Password Policy And MFA In AWS
Password Pilicy
AWS Identity and Access Management (IAM) allows us to set a custom password policy for your IAM users. If user doesn't set a custom policy, AWS enforces a default password policy.
The default AWS password policy requires:
- A minimum password length of 8 characters and a maximum of 128 characters.
- At least three of the following character types: uppercase letters, lowercase letters, numbers, and non-alphanumeric characters (e.g.,
! @ # $ % ^ & * ( ) _ + - = [ ] { } | '). - The password must not be identical to your AWS account name or email address.
- Passwords never expire.
User can customize this policy to include additional requirements such as a different minimum length, specific character types, password expiration, and preventing password reuse. For more details on setting a custom policy, refer to the AWS documentation.
Multi Factor Authentication (MFA)
Multi-Factor Authentication (MFA) in AWS is a security feature that requires users to present two or more forms of authentication before they can access AWS resources. This adds an extra layer of protection beyond just a username and password.
In AWS, MFA typically involves:
- Something you know: Your password.
- Something you Own: A physical or virtual MFA device that generates a time-based one-time password (TOTP).
When MFA is enabled, users must enter their password and a code from their MFA device to sign in or perform certain sensitive operations.
Types of MFA devices supported by AWS:
- Virtual MFA devices: Applications such as Google Authenticator or Authy installed on smartphones or tablets.
- Hardware MFA devices: Physical devices that generate TOTP codes, such as key fobs.
- U2F security keys: Devices that support the Universal 2nd Factor (U2F) standard, such as YubiKey.
Use cases for MFA in AWS:
- Securing the AWS Management Console login for IAM users and the root account.
- Protecting sensitive API operations (for example, deleting resources or changing account settings).
- Enforcing MFA for privileged users or roles.
Enabling MFA:
User can enable MFA for the AWS root user and for individual IAM users. AWS strongly recommends enabling MFA, especially for the root account, to reduce the risk of unauthorized access.
For detailed steps on enabling and managing MFA in AWS, refer to the official AWS documentation.