Misconfigured Password Policy Expiration
- Query id: 3f2cf811-88fa-4eda-be45-7a191a18aba9
- Query name: Misconfigured Password Policy Expiration
- Platform: Ansible
- Severity: Medium
- Category: Best Practices
- URL: Github
Description¶
No password expiration policy
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
- name: Missing Password policy for AWS account
community.aws.iam_password_policy:
state: present
min_pw_length: 8
require_symbols: false
require_numbers: true
require_uppercase: true
require_lowercase: true
allow_pw_change: true
pw_reuse_prevent: 5
pw_expire: false
- name: Extreme Password policy for AWS account
community.aws.iam_password_policy:
state: present
min_pw_length: 8
require_symbols: false
require_numbers: true
require_uppercase: true
require_lowercase: true
allow_pw_change: true
pw_max_age: 180
pw_reuse_prevent: 5
pw_expire: false
- name: Alias extreme Password policy for AWS account
community.aws.iam_password_policy:
state: present
min_pw_length: 8
require_symbols: false
require_numbers: true
require_uppercase: true
require_lowercase: true
allow_pw_change: true
password_max_age: 95
pw_reuse_prevent: 5
pw_expire: false
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
- name: Missing Password policy for AWS account
community.aws.iam_password_policy:
state: present
min_pw_length: 8
require_symbols: false
require_numbers: true
require_uppercase: true
require_lowercase: true
allow_pw_change: true
pw_max_age: 20
pw_reuse_prevent: 5
pw_expire: false