Check the IAM Account Password Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadPasswordPolicy",
      "Effect": "Allow",
      "Action": [
        "iam:GetAccountPasswordPolicy",
        "iam:ListUsers"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ReadLoginProfiles",
      "Effect": "Allow",
      "Action": "iam:GetLoginProfile",
      "Resource": "arn:aws:iam::123456789012:user/*"
    },
    {
      "Sid": "UpdatePolicyWithApply",
      "Effect": "Allow",
      "Action": "iam:UpdateAccountPasswordPolicy",
      "Resource": "*"
    }
  ]
}

// check-iam-password-policy.ts
// Reads the account password policy for IAM users, compares it with a baseline (CIS: length 14 or more,
// 24 remembered passwords) and counts the IAM users who actually have a console password.
// Report only unless you pass --apply, which writes a complete policy that meets the baseline.
// Usage:
//   npx tsx check-iam-password-policy.ts [--min-length 14] [--reuse 24] [--require-classes] [--apply]
import {
  GetAccountPasswordPolicyCommand,
  GetLoginProfileCommand,
  IAMClient,
  NoSuchEntityException,
  UpdateAccountPasswordPolicyCommand,
  paginateListUsers,
  type PasswordPolicy,
  type UpdateAccountPasswordPolicyCommandInput,
} from "@aws-sdk/client-iam";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const minLength = Number(flag("--min-length") ?? "14");
const reuse = Number(flag("--reuse") ?? "24");
const requireClasses = args.includes("--require-classes"); // also require upper, lower, number and symbol
const apply = args.includes("--apply");
const iam = new IAMClient({ region: process.env.AWS_REGION ?? "us-east-1" }); // IAM is global

interface Check {
  Setting: string;
  Current: string;
  Baseline: string;
  Result: string;
}

async function currentPolicy(): Promise<PasswordPolicy | undefined> {
  try {
    const { PasswordPolicy } = await iam.send(new GetAccountPasswordPolicyCommand({}));
    return PasswordPolicy;
  } catch (err) {
    if (err instanceof NoSuchEntityException) return undefined; // no custom policy: the IAM default applies
    throw err;
  }
}

async function consoleUsers(): Promise<{ total: number; withPassword: number }> {
  let total = 0;
  let withPassword = 0;
  for await (const page of paginateListUsers({ client: iam }, {})) {
    for (const u of page.Users ?? []) {
      total++;
      try {
        await iam.send(new GetLoginProfileCommand({ UserName: u.UserName }));
        withPassword++;
      } catch (err) {
        if (!(err instanceof NoSuchEntityException)) throw err;
      }
    }
  }
  return { total, withPassword };
}

function evaluate(p: PasswordPolicy | undefined): Check[] {
  const show = (v: number | boolean | undefined) => (v === undefined ? "not set" : String(v));
  const checks: Check[] = [
    { Setting: "MinimumPasswordLength", Current: show(p?.MinimumPasswordLength), Baseline: `>= ${minLength}`, Result: (p?.MinimumPasswordLength ?? 0) >= minLength ? "ok" : "FAIL" },
    { Setting: "PasswordReusePrevention", Current: show(p?.PasswordReusePrevention), Baseline: `>= ${reuse}`, Result: (p?.PasswordReusePrevention ?? 0) >= reuse ? "ok" : "FAIL" },
    { Setting: "AllowUsersToChangePassword", Current: show(p?.AllowUsersToChangePassword), Baseline: "true", Result: p?.AllowUsersToChangePassword ? "ok" : "FAIL" },
    { Setting: "MaxPasswordAge", Current: show(p?.MaxPasswordAge), Baseline: "info only", Result: p?.ExpirePasswords ? `passwords expire after ${p.MaxPasswordAge} days` : "no expiry" },
    { Setting: "HardExpiry", Current: show(p?.HardExpiry), Baseline: "info only", Result: p?.HardExpiry ? "admin must reset expired passwords" : "users can reset expired passwords" },
  ];
  const classes = [p?.RequireUppercaseCharacters, p?.RequireLowercaseCharacters, p?.RequireNumbers, p?.RequireSymbols];
  checks.push({
    Setting: "Require upper/lower/number/symbol",
    Current: classes.map((c) => (c ? "Y" : "N")).join("/"),
    Baseline: requireClasses ? "Y/Y/Y/Y" : "info only",
    Result: requireClasses && !classes.every(Boolean) ? "FAIL" : "ok",
  });
  return checks;
}

