MlcWv73ys88cOgQNXQiREnforce Password Change for AWS IAM Users
Enforce Password Change for AWS IAM Users
This task makes all users to update their passwords by updating their login profiles, typically following the implementation of a new password policy. This ensures that all user passwords comply with the updated security standards, enhancing overall account security.
inputs
outputs
import boto3
from botocore.exceptions import ClientError, BotoCoreError
creds = _get_creds(cred_label)['creds']
access_key = creds['username']
secret_key = creds['password']
def enforce_password_change_for_all_users(client):
"""
Enforce a password change for all IAM users.
:param client: Boto3 IAM client
:return: None
"""
try:
paginator = client.get_paginator('list_users')
for page in paginator.paginate():
for user in page['Users']:
try:
client.update_login_profile(
UserName=user['UserName'],
PasswordResetRequired=True
)
print(f"Password change enforced for user: {user['UserName']}")
except ClientError as e:
if e.response['Error']['Code'] == 'NoSuchEntity':
print(f"User {user['UserName']} does not have a password to change.")
else:
print(f"Failed to enforce password change for user {user['UserName']}: {e}")
except Exception as e:
print(f"Unexpected error for user {user['UserName']}: {e}")
except ClientError as e:
print(f"Error retrieving IAM users: {e}")
except BotoCoreError as e:
print(f"Boto core error: {e}")
except Exception as e:
print(f"Unexpected error: {e}")
# Create a boto3 client for IAM
iam_client = boto3.client('iam',aws_access_key_id=access_key,aws_secret_access_key=secret_key)
# Enforce password change for all users
enforce_password_change_for_all_users(iam_client)
copied