IAM password policy has no minimum length of its own (the API default of 6 applies)

What it checks

IAM password policy has no minimum length of its own (the API default of 6 applies)

Where it applies

Terraform: aws_iam_account_password_policy

CloudFormation: no CloudFormation type maps to these resources yet.

How to fix it

1. Set minimum_password_length = 14 on the existing account password policy. Preserve its other settings; the minimum applies on the next password change and does not force existing users to rotate.

Frameworks

• AWS FSBP IAM.15
• CIS AWS Foundations Benchmark v5.0.0 1.7

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules