AWS::IAM::PasswordPolicy

[amayausky]

2. Scope of request

Allow IAM Password Policy to be set with native CFN versus requiring a lambda + custom resource to call the IAM API directly.

3. Expected behavior

I should be able to set an account's password policy without needing to call the API directly.

5. Helpful Links to speed up research and evaluation

Functionality appears to be missing based on https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_IAM.html

Ended up using https://github.com/widdix/aws-cf-templates/blob/master/security/account-password-policy.yaml as a resource to create this stack.

6. Category (required) - Will help with tagging and be easier to find by other users to +1

Security

[eduardomourar]

While this is not implemented with a public one, you can use this private resource type Community::IAM::PasswordPolicy.

Installation instructions:

aws cloudformation register-type \
  --region us-east-1 \
  --type-name "Community::IAM::PasswordPolicy" \
  --schema-handler-package "s3://community-resource-provider-catalog/community-iam-passwordpolicy-0.2.0.zip" \
  --type RESOURCE \
  --execution-role-arn <ROLE_ARN_WITH_ENOUGH_PRIVILEGE>

Usage example:

AWSTemplateFormatVersion: 2010-09-09
Resources:
  PasswordPolicy:
    Type: Community::IAM::PasswordPolicy
    Properties:
      MinimumPasswordLength: 6
      RequireSymbols: false
      RequireNumbers: true
      RequireUppercaseCharacters: false
      RequireLowercaseCharacters: true
      AllowUsersToChangePassword: true
      MaxPasswordAge: 90
      PasswordReusePrevention: 10
      HardExpiry: false

[kylekluever]

Any update on this?

[kylekluever]

Any update on this?

[suresan]

Customers that use CloudFormation for creating IAM users would benefit to be able to configure Password Policies through the CFN templates instead of doing it manually in every account. IAM password policy can be deployed via following methods – Console, CLI, API.

Request to create a new resource (AWS::IAM::PasswordPolicy). Creation of new resources is owned by service teams, in this case IAM team.