cmc/cleberg.net
My personal web garden & blog.
clone: git clone https://gitbay.org/cmc/cleberg.net.git
fa252874584e7590c487014ad490d0ea6580bfcb
signed_unknown_key
author: Christian Cleberg <hello@cleberg.net> · 2026-02-22T06:19:02Z
committer: <noreply@github.com>
content/blog/2026-02-21-auditing-aws-passwords.org | 48 ++++++++++++---------- 1 file changed, 26 insertions(+), 22 deletions(-) @@ -29,11 +29,12 @@ testing. The process runs in two steps: 1. ~gather_policy.sh~ calls the AWS CLI to fetch the current IAM password policy, -captures metadata (timestamp, AWS account, region, caller identity), and writes -everything to a JSON file. This file is evidence of the policy's current state. -2. ~evaluate_policy.py~ reads that JSON file, prompts you for the expected value of -each setting, and exports a CSV report with a value of ~PASS~ or ~FAIL~ for each -rule. + captures metadata (timestamp, AWS account, region, caller identity), and + writes everything to a JSON file. This file is evidence of the policy's + current state. +2. ~evaluate_policy.py~ reads that JSON file, prompts you for the expected value + of each setting, and exports a CSV report with a value of ~PASS~ or ~FAIL~ for + each rule. * Prerequisites @@ -182,32 +183,35 @@ allows you to prove that the data was not modified after the script was run. * Common Exceptions and False Positives - *No policy defined*: If ~gather_policy.sh~ exits with a ~NoSuchEntity~ error, the -account has no IAM password policy configured. If you were expecting a password -policy, document it as a missing control. + account has no IAM password policy configured. If you were expecting a + password policy, document it as a missing control. - *HardExpiry: false*: This setting controls whether users are locked out -immediately when their password expires or given a grace period to change it. -~false~ is often intentional to avoid lockouts. Check the organization's policy -before calling it a finding. Additionally, check if the organization has -security exceptions in place before noting a deficiency. + immediately when their password expires or given a grace period to change it. + ~false~ is often intentional to avoid lockouts. Check the organization's policy + before calling it a finding. Additionally, check if the organization has + security exceptions in place before noting a deficiency. - *MaxPasswordAge and forced rotation*: A 90-day rotation requirement is common in -older policies and frameworks like CIS. NIST 800-63B no longer recommends forced -rotation unless there's evidence of compromise. Know which framework you're -auditing against before writing up a finding for this setting. Confirm with the -organization to understand which framework they used to write their policy. -- *PasswordReusePrevention*: AWS allows a maximum of 24 previous passwords. If your -organization's policy requires a higher number than AWS supports, document the -platform limitation rather than raising it as a deficiency. + older policies and frameworks like CIS. NIST 800-63B no longer recommends + forced rotation unless there's evidence of compromise. Know which framework + you're auditing against before writing up a finding for this setting. Confirm + with the organization to understand which framework they used to write their + policy. +- *PasswordReusePrevention*: AWS allows a maximum of 24 previous passwords. If + your organization's policy requires a higher number than AWS supports, + document the platform limitation rather than raising it as a deficiency. * How to Write Up the Finding If a setting fails, here's how to frame it: -- *Deficiency:* The ~MinimumPasswordLength~ setting in the AWS IAM password policy is -configured to ~6~, which is below the organization's requirement of ~8~ characters. + +- *Deficiency:* The ~MinimumPasswordLength~ setting in the AWS IAM password policy + is configured to ~6~, which is below the organization's requirement of ~8~ + characters. - *Root Cause:* Due to {{ root cause }}, the policy was configured to enforce a ~MinimumPasswordLength~ of ~6~. - *Risk:* Shorter passwords are more susceptible to brute-force and credential -stuffing attacks, increasing the likelihood of unauthorized access to the AWS -console. + stuffing attacks, increasing the likelihood of unauthorized access to the AWS + console. - *Evidence:* Refer to ~policy_audit_<timestamp>.csv~ for documentation of testing. The same structure applies to any other failing rule. For boolean settings, the