Misconfigured Password Policy Expiration

• Query id: 3f2cf811-88fa-4eda-be45-7a191a18aba9
• Query name: Misconfigured Password Policy Expiration
• Platform: Ansible
• Severity: Medium
• Category: Best Practices
• URL: Github

Description

No password expiration policy
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - yaml file

- name: Missing Password policy for AWS account
  community.aws.iam_password_policy:
    state: present
    min_pw_length: 8
    require_symbols: false
    require_numbers: true
    require_uppercase: true
    require_lowercase: true
    allow_pw_change: true
    pw_reuse_prevent: 5
    pw_expire: false
- name: Extreme Password policy for AWS account
  community.aws.iam_password_policy:
    state: present
    min_pw_length: 8
    require_symbols: false
    require_numbers: true
    require_uppercase: true
    require_lowercase: true
    allow_pw_change: true
    pw_max_age: 180
    pw_reuse_prevent: 5
    pw_expire: false
- name: Alias extreme Password policy for AWS account
  community.aws.iam_password_policy:
    state: present
    min_pw_length: 8
    require_symbols: false
    require_numbers: true
    require_uppercase: true
    require_lowercase: true
    allow_pw_change: true
    password_max_age: 95
    pw_reuse_prevent: 5
    pw_expire: false

Code samples without security vulnerabilities

Negative test num. 1 - yaml file

- name: Missing Password policy for AWS account
  community.aws.iam_password_policy:
    state: present
    min_pw_length: 8
    require_symbols: false
    require_numbers: true
    require_uppercase: true
    require_lowercase: true
    allow_pw_change: true
    pw_max_age: 20
    pw_reuse_prevent: 5
    pw_expire: false