The IAM password policy should require at least 14 characters

Short passwords are cheap to guess and to crack offline. The account password policy is the one place that sets the floor for every IAM user who signs in to the AWS console with a password, so a weak value there weakens every one of those accounts at once.

AWS describes the available policy options, including minimum length, in Set an account password policy for IAM users. Longer passwords combined with multi-factor authentication are the standard defence for console sign-in.

In the AWS console open IAM, then Account settings. The Password policy panel shows the current minimum length. If the panel says no custom policy is set, the AWS default applies, which is not the safe setting.

This read-only command prints the value:

aws iam get-account-password-policy \
  --query "PasswordPolicy.MinimumPasswordLength"

A result below 14, or a NoSuchEntity error (no policy has been set), means the check fails. Run it with a profile that has read access to IAM.

In the console go to IAM, Account settings, Edit next to the password policy, choose Custom and set the minimum length to 14 or more.

With the CLI, note that update-account-password-policy resets every option you leave out back to its default. Read the current policy first and pass the existing values again together with the new length:

aws iam get-account-password-policy   # note the current values

aws iam update-account-password-policy \
  --minimum-password-length 14 \
  --require-symbols --require-numbers \
  --require-uppercase-characters --require-lowercase-characters

Adjust the flags to match what you read in the first command. ConfigCobra only reads the policy; it never changes it for you.

IAM users with a console password are affected, and only when they next set a password: AWS applies the new rules when a password is created or changed, not to passwords that already exist. A user changing a password after the update has to choose one of at least 14 characters, and the helpdesk should expect a few questions from them.

Access keys, roles, federated sign-in and the root user are not governed by this policy, so automation and single sign-in users see no change.