account

If no account-specific password policy exists, the system automatically uses the default password policy.

Why Use a Password Policy?

Password policies help protect accounts from weak or compromised passwords by enforcing security requirements such as:

• Minimum and maximum password length

• Character complexity

• Password expiration

• Password history

• MFA enforcement

Using a password policy helps organizations meet security and compliance requirements while reducing the risk of unauthorized access.

How Password Policies Work

When a user creates, resets, or signs in with a password, IAM validates the password against the applicable password policy.

The system checks policies in the following order:

Account Password Policy

↓

(Default if none exists)

↓

Default Password Policy

If no account-specific policy exists, the default policy is automatically used.

Password Policy Settings

A password policy can include the following settings.

Organizations can configure:

Setting	Description
Minimum Length	Minimum allowed password length
Maximum Length	Maximum allowed password length
Uppercase Letters	Require uppercase characters
Lowercase Letters	Require lowercase characters
Numbers	Require numeric characters
Symbols	Require special characters
Password Expiration	Maximum password lifetime
Password History	Prevent reuse of recent passwords
MFA Requirement	Require MFA for all users

Password Policy Example

The following example shows a password policy configured for an account.

{

"minPasswordLength": 8,

"maxPasswordLength": 22,

"requireUppercase": true,

"requireLowercase": true,

"requireNumbers": true,

"requireSymbols": true,

"expirationDays": 2,

"passwordChangeOnFirstLogin": false,

"mfaEnable": true,

"passwordHistoryLimit": 5,

"lockoutAfterFailedAttempts": 5,

"lockoutDurationMinutes": 5

}

What This Policy Enforces

This password policy requires users to:

• Create passwords between 8 and 22 characters long.

• Include at least one uppercase letter.

• Include at least one lowercase letter.

• Include at least one number.

• Include at least one special character.

• Change their password every 2 days.

• Enable Multi-Factor Authentication (MFA).

• Avoid reusing their last 5 passwords.

• After 5 consecutive failed login attempts, the account is locked temporarily for 5 minutes.

The following fields are managed automatically by the system and are returned when retrieving the password policy:

• createdAt

• createdBy

• updatedAt

• updatedBy

• accountId

These fields are maintained by IAM for auditing and tracking purposes.

Creating a Password Policy

Root Users can create a custom password policy for their organization.

When a password policy is created:

• It becomes the active policy for the account.

• It applies to both the Root User and all IAM Users.

• New passwords must satisfy the configured rules.

A password policy must include:

• Minimum password length

• Maximum password length

• Password expiration period

• Character requirements

Optional settings such as password history, MFA enforcement, and account lockout can also be configured.

Updating a Password Policy

Password policies can be updated at any time.

Changes take effect immediately.

If the updated policy is more restrictive than the previous one, existing passwords may no longer satisfy the new requirements.

In such cases, users will be required to reset their passwords during their next sign-in.

Examples include:

• Increasing minimum password length

• Requiring special characters

• Enabling uppercase requirements

• Enabling password expiration

Deleting a Password Policy

An account-specific password policy can be deleted.

When deleted:

• The account automatically falls back to the system default password policy.

• Users continue to authenticate normally if their passwords satisfy the default policy.

• Otherwise, users are prompted to reset their passwords.

Password Validation

Password validation occurs during:

• User creation

• Password reset

• Password change

The password must satisfy every enabled rule in the active password policy before it is accepted.

Password Expiration

Password policies can define how long a password remains valid.

Once the configured expiration period is reached, users are required to change their password before they can continue accessing their account.

The user receives a message similar to:

Password expired. Please change your password to continue.

Password History

Password history prevents users from reusing recently used passwords.

If enabled:

• Previously used passwords cannot be reused until they fall outside the configured history limit.

This helps prevent users from repeatedly alternating between the same passwords.

MFA Requirement

A password policy can require users to enable Multi-Factor Authentication (MFA).

When MFA enforcement is enabled:

• IAM Users must enable MFA.

• Users cannot disable MFA while the policy requires it.

• Root Users can modify the password policy to remove the requirement if needed.

Account Lockout

To reduce brute-force attacks, password policies support temporary account lockout.

When enabled:

• Accounts are locked after the configured number of failed login attempts.

• Accounts remain locked for the configured duration.

• Users can sign in again after the lockout period expires.

User Password Metadata

IAM maintains password-related metadata to support password expiration, security monitoring, and auditing.

Best Practices

For better account security, consider the following recommendations:

• Use passwords with at least 12 characters.

• Require uppercase, lowercase, numbers, and symbols.

• Enable password expiration where required by your organization's security policy.

• Enable password history to prevent password reuse.

• Require MFA for all users.

• Configure account lockout to protect against repeated login attempts.