// UpdateAccountPasswordPolicy has no partial update: any parameter left out reverts to its default,
// so the new policy is built from the current one. MaxPasswordAge and PasswordReusePrevention can't be
// sent as 0; leaving them out is how you ask for "never expire" and "no reuse check".
function desiredPolicy(p: PasswordPolicy | undefined): UpdateAccountPasswordPolicyCommandInput {
  const input: UpdateAccountPasswordPolicyCommandInput = {
    MinimumPasswordLength: Math.max(p?.MinimumPasswordLength ?? 0, minLength),
    PasswordReusePrevention: Math.max(p?.PasswordReusePrevention ?? 0, reuse),
    AllowUsersToChangePassword: true,
    HardExpiry: p?.HardExpiry ?? false,
    RequireUppercaseCharacters: requireClasses || (p?.RequireUppercaseCharacters ?? false),
    RequireLowercaseCharacters: requireClasses || (p?.RequireLowercaseCharacters ?? false),
    RequireNumbers: requireClasses || (p?.RequireNumbers ?? false),
    RequireSymbols: requireClasses || (p?.RequireSymbols ?? false),
  };
  if (p?.ExpirePasswords && p.MaxPasswordAge) input.MaxPasswordAge = p.MaxPasswordAge;
  return input;
}

async function main(): Promise<void> {
  const policy = await currentPolicy();
  console.log(policy ? "Custom account password policy found." : "No custom password policy (NoSuchEntity): the IAM default policy applies.");
  const checks = evaluate(policy);
  console.table(checks);

  const users = await consoleUsers();
  console.log(`${users.withPassword} of ${users.total} IAM users have a console password.`);

  const failed = checks.filter((c) => c.Result === "FAIL").length;
  if (!failed) {
    console.log("The policy meets the baseline.");
    return;
  }
  const input = desiredPolicy(policy);
  if (!apply) {
    console.log(`${failed} setting(s) below baseline. --apply would send:`);
    console.log(JSON.stringify(input, null, 2));
    return;
  }
  await iam.send(new UpdateAccountPasswordPolicyCommand(input));
  console.log("Password policy updated. New rules apply the next time each user sets a password.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-iam
npm install --save-dev tsx typescript @types/node

# Check against CIS defaults
AWS_PROFILE=readonly npx tsx check-iam-password-policy.ts

# Follow NIST's 15 characters instead, then apply
AWS_PROFILE=iam-admin npx tsx check-iam-password-policy.ts --min-length 15 --apply

No custom password policy (NoSuchEntity): the IAM default policy applies.
┌─────────┬─────────────────────────────────────┬───────────┬─────────────┬─────────────────────────────────────┐
│ (index) │ Setting                             │ Current   │ Baseline    │ Result                              │
├─────────┼─────────────────────────────────────┼───────────┼─────────────┼─────────────────────────────────────┤
│ 0       │ 'MinimumPasswordLength'             │ 'not set' │ '>= 14'     │ 'FAIL'                              │
│ 1       │ 'PasswordReusePrevention'           │ 'not set' │ '>= 24'     │ 'FAIL'                              │
│ 2       │ 'AllowUsersToChangePassword'        │ 'not set' │ 'true'      │ 'FAIL'                              │
│ 3       │ 'MaxPasswordAge'                    │ 'not set' │ 'info only' │ 'no expiry'                         │
│ 4       │ 'HardExpiry'                        │ 'not set' │ 'info only' │ 'users can reset expired passwords' │
│ 5       │ 'Require upper/lower/number/symbol' │ 'N/N/N/N' │ 'info only' │ 'ok'                                │
└─────────┴─────────────────────────────────────┴───────────┴─────────────┴─────────────────────────────────────┘
3 of 11 IAM users have a console password.
3 setting(s) below baseline. --apply would send:
{
  "MinimumPasswordLength": 14,
  "PasswordReusePrevention": 24,
  "AllowUsersToChangePassword": true,
  "HardExpiry": false,
  "RequireUppercaseCharacters": false,
  "RequireLowercaseCharacters": false,
  "RequireNumbers": false,
  "RequireSymbols": false
}