> For the complete documentation index, see [llms.txt](https://docs.cloud.olakrutrim.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloud.olakrutrim.com/basics/identity-access-management/password-policy.md).
# Password Policy
### What is a Password Policy?
A Password Policy defines the password requirements that users must follow when creating or resetting their passwords. It helps organizations enforce strong passwords and improve account security.
Password policies are configured at the account level by the Root User. Once configured, the same policy applies to:
* The Root User
* All IAM Users belonging to the account
If no account-specific password policy exists, the system automatically uses the default password policy.
### Why Use a Password Policy?
Password policies help protect accounts from weak or compromised passwords by enforcing security requirements such as:
* Minimum and maximum password length
* Character complexity
* Password expiration
* Password history
* MFA enforcement
Using a password policy helps organizations meet security and compliance requirements while reducing the risk of unauthorized access.
### How Password Policies Work
When a user creates, resets, or signs in with a password, IAM validates the password against the applicable password policy.
The system checks policies in the following order:
Account Password Policy
↓
(Default if none exists)
↓
Default Password Policy
If no account-specific policy exists, the default policy is automatically used.
### Password Policy Settings
A password policy can include the following settings.
Organizations can configure:
| Setting | Description |
| ------------------- | --------------------------------- |
| Minimum Length | Minimum allowed password length |
| Maximum Length | Maximum allowed password length |
| Uppercase Letters | Require uppercase characters |
| Lowercase Letters | Require lowercase characters |
| Numbers | Require numeric characters |
| Symbols | Require special characters |
| Password Expiration | Maximum password lifetime |
| Password History | Prevent reuse of recent passwords |
| MFA Requirement | Require MFA for all users |
### Password Policy Example
The following example shows a password policy configured for an account.
{
"minPasswordLength": 8,
"maxPasswordLength": 22,
"requireUppercase": true,
"requireLowercase": true,
"requireNumbers": true,
"requireSymbols": true,
"expirationDays": 2,
"passwordChangeOnFirstLogin": false,
"mfaEnable": true,
"passwordHistoryLimit": 5,
"lockoutAfterFailedAttempts": 5,
"lockoutDurationMinutes": 5
}
#### What This Policy Enforces
This password policy requires users to:
* Create passwords between 8 and 22 characters long.
* Include at least one uppercase letter.
* Include at least one lowercase letter.
* Include at least one number.
* Include at least one special character.
* Change their password every 2 days.
* Enable Multi-Factor Authentication (MFA).
* Avoid reusing their last 5 passwords.
* After 5 consecutive failed login attempts, the account is locked temporarily for 5 minutes.
The following fields are managed automatically by the system and are returned when retrieving the password policy:
* createdAt
* createdBy
* updatedAt
* updatedBy
* accountId
These fields are maintained by IAM for auditing and tracking purposes.
### Creating a Password Policy
Root Users can create a custom password policy for their organization.
When a password policy is created:
* It becomes the active policy for the account.
* It applies to both the Root User and all IAM Users.
* New passwords must satisfy the configured rules.
A password policy must include:
* Minimum password length
* Maximum password length
* Password expiration period
* Character requirements
Optional settings such as password history, MFA enforcement, and account lockout can also be configured.
### Updating a Password Policy
Password policies can be updated at any time.
Changes take effect immediately.
If the updated policy is more restrictive than the previous one, existing passwords may no longer satisfy the new requirements.
In such cases, users will be required to reset their passwords during their next sign-in.
Examples include:
* Increasing minimum password length
* Requiring special characters
* Enabling uppercase requirements
* Enabling password expiration
Deleting a Password Policy
An account-specific password policy can be deleted.
When deleted:
* The account automatically falls back to the system default password policy.
* Users continue to authenticate normally if their passwords satisfy the default policy.
* Otherwise, users are prompted to reset their passwords.
### Password Validation
Password validation occurs during:
* User creation
* Password reset
* Password change
The password must satisfy every enabled rule in the active password policy before it is accepted.
### Password Expiration
Password policies can define how long a password remains valid.
Once the configured expiration period is reached, users are required to change their password before they can continue accessing their account.
The user receives a message similar to:
Password expired. Please change your password to continue.
### Password History
Password history prevents users from reusing recently used passwords.
If enabled:
* Previously used passwords cannot be reused until they fall outside the configured history limit.
This helps prevent users from repeatedly alternating between the same passwords.
### MFA Requirement
A password policy can require users to enable Multi-Factor Authentication (MFA).
When MFA enforcement is enabled:
* IAM Users must enable MFA.
* Users cannot disable MFA while the policy requires it.
* Root Users can modify the password policy to remove the requirement if needed.
### Account Lockout
To reduce brute-force attacks, password policies support temporary account lockout.
When enabled:
* Accounts are locked after the configured number of failed login attempts.
* Accounts remain locked for the configured duration.
* Users can sign in again after the lockout period expires.
### User Password Metadata
IAM maintains password-related metadata to support password expiration, security monitoring, and auditing.
### Best Practices
For better account security, consider the following recommendations:
* Use passwords with at least 12 characters.
* Require uppercase, lowercase, numbers, and symbols.
* Enable password expiration where required by your organization's security policy.
* Enable password history to prevent password reuse.
* Require MFA for all users.
* Configure account lockout to protect against repeated login attempts.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.cloud.olakrutrim.com/basics/identity-access-management/password-policy.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.