- Newest
- Most votes
- Most comments
When you enable the validate_password plugin with these parameters on your Aurora MySQL RDS cluster, it will not automatically affect existing users or force them to change their passwords. The password validation policies only apply when passwords are changed or when new users are created.
After enabling the plugin, you'll need to reset existing passwords manually to ensure they comply with your new validation policies. This is an important step to bring all accounts into compliance with your security standards.
When you submit a password update request through the AWS Management Console, modify-db-instance CLI command, or ModifyDBInstance API operation, RDS initially accepts your request. However, RDS processes the request asynchronously and will only update the password if it meets your defined policies. If the password doesn't comply with the policies, RDS will keep the existing password and log an error event indicating "Unable to reset your password. Error information: Password failed to meet validation rules."
This approach allows for a smoother transition when implementing new password policies, as it doesn't disrupt existing operations but ensures that all future password changes adhere to your security requirements.
Sources
Password validation for RDS for MySQL - Amazon Relational Database Service
Security controls must apply only to new users and future password changes. Existing user accounts and their current passwords must not be modified.
The implementation must not force password resets, re-encrypt existing credentials, or disrupt current authentication flows. All existing applications and services must continue to authenticate using their current credentials without impact.
The goal is to improve security posture for newly created users while ensuring zero disruption to existing workloads.
Hello.
The MySQL documentation states the following, which seems to apply when changing passwords or creating users:
So, if you are an existing user, I don't think it will affect you unless you change your password.
https://dev.mysql.com/doc/refman/8.0/en/validate-password.html
For SQL statements that assign a password supplied as a cleartext value, validate_password checks the password against the current password policy and rejects the password if it is weak (the statement returns an ER_NOT_VALID_PASSWORD error). This applies to the ALTER USER, CREATE USER, and SET PASSWORD statements.
Relevant content
asked 2 years ago
asked 2 years ago
Ill provide you with a simple and short answer that you are safe users who already have a password will not be required to change there password