QJnMBo38c9iQavr1DSwiCheck the current AWS IAM password policy
Check the current AWS IAM password policy
This task reviews the existing AWS IAM password policy to ensure it meets specified security standards. It involves assessing criteria like password complexity, expiration, and rotation rules for compliance with organizational or regulatory requirements.
inputs
outputs
import boto3
from botocore.exceptions import ClientError, BotoCoreError
creds = _get_creds(cred_label)['creds']
access_key = creds['username']
secret_key = creds['password']
def get_password_policy(client):
"""
Retrieves the current account password policy.
:param client: Boto3 IAM client
:return: Current password policy if exists, None otherwise
"""
try:
return client.get_account_password_policy()['PasswordPolicy']
except client.exceptions.NoSuchEntityException:
# No password policy is set for the account
print("No password policy is set for the account.")
return None
except ClientError as e:
print(f"Error retrieving password policy: {e}")
return None
def check_password_policy_compliance(current_policy, desired_policy):
"""
Checks if the current AWS IAM account password policy is compliant with the desired policy.
Also, returns the non-compliant fields.
:param current_policy: The current password policy
:param desired_policy: The desired password policy attributes
:return: Tuple (True if compliant, False otherwise, non_compliant_fields)
"""
non_compliant_fields = {}
for key, value in desired_policy.items():
if key not in current_policy or current_policy[key] != value:
non_compliant_fields[key] = {
'current_value': current_policy.get(key),
'desired_value': value
}
return len(non_compliant_fields) == 0, non_compliant_fields
# Desired password policy parameters
desired_policy = {
'MinimumPasswordLength': int(MinimumPasswordLength),
'RequireSymbols': RequireSymbols,
'RequireNumbers': RequireNumbers,
'RequireUppercaseCharacters': RequireUppercaseCharacters,
'RequireLowercaseCharacters': RequireLowercaseCharacters,
'MaxPasswordAge': int(MaxPasswordAge), # Days
'PasswordReusePrevention': int(PasswordReusePrevention),
'HardExpiry': HardExpiry
}
'''
# The 'HardExpiry' field in the password policy determines whether IAM users are allowed to change their own passwords.
# - If 'HardExpiry' is set to True, it means IAM users cannot change their own passwords. In this case, only an administrator can reset the passwords. This setting is typically used in highly secure environments where password management needs to be strictly controlled by administrators.
# - If 'HardExpiry' is set to False, IAM users are permitted to change their own passwords. This setting is more user-friendly and allows users to manage their own password changes, including regular updates or resets if needed.
'''
# Create a boto3 client for IAM
iam_client = boto3.client('iam',aws_access_key_id=access_key,aws_secret_access_key=secret_key)
# Get the current account password policy
current_policy = get_password_policy(iam_client)
print("Current Policy:")
for key, value in current_policy.items():
print(f" - {key}: {value}")
if current_policy:
# Debugging: Before checking compliance
#print("Checking policy compliance...")
is_compliant, non_compliant_fields = check_password_policy_compliance(current_policy, desired_policy)
# Debugging: After checking compliance
#print("Completed policy compliance check.")
if is_compliant:
print("The account password policy is compliant.")
else:
print("The account password policy is not compliant.")
print("Non-compliant fields:")
for field, values in non_compliant_fields.items():
print(f" - {field}: Current Value - {values['current_value']}, Desired Value - {values['desired_value']}")
else:
print("No password policy found for the account.")
context.skip_sub_tasks=True #create_new_policy
copied- 1FQ7JkEUtC3oxsI3mURl7Set an AWS IAM Password Policy
1
This task configures rules for user passwords in your AWS account. This process includes defining requirements for password complexity, expiration, and rotation to enhance account security and manage access controls effectively.
inputsoutputsimport boto3 from botocore.exceptions import ClientError, BotoCoreError creds = _get_creds(cred_label)['creds'] access_key = creds['username'] secret_key = creds['password'] def set_password_policy(client): """ Updates the account password policy with specified settings. :param client: Boto3 IAM client """ try: # Update the account password policy with the desired settings client.update_account_password_policy( MinimumPasswordLength=MinimumPasswordLength, RequireSymbols=RequireSymbols, RequireNumbers=RequireNumbers, RequireUppercaseCharacters=RequireUppercaseCharacters, RequireLowercaseCharacters=RequireLowercaseCharacters, MaxPasswordAge=MaxPasswordAge, PasswordReusePrevention=PasswordReusePrevention, HardExpiry=HardExpiry ) print("Password policy updated successfully.") # Handle client errors from AWS except ClientError as e: print(f"AWS client error occurred: {e}") # Handle BotoCore errors except BotoCoreError as e: print(f"Boto core error occurred: {e}") # Handle other unexpected errors except Exception as e: print(f"An unexpected error occurred: {e}") # Create a boto3 client for IAM iam_client = boto3.client('iam',aws_access_key_id=access_key,aws_secret_access_key=secret_key) # Set the password policy set_password_policy(iam_client)copied1 - 2MlcWv73ys88cOgQNXQiREnforce Password Change for AWS IAM Users
2
This task makes all users to update their passwords by updating their login profiles, typically following the implementation of a new password policy. This ensures that all user passwords comply with the updated security standards, enhancing overall account security.
inputsoutputsimport boto3 from botocore.exceptions import ClientError, BotoCoreError creds = _get_creds(cred_label)['creds'] access_key = creds['username'] secret_key = creds['password'] def enforce_password_change_for_all_users(client): """ Enforce a password change for all IAM users. :param client: Boto3 IAM client :return: None """ try: paginator = client.get_paginator('list_users') for page in paginator.paginate(): for user in page['Users']: try: client.update_login_profile( UserName=user['UserName'], PasswordResetRequired=True ) print(f"Password change enforced for user: {user['UserName']}") except ClientError as e: if e.response['Error']['Code'] == 'NoSuchEntity': print(f"User {user['UserName']} does not have a password to change.") else: print(f"Failed to enforce password change for user {user['UserName']}: {e}") except Exception as e: print(f"Unexpected error for user {user['UserName']}: {e}") except ClientError as e: print(f"Error retrieving IAM users: {e}") except BotoCoreError as e: print(f"Boto core error: {e}") except Exception as e: print(f"Unexpected error: {e}") # Create a boto3 client for IAM iam_client = boto3.client('iam',aws_access_key_id=access_key,aws_secret_access_key=secret_key) # Enforce password change for all users enforce_password_change_for_all_users(iam_client)copied2