IAM.7: The IAM password policy is too weak

What does AWS Security Hub IAM.7 check?

IAM.7 fails when the account password policy is missing or weaker than the recommended configuration, checking minimum length, character requirements, and password reuse prevention for IAM users who sign in with passwords.

Why does IAM.7 matter?

Console passwords are a credential an attacker can guess, spray, or reuse from another breach. A weak or absent policy lets users set short, repeated passwords across the account, widening the surface for credential-stuffing. A strong baseline raises the cost of every guessing attempt and standardises hygiene across all human users.

How do I fix IAM.7?

1. Read the current policy with get-account-password-policy to see what's set.
2. Apply a baseline via update-account-password-policy: minimum length of at least 14, require mixed case, numbers and symbols, and prevent reuse of recent passwords.
3. For human users, move to IAM Identity Center so password policy becomes your identity provider's responsibility rather than AWS's.

# Find active credentials idle past 45 days and disable them (review before deleting).
CUTOFF=$(date -u -d '45 days ago' +%Y-%m-%d)
aws iam generate-credential-report >/dev/null
aws iam get-credential-report --query Content --output text | base64 -d \
  | awk -F, -v c="$CUTOFF" 'NR>1 && $9=="true" && $11<c {print $1, $10}'
aws iam update-access-key --user-name old-contractor \
  --access-key-id AKIAIOSFODNN7EXAMPLE --status Inactive

# Apply the CIS-aligned IAM password policy in one idempotent call.
aws iam update-account-password-policy --minimum-password-length 14 \
  --require-uppercase-characters --require-lowercase-characters \
  --require-numbers --require-symbols --password-reuse-prevention 24

# A clear-text key in a build project is compromised: rotate and delete, never just relocate.
aws iam delete-access-key --user-name ci-deploy --access-key-id AKIAIOSFODNN7EXAMPLE