The AWS IAM password policy should stop users from reusing old passwords

IAM users who sign in to the AWS Management Console use a password, and without a reuse rule a user can rotate to a new password and then straight back to the old one. That defeats the point of expiry and of changing a password after a suspected leak.

The IAM account password policy has a Prevent password reuse option. According to AWS documentation, you choose how many previous passwords cannot be repeated, from a minimum of 1 to a maximum of 24. The policy does not apply to the root user password or to access keys, so those need separate controls.

Source: Set an account password policy for IAM users, AWS documentation.

In the AWS console open IAM, then Account settings, and look at the Password policy section for the reuse setting. If the policy is the IAM default, no reuse prevention is configured.

From the AWS CLI, this read-only call prints the current policy:

aws iam get-account-password-policy

Look for PasswordReusePrevention in the output. If the field is missing, reuse prevention is off. If the account has no custom policy the command returns a NoSuchEntity error, which also means the default applies.

In the console, go to IAM, Account settings, then Password policy and choose Edit. Choose Custom, tick Prevent password reuse, enter how many previous passwords to remember, then Save changes and confirm with Set custom.

From the CLI, be careful: update-account-password-policy replaces the whole policy, and any option you leave out falls back to its default. Read the current policy first, then repeat every value you want to keep:

aws iam get-account-password-policy

aws iam update-account-password-policy \
  --password-reuse-prevention <count> \
  --minimum-password-length <current-value> \
  --max-password-age <current-value>

Add the other flags from your current policy (character-type requirements, allow-users-to-change-password) in the same call. ConfigCobra itself only reads your account and never changes it.

Console users notice nothing until they change their password; then they must pick one that is not among the remembered ones. Per AWS documentation, most password policy settings are enforced the next time users change their passwords, and existing passwords are not forced to change just because of the new reuse rule.

Check that users are allowed to change their own passwords, and that your help desk knows the rule, so people are not locked into a failing change form. Programmatic access with access keys is not affected.