By using AWS re:Post, you agree to the AWS re:Post Terms of Use

IAM Password Policies

0

We can apply password Policies for all users in an AWS Account. So is it possible for doing the same for cross-account or deploy password policies in a **organization ** from the head account of the organization.

asked a month ago53 views
2 Answers
3
Accepted Answer

No I am afraid not. Each account has its own IAM password policy.

You need to configure the policy in every account. If using IaC, you can define the password policy on account creation etc or take ownership of the password policy via IaC and define it.

profile picture
EXPERT
answered a month ago
EXPERT
reviewed a month ago
1

Hello,

I'd also add to the above the following considerations:

  • After deploying the password policy, consider implementing an SCP to prevent member accounts from modifying their IAM password policies
  • For enhanced security, consider using AWS Single Sign-On (SSO) instead of IAM users for account access
  • You could also use AWS Config Rules with SSM auto-remediation documents to ensure ongoing compliance with the password policy

You can check this lab on updating the password policy for all IAM users across all AWS accounts: https://github.com/aws-samples/devlab-iam-password-policy

AWS
answered a month ago
profile picture
EXPERT
reviewed a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions