Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Didn't get DefaultAccountPasswordPolicy When Calling "GetAccountPasswordPolicy" API. #7265

Open
tirthrajsinh-fens opened this issue Sep 12, 2022 · 12 comments
Assignees
Labels
iam p2 This is a standard priority issue service-api This issue is due to a problem in a service API, not the SDK implementation.

Comments

@tirthrajsinh-fens
Copy link

tirthrajsinh-fens commented Sep 12, 2022

Describe the bug

Hi Team, In my AWS Account after creating a custom password policy, called GetAccountPasswordPolicy API, it returns a proper response But when I delete the custom password policy and then hit the GetAccountPasswordPolicy API, the response shows The Password Policy with domain name 12345678912 cannot be found.

Expected Behavior

  • If the account password policy is default then it should return a proper response as mentioned in below
    default password policy

Default Policy
DefaultPasswordPolicy

Expected Response

<GetAccountPasswordPolicyResponse xmlns="https://iam.amazonaws.com/doc/2010-05-08/">
    <GetAccountPasswordPolicyResult>
        <PasswordPolicy>
            <ExpirePasswords>false</ExpirePasswords>
            <MinimumPasswordLength>8</MinimumPasswordLength>
            <RequireSymbols>true</RequireSymbols>
            <AllowUsersToChangePassword>false</AllowUsersToChangePassword>
            <RequireLowercaseCharacters>true</RequireLowercaseCharacters>
            <RequireNumbers>false</RequireNumbers>
            <RequireUppercaseCharacters>true</RequireUppercaseCharacters>
            <NotBeIdenticalToYourAWSAccount>true<NotBeIdenticalToYourAWSAccount>
            <NotBeIdenticalToYourEmailAddress>true<NotBeIdenticalToYourAWSAccount>
        </PasswordPolicy>
    </GetAccountPasswordPolicyResult>
    <ResponseMetadata>
        <RequestId>1234ee3-e316-43b3-9ae3-f18d4113dcbb</RequestId>
    </ResponseMetadata>
</GetAccountPasswordPolicyResponse>

Current Behavior

Default Policy
DefaultPasswordPolicy

Current Response

<ErrorResponse xmlns="https://iam.amazonaws.com/doc/2010-05-08/">
    <Error>
        <Type>Sender</Type>
        <Code>NoSuchEntity</Code>
        <Message>The Password Policy with domain name 123456789 cannot be found.</Message>
    </Error>
    <RequestId>1234ee3-bee0-4b38-b237-534db874e627</RequestId>
</ErrorResponse>

Reproduction Steps

  • Create Custom Account Password Policy And Fire These API GetAccountPasswordPolicy
  • Delete Custome Account Password Policy and Fire the above API
  • Compare Responses.

Possible Solution

  • If the Account Password Policy Default, Then as I mentioned in Expected Behavior response should be thrown.

Additional Information/Context

This is not specific to the aws-cli bug, it's problem with the AWS API. I just didn't know where else to report the bug.

CLI version used

NA

Environment details (OS name and version, etc.)

Windows 10, Postman

@tirthrajsinh-fens tirthrajsinh-fens added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Sep 12, 2022
@aBurmeseDev aBurmeseDev added investigating This issue is being investigated and/or work is in progress to resolve the issue. and removed needs-triage This issue or PR still needs to be triaged. labels Sep 12, 2022
@aBurmeseDev aBurmeseDev self-assigned this Sep 12, 2022
@aBurmeseDev
Copy link
Member

Hi @tirthrajsinh-fens, thanks for reaching out.

Which CLI command did you run and receive the Password Policy error? I assumed that you ran aws iam get-account-password-policy? If that's the case, you'd want to run this update command aws iam update-account-password-policy first to update the policy after removing the custom password policy and then run aws iam get-account-password-policy to get the default policy.

Here's docs on for your reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#PasswordPolicy_CLI

If you're still having trouble, please share the debugs logs by adding --debug to your CLI command.

Best,
John

@aBurmeseDev aBurmeseDev added response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. iam and removed bug This issue is a bug. investigating This issue is being investigated and/or work is in progress to resolve the issue. labels Sep 12, 2022
@tirthrajsinh-fens
Copy link
Author

Hi, @aBurmeseDev Thanks for your response.

  • In my account, I have a default password policy as displayed in the below image.

DefaultPasswordPolicy

  • I have checked with aws iam get-account-password-policy --debug command but getting the below error.
>aws iam get-account-password-policy --debug
2022-09-13 11:42:29,693 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/2.7.31 Python/3.9.11 Windows/10 exe/AMD64
2022-09-13 11:42:29,693 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['iam', 'get-account-password-policy', '--debug']
2022-09-13 11:42:29,826 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_s3 at 0x000001DC7A1BDC10>
2022-09-13 11:42:29,826 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_ddb at 0x000001DC7A0159D0>
2022-09-13 11:42:29,827 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <bound method BasicCommand.add_command of <class 'awscli.customizations.configure.configure.ConfigureCommand'>>
2022-09-13 11:42:29,827 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function change_name at 0x000001DC79FB6D30>
2022-09-13 11:42:29,827 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function change_name at 0x000001DC79FBFE50>
2022-09-13 11:42:29,827 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function alias_opsworks_cm at 0x000001DC7A1D35E0>
2022-09-13 11:42:29,829 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_history_commands at 0x000001DC7A063550>
2022-09-13 11:42:29,829 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <bound method BasicCommand.add_command of <class 'awscli.customizations.devcommands.CLIDevCommand'>>
2022-09-13 11:42:29,829 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_waiters at 0x000001DC7A185820>
2022-09-13 11:42:29,830 - MainThread - botocore.loaders - DEBUG - Loading JSON file: C:\Program Files\Amazon\AWSCLIV2\awscli\data\cli.json
2022-09-13 11:42:29,835 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_types at 0x000001DC7A1155E0>
2022-09-13 11:42:29,835 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function no_sign_request at 0x000001DC7A11A160>
2022-09-13 11:42:29,835 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_verify_ssl at 0x000001DC7A11A0D0>
2022-09-13 11:42:29,837 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_cli_read_timeout at 0x000001DC7A11A280>
2022-09-13 11:42:29,838 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_cli_connect_timeout at 0x000001DC7A11A1F0>
2022-09-13 11:42:29,839 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <built-in method update of dict object at 0x000001DC7A270C40>
2022-09-13 11:42:29,842 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/2.7.31 Python/3.9.11 Windows/10 exe/AMD64 prompt/off
2022-09-13 11:42:29,842 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['iam', 'get-account-password-policy', '--debug']
2022-09-13 11:42:29,844 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function add_timestamp_parser at 0x000001DC7A1C4280>
2022-09-13 11:42:29,845 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function register_uri_param_handler at 0x000001DC79D31DC0>
2022-09-13 11:42:29,847 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function add_binary_formatter at 0x000001DC7A235A60>
2022-09-13 11:42:29,848 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function no_pager_handler at 0x000001DC79D2D280>
2022-09-13 11:42:29,849 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function inject_assume_role_provider_cache at 0x000001DC79D8ECA0>
2022-09-13 11:42:29,853 - MainThread - botocore.utils - DEBUG - IMDS ENDPOINT: http://169.254.169.254/
2022-09-13 11:42:29,859 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function attach_history_handler at 0x000001DC7A063430>
2022-09-13 11:42:29,859 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function inject_json_file_cache at 0x000001DC7A0188B0>
2022-09-13 11:42:29,985 - MainThread - botocore.loaders - DEBUG - Loading JSON file: C:\Program Files\Amazon\AWSCLIV2\awscli\botocore\data\iam\2010-05-08\service-2.json
2022-09-13 11:42:30,004 - MainThread - botocore.hooks - DEBUG - Event building-command-table.iam: calling handler <function _add_wizard_command at 0x000001DC7A2359D0>
2022-09-13 11:42:30,006 - MainThread - botocore.hooks - DEBUG - Event building-command-table.iam: calling handler <function add_waiters at 0x000001DC7A185820>
2022-09-13 11:42:30,099 - MainThread - botocore.loaders - DEBUG - Loading JSON file: C:\Program Files\Amazon\AWSCLIV2\awscli\botocore\data\iam\2010-05-08\waiters-2.json
2022-09-13 11:42:30,102 - MainThread - awscli.clidriver - DEBUG - OrderedDict()
2022-09-13 11:42:30,102 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function add_streaming_output_arg at 0x000001DC7A1C4550>
2022-09-13 11:42:30,103 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function add_cli_input_json at 0x000001DC79D964C0>
2022-09-13 11:42:30,106 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function add_cli_input_yaml at 0x000001DC79D96700>
2022-09-13 11:42:30,107 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function unify_paging_params at 0x000001DC7A015EE0>
2022-09-13 11:42:30,221 - MainThread - botocore.loaders - DEBUG - Loading JSON file: C:\Program Files\Amazon\AWSCLIV2\awscli\botocore\data\iam\2010-05-08\paginators-1.json
2022-09-13 11:42:30,222 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function add_generate_skeleton at 0x000001DC7A108B80>
2022-09-13 11:42:30,224 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.iam.get-account-password-policy: calling handler <bound method OverrideRequiredArgsArgument.override_required_args of <awscli.customizations.cliinput.CliInputJSONArgument object at 0x000001DC7A600F40>>
2022-09-13 11:42:30,227 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.iam.get-account-password-policy: calling handler <bound method OverrideRequiredArgsArgument.override_required_args of <awscli.customizations.cliinput.CliInputYAMLArgument object at 0x000001DC7A310040>>
2022-09-13 11:42:30,228 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.iam.get-account-password-policy: calling handler <bound method GenerateCliSkeletonArgument.override_required_args of <awscli.customizations.generatecliskeleton.GenerateCliSkeletonArgument object at 0x000001DC7A3100D0>>
2022-09-13 11:42:30,230 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.iam.get-account-password-policy.cli-input-json: calling handler <awscli.paramfile.URIArgumentHandler object at 0x000001DC7A2BC580>
2022-09-13 11:42:30,230 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.iam.get-account-password-policy.cli-input-yaml: calling handler <awscli.paramfile.URIArgumentHandler object at 0x000001DC7A2BC580>
2022-09-13 11:42:30,231 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.iam.get-account-password-policy.generate-cli-skeleton: calling handler <awscli.paramfile.URIArgumentHandler object at 0x000001DC7A2BC580>
2022-09-13 11:42:30,233 - MainThread - botocore.hooks - DEBUG - Event calling-command.iam.get-account-password-policy: calling handler <bound method CliInputArgument.add_to_call_parameters of <awscli.customizations.cliinput.CliInputJSONArgument object at 0x000001DC7A600F40>>
2022-09-13 11:42:30,233 - MainThread - botocore.hooks - DEBUG - Event calling-command.iam.get-account-password-policy: calling handler <bound method CliInputArgument.add_to_call_parameters of <awscli.customizations.cliinput.CliInputYAMLArgument object at 0x000001DC7A310040>>
2022-09-13 11:42:30,234 - MainThread - botocore.hooks - DEBUG - Event calling-command.iam.get-account-password-policy: calling handler <bound method GenerateCliSkeletonArgument.generate_skeleton of <awscli.customizations.generatecliskeleton.GenerateCliSkeletonArgument object at 0x000001DC7A3100D0>>
2022-09-13 11:42:30,235 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2022-09-13 11:42:30,236 - MainThread - botocore.credentials - INFO - Found credentials in environment variables.
2022-09-13 11:42:30,239 - MainThread - botocore.loaders - DEBUG - Loading JSON file: C:\Program Files\Amazon\AWSCLIV2\awscli\botocore\data\endpoints.json
2022-09-13 11:42:30,250 - MainThread - botocore.hooks - DEBUG - Event choose-service-name: calling handler <function handle_service_name_alias at 0x000001DC78B60790>
2022-09-13 11:42:30,254 - MainThread - botocore.hooks - DEBUG - Event creating-client-class.iam: calling handler <function add_generate_presigned_url at 0x000001DC78AE4F70>
2022-09-13 11:42:30,255 - MainThread - botocore.regions - DEBUG - Using partition endpoint for iam, ap-south-1: aws-global
2022-09-13 11:42:30,259 - MainThread - botocore.endpoint - DEBUG - Setting iam timeout as (60, 60)
2022-09-13 11:42:30,260 - MainThread - botocore.hooks - DEBUG - Event provide-client-params.iam.GetAccountPasswordPolicy: calling handler <function base64_decode_input_blobs at 0x000001DC7A22B1F0>
2022-09-13 11:42:30,261 - MainThread - botocore.hooks - DEBUG - Event before-parameter-build.iam.GetAccountPasswordPolicy: calling handler <function generate_idempotent_uuid at 0x000001DC78B79790>
2022-09-13 11:42:30,263 - MainThread - botocore.hooks - DEBUG - Event before-call.iam.GetAccountPasswordPolicy: calling handler <function inject_api_version_header_if_needed at 0x000001DC78B7F040>
2022-09-13 11:42:30,264 - MainThread - botocore.endpoint - DEBUG - Making request for OperationModel(name=GetAccountPasswordPolicy) with params: {'url_path': '/', 'query_string': '', 'method': 'POST', 'headers': {'Content-Type': 'application/x-www-form-urlencoded; charset=utf-8', 'User-Agent': 'aws-cli/2.7.31 Python/3.9.11 Windows/10 exe/AMD64 prompt/off command/iam.get-account-password-policy'}, 'body': {'Action': 'GetAccountPasswordPolicy', 'Version': '2010-05-08'}, 'url': 'https://iam.amazonaws.com/', 'context': {'client_region': 'aws-global', 'client_config': <botocore.config.Config object at 0x000001DC7A944940>, 'has_streaming_input': False, 'auth_type': None}}
2022-09-13 11:42:30,265 - MainThread - botocore.hooks - DEBUG - Event request-created.iam.GetAccountPasswordPolicy: calling handler <bound method RequestSigner.handler of <botocore.signers.RequestSigner object at 0x000001DC7A944A30>>
2022-09-13 11:42:30,266 - MainThread - botocore.hooks - DEBUG - Event choose-signer.iam.GetAccountPasswordPolicy: calling handler <function set_operation_specific_signer at 0x000001DC78B79670>
2022-09-13 11:42:30,267 - MainThread - botocore.auth - DEBUG - Calculating signature using v4 auth.
2022-09-13 11:42:30,268 - MainThread - botocore.auth - DEBUG - CanonicalRequest:
POST
/

content-type:application/x-www-form-urlencoded; charset=utf-8
host:iam.amazonaws.com
x-amz-date:20220913T061230Z

content-type;host;x-amz-date
ea932dc167ba62f61056ffd881499668d7cf04f9c4ed7883675e860d28fff1e9
2022-09-13 11:42:30,269 - MainThread - botocore.auth - DEBUG - StringToSign:
AWS4-HMAC-SHA256
20220913T061230Z
20220913/us-east-1/iam/aws4_request
fabca69c4d1b5adfade0f0ef47fac07ddd9f2d5909a19701ffedf0418b32f6cc
2022-09-13 11:42:30,270 - MainThread - botocore.auth - DEBUG - Signature:
026b93a398369476cb6a9deccea63f505758389f08bcc6de834461e7e4a97c0a
2022-09-13 11:42:30,271 - MainThread - botocore.endpoint - DEBUG - Sending http request: <AWSPreparedRequest stream_output=False, method=POST, url=https://iam.amazonaws.com/, headers={'Content-Type': b'application/x-www-form-urlencoded; charset=utf-8', 'User-Agent': b'aws-cli/2.7.31 Python/3.9.11 Windows/10 exe/AMD64 prompt/off command/iam.get-account-password-policy', 'X-Amz-Date': b'20220913T061230Z', 'Authorization': b'AWS4-HMAC-SHA256 Credential=AKIAV4B5HOXQI4TPPPIV/20220913/us-east-1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=026b93a398369476cb6a9deccea63f505758389f08bcc6de834461e7e4a97c0a', 'Content-Length': '50'}>
2022-09-13 11:42:30,272 - MainThread - botocore.httpsession - DEBUG - Certificate path: C:\Program Files\Amazon\AWSCLIV2\awscli\botocore\cacert.pem
2022-09-13 11:42:30,275 - MainThread - urllib3.connectionpool - DEBUG - Starting new HTTPS connection (1): iam.amazonaws.com:443
2022-09-13 11:42:32,443 - MainThread - urllib3.connectionpool - DEBUG - https://iam.amazonaws.com:443 "POST / HTTP/1.1" 404 310
2022-09-13 11:42:32,444 - MainThread - botocore.parsers - DEBUG - Response headers: {'x-amzn-RequestId': 'f6da0cc7-2cdc-4fdc-9b5e-dd3fbb5b5a31', 'Content-Type': 'text/xml', 'Content-Length': '310', 'Date': 'Tue, 13 Sep 2022 06:12:31 GMT'}
2022-09-13 11:42:32,448 - MainThread - botocore.parsers - DEBUG - Response body:
b'<ErrorResponse xmlns="https://iam.amazonaws.com/doc/2010-05-08/">\n  <Error>\n    <Type>Sender</Type>\n    <Code>NoSuchEntity</Code>\n    <Message>The Password Policy with domain name 403855341024 cannot be found.</Message>\n  </Error>\n  <RequestId>f6da0cc7-2cdc-4fdc-9b5e-dd3fbb5b5a31</RequestId>\n</ErrorResponse>\n'
2022-09-13 11:42:32,451 - MainThread - botocore.parsers - DEBUG - Response headers: {'x-amzn-RequestId': 'f6da0cc7-2cdc-4fdc-9b5e-dd3fbb5b5a31', 'Content-Type': 'text/xml', 'Content-Length': '310', 'Date': 'Tue, 13 Sep 2022 06:12:31 GMT'}
2022-09-13 11:42:32,452 - MainThread - botocore.parsers - DEBUG - Response body:
b'<ErrorResponse xmlns="https://iam.amazonaws.com/doc/2010-05-08/">\n  <Error>\n    <Type>Sender</Type>\n    <Code>NoSuchEntity</Code>\n    <Message>The Password Policy with domain name 403855341024 cannot be found.</Message>\n  </Error>\n  <RequestId>f6da0cc7-2cdc-4fdc-9b5e-dd3fbb5b5a31</RequestId>\n</ErrorResponse>\n'
2022-09-13 11:42:32,452 - MainThread - botocore.hooks - DEBUG - Event needs-retry.iam.GetAccountPasswordPolicy: calling handler <bound method RetryHandler.needs_retry of <botocore.retries.standard.RetryHandler object at 0x000001DC7A98C460>>
2022-09-13 11:42:32,453 - MainThread - botocore.retries.standard - DEBUG - Not retrying request.
2022-09-13 11:42:32,454 - MainThread - botocore.hooks - DEBUG - Event after-call.iam.GetAccountPasswordPolicy: calling handler <function json_decode_policies at 0x000001DC78B7E310>
2022-09-13 11:42:32,455 - MainThread - botocore.hooks - DEBUG - Event after-call.iam.GetAccountPasswordPolicy: calling handler <bound method RetryQuotaChecker.release_retry_quota of <botocore.retries.standard.RetryQuotaChecker object at 0x000001DC7A944EB0>>
2022-09-13 11:42:32,457 - MainThread - awscli.clidriver - DEBUG - Exception caught in main()
Traceback (most recent call last):
  File "awscli\clidriver.py", line 458, in main
  File "awscli\clidriver.py", line 593, in __call__
  File "awscli\clidriver.py", line 769, in __call__
  File "awscli\clidriver.py", line 900, in invoke
  File "awscli\clidriver.py", line 912, in _make_client_call
  File "awscli\botocore\client.py", line 304, in _api_call
  File "awscli\botocore\client.py", line 634, in _make_api_call
botocore.errorfactory.NoSuchEntityException: An error occurred (NoSuchEntity) when calling the GetAccountPasswordPolicy operation: The Password Policy with domain name 12345678912 cannot be found.

An error occurred (NoSuchEntity) when calling the GetAccountPasswordPolicy operation: The Password Policy with domain name 12345678912 cannot be found.
  • IMO, If the account-password-policy is default then we should get default password policy values in the response

Thanks,
Tirthraj

@github-actions github-actions bot removed the response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. label Sep 13, 2022
@aBurmeseDev
Copy link
Member

@tirthrajsinh-fens Thanks for sharing this additional info. Could you try running update-account command aws iam update-account-password-policy before running get-account aws iam get-account-password-policy?

As mentioned in the docs from previous comment, you might have to run update-account-policy command to retrieve the default password policy after removing the custom password policy. Please let me know if that helps!

@aBurmeseDev aBurmeseDev added the response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. label Sep 13, 2022
@tirthrajsinh-fens
Copy link
Author

Hi @aBurmeseDev,
I have tried aws iam update-account-password-policy command and then after run aws iam get-account-password-policy command, it gives me the below response

{
    "PasswordPolicy": {
        "MinimumPasswordLength": 6,
        "RequireSymbols": false,
        "RequireNumbers": false,
        "RequireUppercaseCharacters": false,
        "RequireLowercaseCharacters": false,
        "AllowUsersToChangePassword": false,
        "ExpirePasswords": false
    }
}

But it's not a default AWS account password policy, right? , I think when account password policy is not set or updated then, by default AWS account password policy should be set.

  • default AWS account password policy is mentioned in the below image.

DefaultPasswordPolicy

@github-actions github-actions bot removed the response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. label Sep 14, 2022
@aBurmeseDev aBurmeseDev added the investigating This issue is being investigated and/or work is in progress to resolve the issue. label Sep 14, 2022
@aBurmeseDev
Copy link
Member

Could you check your current password policy by going to AWS IAM console and then click on Account settings on the left navigation menu. You'll see your password policy first thing on the page. That's where the default password policy is pulled from when you run aws iam get-account-password-policy and it's showing correctly for me.

@aBurmeseDev aBurmeseDev added response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. and removed investigating This issue is being investigated and/or work is in progress to resolve the issue. labels Sep 14, 2022
@tirthrajsinh-fens
Copy link
Author

Hi @aBurmeseDev,

  • This is my current password policy as displayed in the below Screenshot.
    DefaultPasswordPolicy

  • I perform aws iam get-account-password-policy command, But it gives me an error, as displayed in the below image.

passwordPolicywithCLI

@aBurmeseDev Can u please check with the above password policy?

Thanks,
Tirthraj

@github-actions github-actions bot removed the response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. label Sep 15, 2022
@aBurmeseDev aBurmeseDev added the investigating This issue is being investigated and/or work is in progress to resolve the issue. label Sep 15, 2022
@aBurmeseDev aBurmeseDev added bug This issue is a bug. investigating This issue is being investigated and/or work is in progress to resolve the issue. and removed investigating This issue is being investigated and/or work is in progress to resolve the issue. bug This issue is a bug. labels Sep 23, 2022
@aBurmeseDev
Copy link
Member

Hi @tirthrajsinh-fens - apologies for the delay. I heard back from the team that this error is likely be resolved by doing these steps:

  • Make sure that password policy is set to your AWS account for current IAM user. (Reference Doc)
  • Make sure that IAM user has permissions to perform this action. (Reference Doc)

Also I would check on your CLI version and update to recent version if you haven't already. If you the issue persists, please share the full debug logs by appending --debug to the command.
Hope that helps,
John

@aBurmeseDev aBurmeseDev added response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. and removed investigating This issue is being investigated and/or work is in progress to resolve the issue. labels Jan 12, 2023
@github-actions
Copy link

Greetings! It looks like this issue hasn’t been active in longer than five days. We encourage you to check if this is still an issue in the latest release. In the absence of more information, we will be closing this issue soon. If you find that this is still a problem, please feel free to provide a comment or upvote with a reaction on the initial post to prevent automatic closure. If the issue is already closed, please feel free to open a new one.

@github-actions github-actions bot added the closing-soon This issue will automatically close in 4 days unless further comments are made. label Jan 17, 2023
@tirthrajsinh-fens
Copy link
Author

@aBurmeseDev thanks for your reply, I will surely check in short and Revert Back.

@github-actions github-actions bot removed closing-soon This issue will automatically close in 4 days unless further comments are made. response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. labels Jan 18, 2023
@tirthrajsinh-fens
Copy link
Author

Hi @aBurmeseDev , I have checked with latest version 2.9.16 but still getting same error. and I have setup default account-password-policy to the account.

2023-01-20 19:16:19,996 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/2.9.16 Python/3.9.11 Windows/10 exe/AMD64
2023-01-20 19:16:19,997 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['iam', 'get-account-password-policy', '--debug']
2023-01-20 19:16:20,195 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_s3 at 0x00000244AB22DDC0>
2023-01-20 19:16:20,196 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_ddb at 0x00000244AB081C10>
2023-01-20 19:16:20,196 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <bound method BasicCommand.add_command of <class 'awscli.customizations.configure.configure.ConfigureCommand'>>
2023-01-20 19:16:20,197 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function change_name at 0x00000244AB012940>
2023-01-20 19:16:20,198 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function change_name at 0x00000244AB019A60>
2023-01-20 19:16:20,199 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function alias_opsworks_cm at 0x00000244AB23F790>
2023-01-20 19:16:20,204 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_history_commands at 0x00000244AB0CC820>
2023-01-20 19:16:20,205 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <bound method BasicCommand.add_command of <class 'awscli.customizations.devcommands.CLIDevCommand'>>
2023-01-20 19:16:20,206 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_waiters at 0x00000244AB2389D0>
2023-01-20 19:16:20,206 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <bound method AliasSubCommandInjector.on_building_command_table of <awscli.alias.AliasSubCommandInjector object at 0x00000244AB2E00A0>>
2023-01-20 19:16:20,208 - MainThread - botocore.loaders - DEBUG - Loading JSON file: C:\Program Files\Amazon\AWSCLIV2\awscli\data\cli.json
2023-01-20 19:16:20,213 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_types at 0x00000244AB182790>
2023-01-20 19:16:20,214 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function no_sign_request at 0x00000244AB185310>
2023-01-20 19:16:20,215 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_verify_ssl at 0x00000244AB185280>
2023-01-20 19:16:20,216 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_cli_read_timeout at 0x00000244AB185430>
2023-01-20 19:16:20,217 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_cli_connect_timeout at 0x00000244AB1853A0>
2023-01-20 19:16:20,217 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <built-in method update of dict object at 0x00000244AB2E1B80>
2023-01-20 19:16:20,223 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/2.9.16 Python/3.9.11 Windows/10 exe/AMD64 prompt/off
2023-01-20 19:16:20,225 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['iam', 'get-account-password-policy', '--debug']
2023-01-20 19:16:20,226 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function add_timestamp_parser at 0x00000244AB230430>
2023-01-20 19:16:20,227 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function register_uri_param_handler at 0x00000244AA595CA0>
2023-01-20 19:16:20,228 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function add_binary_formatter at 0x00000244AB2A1C10>
2023-01-20 19:16:20,229 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function no_pager_handler at 0x00000244AA593040>
2023-01-20 19:16:20,230 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function inject_assume_role_provider_cache at 0x00000244AADF6C10>
2023-01-20 19:16:20,234 - MainThread - botocore.utils - DEBUG - IMDS ENDPOINT: http://169.254.169.254/
2023-01-20 19:16:20,238 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function attach_history_handler at 0x00000244AB0CC700>
2023-01-20 19:16:20,240 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function inject_json_file_cache at 0x00000244AB078940>
2023-01-20 19:16:20,399 - MainThread - botocore.loaders - DEBUG - Loading JSON file: C:\Program Files\Amazon\AWSCLIV2\awscli\botocore\data\iam\2010-05-08\service-2.json
2023-01-20 19:16:20,436 - MainThread - botocore.hooks - DEBUG - Event building-command-table.iam: calling handler <function _add_wizard_command at 0x00000244AB2A1B80>
2023-01-20 19:16:20,437 - MainThread - botocore.hooks - DEBUG - Event building-command-table.iam: calling handler <function add_waiters at 0x00000244AB2389D0>
2023-01-20 19:16:20,590 - MainThread - botocore.loaders - DEBUG - Loading JSON file: C:\Program Files\Amazon\AWSCLIV2\awscli\botocore\data\iam\2010-05-08\waiters-2.json
2023-01-20 19:16:20,591 - MainThread - botocore.hooks - DEBUG - Event building-command-table.iam: calling handler <bound method AliasSubCommandInjector.on_building_command_table of <awscli.alias.AliasSubCommandInjector object at 0x00000244AB2E00A0>>
2023-01-20 19:16:20,593 - MainThread - awscli.clidriver - DEBUG - OrderedDict()
2023-01-20 19:16:20,593 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function add_streaming_output_arg at 0x00000244AB230700>
2023-01-20 19:16:20,594 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function add_cli_input_json at 0x00000244AADFA430>
2023-01-20 19:16:20,603 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function add_cli_input_yaml at 0x00000244AADFA670>
2023-01-20 19:16:20,604 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function unify_paging_params at 0x00000244AB0901F0>
2023-01-20 19:16:20,784 - MainThread - botocore.loaders - DEBUG - Loading JSON file: C:\Program Files\Amazon\AWSCLIV2\awscli\botocore\data\iam\2010-05-08\paginators-1.json
2023-01-20 19:16:20,785 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function add_generate_skeleton at 0x00000244AB176D30>
2023-01-20 19:16:20,787 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.iam.get-account-password-policy: calling handler <bound method OverrideRequiredArgsArgument.override_required_args of <awscli.customizations.cliinput.CliInputJSONArgument object at 0x00000244AB3851C0>>
2023-01-20 19:16:20,789 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.iam.get-account-password-policy: calling handler <bound method OverrideRequiredArgsArgument.override_required_args of <awscli.customizations.cliinput.CliInputYAMLArgument object at 0x00000244AB3851F0>>
2023-01-20 19:16:20,789 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.iam.get-account-password-policy: calling handler <bound method GenerateCliSkeletonArgument.override_required_args of <awscli.customizations.generatecliskeleton.GenerateCliSkeletonArgument object at 0x00000244AB385130>>
2023-01-20 19:16:20,791 - MainThread - botocore.hooks - DEBUG - Event building-command-table.iam_get-account-password-policy: calling handler <function add_waiters at 0x00000244AB2389D0>
2023-01-20 19:16:20,792 - MainThread - botocore.hooks - DEBUG - Event building-command-table.iam_get-account-password-policy: calling handler <bound method AliasSubCommandInjector.on_building_command_table of <awscli.alias.AliasSubCommandInjector object at 0x00000244AB2E00A0>>
2023-01-20 19:16:20,796 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.iam.get-account-password-policy.cli-input-json: calling handler <awscli.paramfile.URIArgumentHandler object at 0x00000244AB32EA00>
2023-01-20 19:16:20,796 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.iam.get-account-password-policy.cli-input-yaml: calling handler <awscli.paramfile.URIArgumentHandler object at 0x00000244AB32EA00>
2023-01-20 19:16:20,797 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.iam.get-account-password-policy.generate-cli-skeleton: calling handler <awscli.paramfile.URIArgumentHandler object at 0x00000244AB32EA00>
2023-01-20 19:16:20,798 - MainThread - botocore.hooks - DEBUG - Event calling-command.iam.get-account-password-policy: calling handler <bound method CliInputArgument.add_to_call_parameters of <awscli.customizations.cliinput.CliInputJSONArgument object at 0x00000244AB3851C0>>
2023-01-20 19:16:20,798 - MainThread - botocore.hooks - DEBUG - Event calling-command.iam.get-account-password-policy: calling handler <bound method CliInputArgument.add_to_call_parameters of <awscli.customizations.cliinput.CliInputYAMLArgument object at 0x00000244AB3851F0>>
2023-01-20 19:16:20,799 - MainThread - botocore.hooks - DEBUG - Event calling-command.iam.get-account-password-policy: calling handler <bound method GenerateCliSkeletonArgument.generate_skeleton of <awscli.customizations.generatecliskeleton.GenerateCliSkeletonArgument object at 0x00000244AB385130>>
2023-01-20 19:16:20,801 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2023-01-20 19:16:20,801 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2023-01-20 19:16:20,802 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role-with-web-identity
2023-01-20 19:16:20,803 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: sso
2023-01-20 19:16:20,803 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: shared-credentials-file
2023-01-20 19:16:20,812 - MainThread - botocore.credentials - INFO - Found credentials in shared credentials file: ~/.aws/credentials
2023-01-20 19:16:20,819 - MainThread - botocore.loaders - DEBUG - Loading JSON file: C:\Program Files\Amazon\AWSCLIV2\awscli\botocore\data\endpoints.json
2023-01-20 19:16:20,843 - MainThread - botocore.hooks - DEBUG - Event choose-service-name: calling handler <function handle_service_name_alias at 0x00000244A9B7A0D0>
2023-01-20 19:16:21,034 - MainThread - botocore.loaders - DEBUG - Loading JSON file: C:\Program Files\Amazon\AWSCLIV2\awscli\botocore\data\iam\2010-05-08\endpoint-rule-set-1.json
2023-01-20 19:16:21,040 - MainThread - botocore.loaders - DEBUG - Loading JSON file: C:\Program Files\Amazon\AWSCLIV2\awscli\botocore\data\partitions.json
2023-01-20 19:16:21,047 - MainThread - botocore.hooks - DEBUG - Event creating-client-class.iam: calling handler <function add_generate_presigned_url at 0x00000244A9ACE940>
2023-01-20 19:16:21,048 - MainThread - botocore.regions - DEBUG - Using partition endpoint for iam, ap-south-1: aws-global
2023-01-20 19:16:21,053 - MainThread - botocore.endpoint - DEBUG - Setting iam timeout as (60, 60)
2023-01-20 19:16:21,057 - MainThread - botocore.regions - DEBUG - Calling endpoint provider with parameters: {'Region': 'ap-south-1', 'UseDualStack': False, 'UseFIPS': False}
2023-01-20 19:16:21,058 - MainThread - botocore.regions - DEBUG - Endpoint provider result: https://iam.amazonaws.com
2023-01-20 19:16:21,059 - MainThread - botocore.regions - DEBUG - Selecting from endpoint provider's list of auth schemes: "sigv4". User selected auth scheme is: "None"
2023-01-20 19:16:21,060 - MainThread - botocore.regions - DEBUG - Selected auth type "v4" as "v4" with signing context params: {'region': 'us-east-1', 'signing_name': 'iam'}
2023-01-20 19:16:21,060 - MainThread - botocore.hooks - DEBUG - Event provide-client-params.iam.GetAccountPasswordPolicy: calling handler <function base64_decode_input_blobs at 0x00000244AB2A23A0>
2023-01-20 19:16:21,061 - MainThread - botocore.hooks - DEBUG - Event before-parameter-build.iam.GetAccountPasswordPolicy: calling handler <function generate_idempotent_uuid at 0x00000244A9B8F040>
2023-01-20 19:16:21,062 - MainThread - botocore.hooks - DEBUG - Event before-call.iam.GetAccountPasswordPolicy: calling handler <function inject_api_version_header_if_needed at 0x00000244A9BA08B0>
2023-01-20 19:16:21,063 - MainThread - botocore.endpoint - DEBUG - Making request for OperationModel(name=GetAccountPasswordPolicy) with params: {'url_path': '/', 'query_string': '', 'method': 'POST', 'headers': {'Content-Type': 'application/x-www-form-urlencoded; charset=utf-8', 'User-Agent': 'aws-cli/2.9.16 Python/3.9.11 Windows/10 exe/AMD64 prompt/off command/iam.get-account-password-policy'}, 'body': {'Action': 'GetAccountPasswordPolicy', 'Version': '2010-05-08'}, 'url': 'https://iam.amazonaws.com/', 'context': {'client_region': 'aws-global', 'client_config': <botocore.config.Config object at 0x00000244ABA65BB0>, 'has_streaming_input': False, 'auth_type': 'v4', 'signing': {'region': 'us-east-1', 'signing_name': 'iam'}}}
2023-01-20 19:16:21,063 - MainThread - botocore.hooks - DEBUG - Event request-created.iam.GetAccountPasswordPolicy: calling handler <bound method RequestSigner.handler of <botocore.signers.RequestSigner object at 0x00000244ABA65CA0>>
2023-01-20 19:16:21,064 - MainThread - botocore.hooks - DEBUG - Event choose-signer.iam.GetAccountPasswordPolicy: calling handler <function set_operation_specific_signer at 0x00000244A9B8AEE0>
2023-01-20 19:16:21,065 - MainThread - botocore.auth - DEBUG - Calculating signature using v4 auth.
2023-01-20 19:16:21,066 - MainThread - botocore.auth - DEBUG - CanonicalRequest:
POST
/

content-type:application/x-www-form-urlencoded; charset=utf-8
host:iam.amazonaws.com
x-amz-date:20230120T134621Z

content-type;host;x-amz-date
ea932dc167ba62f61056ffd881499668d7cf04f9c4ed7883675e860d28fff1e9
2023-01-20 19:16:21,066 - MainThread - botocore.auth - DEBUG - StringToSign:
AWS4-HMAC-SHA256
20230120T134621Z
20230120/us-east-1/iam/aws4_request
cd76b748d0c4a702558d813111d99a88aece9bfb131a556b418442e06c276b03
2023-01-20 19:16:21,068 - MainThread - botocore.auth - DEBUG - Signature:
2ae561df65b137f3b5eb337e0fba40070025f8f7abe908903b18a92f75c84bc0
2023-01-20 19:16:21,068 - MainThread - botocore.endpoint - DEBUG - Sending http request: <AWSPreparedRequest stream_output=False, method=POST, url=https://iam.amazonaws.com/, headers={'Content-Type': b'application/x-www-form-urlencoded; charset=utf-8', 'User-Agent': b'aws-cli/2.9.16 Python/3.9.11 Windows/10 exe/AMD64 prompt/off command/iam.get-account-password-policy', 'X-Amz-Date': b'20230120T134621Z', 'Authorization': b'AWS4-HMAC-SHA256 Credential=AKIAV4B5HOXQI4TPPPIV/20230120/us-east-1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=2ae561df65b137f3b5eb337e0fba40070025f8f7abe908903b18a92f75c84bc0', 'Content-Length': '50'}>
2023-01-20 19:16:21,070 - MainThread - botocore.httpsession - DEBUG - Certificate path: C:\Program Files\Amazon\AWSCLIV2\awscli\botocore\cacert.pem
2023-01-20 19:16:21,073 - MainThread - urllib3.connectionpool - DEBUG - Starting new HTTPS connection (1): iam.amazonaws.com:443
2023-01-20 19:16:23,194 - MainThread - urllib3.connectionpool - DEBUG - https://iam.amazonaws.com:443 "POST / HTTP/1.1" 404 310
2023-01-20 19:16:23,194 - MainThread - botocore.parsers - DEBUG - Response headers: {'x-amzn-RequestId': '73bd736a-01b3-4d06-80e9-8c3bc0ae19b4', 'Content-Type': 'text/xml', 'Content-Length': '310', 'Date': 'Fri, 20 Jan 2023 13:46:22 GMT'}
2023-01-20 19:16:23,196 - MainThread - botocore.parsers - DEBUG - Response body:
b'<ErrorResponse xmlns="https://iam.amazonaws.com/doc/2010-05-08/">\n  <Error>\n    <Type>Sender</Type>\n    <Code>NoSuchEntity</Code>\n    <Message>The Password Policy with domain name 403855341024 cannot be found.</Message>\n  </Error>\n  <RequestId>73bd736a-01b3-4d06-80e9-8c3bc0ae19b4</RequestId>\n</ErrorResponse>\n'
2023-01-20 19:16:23,200 - MainThread - botocore.parsers - DEBUG - Response headers: {'x-amzn-RequestId': '73bd736a-01b3-4d06-80e9-8c3bc0ae19b4', 'Content-Type': 'text/xml', 'Content-Length': '310', 'Date': 'Fri, 20 Jan 2023 13:46:22 GMT'}
2023-01-20 19:16:23,200 - MainThread - botocore.parsers - DEBUG - Response body:
b'<ErrorResponse xmlns="https://iam.amazonaws.com/doc/2010-05-08/">\n  <Error>\n    <Type>Sender</Type>\n    <Code>NoSuchEntity</Code>\n    <Message>The Password Policy with domain name 403855341024 cannot be found.</Message>\n  </Error>\n  <RequestId>73bd736a-01b3-4d06-80e9-8c3bc0ae19b4</RequestId>\n</ErrorResponse>\n'
2023-01-20 19:16:23,202 - MainThread - botocore.hooks - DEBUG - Event needs-retry.iam.GetAccountPasswordPolicy: calling handler <bound method RetryHandler.needs_retry of <botocore.retries.standard.RetryHandler object at 0x00000244ABAB68E0>>
2023-01-20 19:16:23,206 - MainThread - botocore.retries.standard - DEBUG - Not retrying request.
2023-01-20 19:16:23,207 - MainThread - botocore.hooks - DEBUG - Event after-call.iam.GetAccountPasswordPolicy: calling handler <function json_decode_policies at 0x00000244A9B8FB80>
2023-01-20 19:16:23,208 - MainThread - botocore.hooks - DEBUG - Event after-call.iam.GetAccountPasswordPolicy: calling handler <bound method RetryQuotaChecker.release_retry_quota of <botocore.retries.standard.RetryQuotaChecker object at 0x00000244ABAB63D0>>
2023-01-20 19:16:23,210 - MainThread - awscli.clidriver - DEBUG - Exception caught in main()
Traceback (most recent call last):
  File "awscli\clidriver.py", line 460, in main
  File "awscli\clidriver.py", line 595, in __call__
  File "awscli\clidriver.py", line 798, in __call__
  File "awscli\clidriver.py", line 929, in invoke
  File "awscli\clidriver.py", line 941, in _make_client_call
  File "awscli\botocore\client.py", line 341, in _api_call
  File "awscli\botocore\client.py", line 697, in _make_api_call
botocore.errorfactory.NoSuchEntityException: An error occurred (NoSuchEntity) when calling the GetAccountPasswordPolicy operation: The Password Policy with domain name 403855341024 cannot be found.

An error occurred (NoSuchEntity) when calling the GetAccountPasswordPolicy operation: The Password Policy with domain name 403855341024 cannot be found.

@wdower
Copy link

wdower commented Dec 11, 2023

I'm also hitting this bug in the AWS CLI and the SDK.

CLI command:

$> aws iam get-account-password-policy --debug 2>&1 | tee error.log

2023-12-11 21:29:17,379 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/2.13.37 Python/3.11.6 Linux/6.2.0-1016-azure exe/x86_64.ubuntu.20
2023-12-11 21:29:17,380 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['iam', 'get-account-password-policy', '--debug']
2023-12-11 21:29:17,399 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_s3 at 0x7ff00e5fc220>
2023-12-11 21:29:17,399 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_ddb at 0x7ff00e820ea0>
2023-12-11 21:29:17,399 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <bound method BasicCommand.add_command of <class 'awscli.customizations.configure.configure.ConfigureCommand'>>
2023-12-11 21:29:17,399 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function change_name at 0x7ff00eb831a0>
2023-12-11 21:29:17,399 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function change_name at 0x7ff00e7a8860>
2023-12-11 21:29:17,399 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function alias_opsworks_cm at 0x7ff00e5feca0>
2023-12-11 21:29:17,399 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_history_commands at 0x7ff00e853880>
2023-12-11 21:29:17,399 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <bound method BasicCommand.add_command of <class 'awscli.customizations.devcommands.CLIDevCommand'>>
2023-12-11 21:29:17,399 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_waiters at 0x7ff00e5feb60>
2023-12-11 21:29:17,399 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <bound method AliasSubCommandInjector.on_building_command_table of <awscli.alias.AliasSubCommandInjector object at 0x7ff00e4b5cd0>>
2023-12-11 21:29:17,399 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/aws-cli/v2/2.13.37/dist/awscli/data/cli.json
2023-12-11 21:29:17,401 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_types at 0x7ff00e731260>
2023-12-11 21:29:17,401 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function no_sign_request at 0x7ff00e731580>
2023-12-11 21:29:17,401 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_verify_ssl at 0x7ff00e7314e0>
2023-12-11 21:29:17,401 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_cli_read_timeout at 0x7ff00e7316c0>
2023-12-11 21:29:17,401 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_cli_connect_timeout at 0x7ff00e731620>
2023-12-11 21:29:17,401 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <built-in method update of dict object at 0x7ff00e4b3480>
2023-12-11 21:29:17,402 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/2.13.37 Python/3.11.6 Linux/6.2.0-1016-azure exe/x86_64.ubuntu.20 prompt/off
2023-12-11 21:29:17,402 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['iam', 'get-account-password-policy', '--debug']
2023-12-11 21:29:17,402 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function add_timestamp_parser at 0x7ff00e5fcb80>
2023-12-11 21:29:17,402 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function register_uri_param_handler at 0x7ff00ebf4c20>
2023-12-11 21:29:17,402 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function add_binary_formatter at 0x7ff00e6804a0>
2023-12-11 21:29:17,402 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function no_pager_handler at 0x7ff00ecef420>
2023-12-11 21:29:17,403 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function inject_assume_role_provider_cache at 0x7ff00ec20540>
2023-12-11 21:29:17,404 - MainThread - botocore.utils - DEBUG - IMDS ENDPOINT: http://169.254.169.254/
2023-12-11 21:29:17,406 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function attach_history_handler at 0x7ff00e8500e0>
2023-12-11 21:29:17,406 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function inject_json_file_cache at 0x7ff00e811120>
2023-12-11 21:29:17,426 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/aws-cli/v2/2.13.37/dist/awscli/botocore/data/iam/2010-05-08/service-2.json
2023-12-11 21:29:17,451 - MainThread - botocore.hooks - DEBUG - Event building-command-table.iam: calling handler <function _add_wizard_command at 0x7ff00e66b1a0>
2023-12-11 21:29:17,451 - MainThread - botocore.hooks - DEBUG - Event building-command-table.iam: calling handler <function add_waiters at 0x7ff00e5feb60>
2023-12-11 21:29:17,469 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/aws-cli/v2/2.13.37/dist/awscli/botocore/data/iam/2010-05-08/waiters-2.json
2023-12-11 21:29:17,470 - MainThread - botocore.hooks - DEBUG - Event building-command-table.iam: calling handler <bound method AliasSubCommandInjector.on_building_command_table of <awscli.alias.AliasSubCommandInjector object at 0x7ff00e4b5cd0>>
2023-12-11 21:29:17,470 - MainThread - awscli.clidriver - DEBUG - OrderedDict()
2023-12-11 21:29:17,471 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function add_streaming_output_arg at 0x7ff00e5fd080>
2023-12-11 21:29:17,471 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function add_cli_input_json at 0x7ff00ec20ea0>
2023-12-11 21:29:17,471 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function add_cli_input_yaml at 0x7ff00ec20f40>
2023-12-11 21:29:17,471 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function unify_paging_params at 0x7ff00e8214e0>
2023-12-11 21:29:17,489 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/aws-cli/v2/2.13.37/dist/awscli/botocore/data/iam/2010-05-08/paginators-1.json
2023-12-11 21:29:17,490 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.iam.get-account-password-policy: calling handler <function add_generate_skeleton at 0x7ff00e70fa60>
2023-12-11 21:29:17,490 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.iam.get-account-password-policy: calling handler <bound method OverrideRequiredArgsArgument.override_required_args of <awscli.customizations.cliinput.CliInputJSONArgument object at 0x7ff00d9f4cd0>>
2023-12-11 21:29:17,490 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.iam.get-account-password-policy: calling handler <bound method OverrideRequiredArgsArgument.override_required_args of <awscli.customizations.cliinput.CliInputYAMLArgument object at 0x7ff00db81710>>
2023-12-11 21:29:17,490 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.iam.get-account-password-policy: calling handler <bound method GenerateCliSkeletonArgument.override_required_args of <awscli.customizations.generatecliskeleton.GenerateCliSkeletonArgument object at 0x7ff00d8bd490>>
2023-12-11 21:29:17,490 - MainThread - botocore.hooks - DEBUG - Event building-command-table.iam_get-account-password-policy: calling handler <function add_waiters at 0x7ff00e5feb60>
2023-12-11 21:29:17,490 - MainThread - botocore.hooks - DEBUG - Event building-command-table.iam_get-account-password-policy: calling handler <bound method AliasSubCommandInjector.on_building_command_table of <awscli.alias.AliasSubCommandInjector object at 0x7ff00e4b5cd0>>
2023-12-11 21:29:17,491 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.iam.get-account-password-policy.cli-input-json: calling handler <awscli.paramfile.URIArgumentHandler object at 0x7ff00ebe1510>
2023-12-11 21:29:17,491 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.iam.get-account-password-policy.cli-input-yaml: calling handler <awscli.paramfile.URIArgumentHandler object at 0x7ff00ebe1510>
2023-12-11 21:29:17,491 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.iam.get-account-password-policy.generate-cli-skeleton: calling handler <awscli.paramfile.URIArgumentHandler object at 0x7ff00ebe1510>
2023-12-11 21:29:17,491 - MainThread - botocore.hooks - DEBUG - Event calling-command.iam.get-account-password-policy: calling handler <bound method CliInputArgument.add_to_call_parameters of <awscli.customizations.cliinput.CliInputJSONArgument object at 0x7ff00d9f4cd0>>
2023-12-11 21:29:17,491 - MainThread - botocore.hooks - DEBUG - Event calling-command.iam.get-account-password-policy: calling handler <bound method CliInputArgument.add_to_call_parameters of <awscli.customizations.cliinput.CliInputYAMLArgument object at 0x7ff00db81710>>
2023-12-11 21:29:17,491 - MainThread - botocore.hooks - DEBUG - Event calling-command.iam.get-account-password-policy: calling handler <bound method GenerateCliSkeletonArgument.generate_skeleton of <awscli.customizations.generatecliskeleton.GenerateCliSkeletonArgument object at 0x7ff00d8bd490>>
2023-12-11 21:29:17,492 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2023-12-11 21:29:17,492 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2023-12-11 21:29:17,492 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role-with-web-identity
2023-12-11 21:29:17,492 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: sso
2023-12-11 21:29:17,492 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: shared-credentials-file
2023-12-11 21:29:17,492 - MainThread - botocore.credentials - INFO - Found credentials in shared credentials file: ~/.aws/credentials
2023-12-11 21:29:17,493 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/aws-cli/v2/2.13.37/dist/awscli/botocore/data/endpoints.json
2023-12-11 21:29:17,507 - MainThread - botocore.hooks - DEBUG - Event choose-service-name: calling handler <function handle_service_name_alias at 0x7ff0109fcae0>
2023-12-11 21:29:17,526 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/aws-cli/v2/2.13.37/dist/awscli/botocore/data/iam/2010-05-08/endpoint-rule-set-1.json
2023-12-11 21:29:17,526 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/aws-cli/v2/2.13.37/dist/awscli/botocore/data/partitions.json
2023-12-11 21:29:17,531 - MainThread - botocore.hooks - DEBUG - Event creating-client-class.iam: calling handler <function add_generate_presigned_url at 0x7ff0111eec00>
2023-12-11 21:29:17,531 - MainThread - botocore.configprovider - DEBUG - Looking for endpoint for iam via: environment_service
2023-12-11 21:29:17,531 - MainThread - botocore.configprovider - DEBUG - Looking for endpoint for iam via: environment_global
2023-12-11 21:29:17,531 - MainThread - botocore.configprovider - DEBUG - Looking for endpoint for iam via: config_service
2023-12-11 21:29:17,532 - MainThread - botocore.configprovider - DEBUG - Looking for endpoint for iam via: config_global
2023-12-11 21:29:17,532 - MainThread - botocore.configprovider - DEBUG - No configured endpoint found.
2023-12-11 21:29:17,532 - MainThread - botocore.regions - DEBUG - Using partition endpoint for iam, us-gov-east-1: aws-us-gov-global
2023-12-11 21:29:17,535 - MainThread - botocore.endpoint - DEBUG - Setting iam timeout as (60, 60)
2023-12-11 21:29:17,537 - MainThread - botocore.regions - DEBUG - Calling endpoint provider with parameters: {'Region': 'us-gov-east-1', 'UseDualStack': False, 'UseFIPS': False}
2023-12-11 21:29:17,537 - MainThread - botocore.regions - DEBUG - Endpoint provider result: https://iam.us-gov.amazonaws.com
2023-12-11 21:29:17,537 - MainThread - botocore.regions - DEBUG - Selecting from endpoint provider's list of auth schemes: "sigv4". User selected auth scheme is: "None"
2023-12-11 21:29:17,537 - MainThread - botocore.regions - DEBUG - Selected auth type "v4" as "v4" with signing context params: {'region': 'us-gov-west-1', 'signing_name': 'iam'}
2023-12-11 21:29:17,537 - MainThread - botocore.hooks - DEBUG - Event provide-client-params.iam.GetAccountPasswordPolicy: calling handler <function base64_decode_input_blobs at 0x7ff00e680540>
2023-12-11 21:29:17,537 - MainThread - botocore.hooks - DEBUG - Event before-parameter-build.iam.GetAccountPasswordPolicy: calling handler <function generate_idempotent_uuid at 0x7ff0109fed40>
2023-12-11 21:29:17,538 - MainThread - botocore.hooks - DEBUG - Event before-call.iam.GetAccountPasswordPolicy: calling handler <function inject_api_version_header_if_needed at 0x7ff010a14860>
2023-12-11 21:29:17,538 - MainThread - botocore.endpoint - DEBUG - Making request for OperationModel(name=GetAccountPasswordPolicy) with params: {'url_path': '/', 'query_string': '', 'method': 'POST', 'headers': {'Content-Type': 'application/x-www-form-urlencoded; charset=utf-8', 'User-Agent': 'aws-cli/2.13.37 Python/3.11.6 Linux/6.2.0-1016-azure exe/x86_64.ubuntu.20 prompt/off command/iam.get-account-password-policy'}, 'body': {'Action': 'GetAccountPasswordPolicy', 'Version': '2010-05-08'}, 'url': 'https://iam.us-gov.amazonaws.com/', 'context': {'client_region': 'aws-us-gov-global', 'client_config': <botocore.config.Config object at 0x7ff00d9789d0>, 'has_streaming_input': False, 'auth_type': 'v4', 'signing': {'region': 'us-gov-west-1', 'signing_name': 'iam'}}}
2023-12-11 21:29:17,538 - MainThread - botocore.hooks - DEBUG - Event request-created.iam.GetAccountPasswordPolicy: calling handler <bound method RequestSigner.handler of <botocore.signers.RequestSigner object at 0x7ff00d37bc90>>
2023-12-11 21:29:17,538 - MainThread - botocore.hooks - DEBUG - Event choose-signer.iam.GetAccountPasswordPolicy: calling handler <function set_operation_specific_signer at 0x7ff0109fec00>
2023-12-11 21:29:17,538 - MainThread - botocore.auth - DEBUG - Calculating signature using v4 auth.
2023-12-11 21:29:17,538 - MainThread - botocore.auth - DEBUG - CanonicalRequest:
POST
/

content-type:application/x-www-form-urlencoded; charset=utf-8
host:iam.us-gov.amazonaws.com
x-amz-date:20231211T212917Z

content-type;host;x-amz-date
ea932dc167ba62f61056ffd881499668d7cf04f9c4ed7883675e860d28fff1e9
2023-12-11 21:29:17,538 - MainThread - botocore.auth - DEBUG - StringToSign:
AWS4-HMAC-SHA256
20231211T212917Z
20231211/us-gov-west-1/iam/aws4_request
a5f0391ad8658c55c22f737fb0d8dc6ae7e3eeea2591fba1dab8221fc80bca70
2023-12-11 21:29:17,538 - MainThread - botocore.auth - DEBUG - Signature:
1fbca2ed9685ee62b0b83d3981ba45863e0e6f544b735b6409af2bfb179e3092
2023-12-11 21:29:17,539 - MainThread - botocore.endpoint - DEBUG - Sending http request: <AWSPreparedRequest stream_output=False, method=POST, url=https://iam.us-gov.amazonaws.com/, headers={'Content-Type': b'application/x-www-form-urlencoded; charset=utf-8', 'User-Agent': b'aws-cli/2.13.37 Python/3.11.6 Linux/6.2.0-1016-azure exe/x86_64.ubuntu.20 prompt/off command/iam.get-account-password-policy', 'X-Amz-Date': b'20231211T212917Z', 'Authorization': b'AWS4-HMAC-SHA256 Credential=<crederntial>, SignedHeaders=content-type;host;x-amz-date, Signature=1fbca2ed9685ee62b0b83d3981ba45863e0e6f544b735b6409af2bfb179e3092', 'Content-Length': '50'}>
2023-12-11 21:29:17,539 - MainThread - botocore.httpsession - DEBUG - Certificate path: /usr/local/aws-cli/v2/2.13.37/dist/awscli/botocore/cacert.pem
2023-12-11 21:29:17,540 - MainThread - urllib3.connectionpool - DEBUG - Starting new HTTPS connection (1): iam.us-gov.amazonaws.com:443
2023-12-11 21:29:17,914 - MainThread - urllib3.connectionpool - DEBUG - https://iam.us-gov.amazonaws.com:443 "POST / HTTP/1.1" 404 310
2023-12-11 21:29:17,914 - MainThread - botocore.parsers - DEBUG - Response headers: {'x-amzn-RequestId': '3eae9747-1d01-4f04-979d-fafd7a1dafd7', 'Content-Type': 'text/xml', 'Content-Length': '310', 'Date': 'Mon, 11 Dec 2023 21:29:17 GMT'}
2023-12-11 21:29:17,915 - MainThread - botocore.parsers - DEBUG - Response body:
b'<ErrorResponse xmlns="https://iam.amazonaws.com/doc/2010-05-08/">\n  <Error>\n    <Type>Sender</Type>\n    <Code>NoSuchEntity</Code>\n    <Message>The Password Policy with domain name <acct> cannot be found.</Message>\n  </Error>\n  <RequestId>3eae9747-1d01-4f04-979d-fafd7a1dafd7</RequestId>\n</ErrorResponse>\n'
2023-12-11 21:29:17,917 - MainThread - botocore.parsers - DEBUG - Response headers: {'x-amzn-RequestId': '3eae9747-1d01-4f04-979d-fafd7a1dafd7', 'Content-Type': 'text/xml', 'Content-Length': '310', 'Date': 'Mon, 11 Dec 2023 21:29:17 GMT'}
2023-12-11 21:29:17,917 - MainThread - botocore.parsers - DEBUG - Response body:
b'<ErrorResponse xmlns="https://iam.amazonaws.com/doc/2010-05-08/">\n  <Error>\n    <Type>Sender</Type>\n    <Code>NoSuchEntity</Code>\n    <Message>The Password Policy with domain name <acct> cannot be found.</Message>\n  </Error>\n  <RequestId>3eae9747-1d01-4f04-979d-fafd7a1dafd7</RequestId>\n</ErrorResponse>\n'
2023-12-11 21:29:17,917 - MainThread - botocore.hooks - DEBUG - Event needs-retry.iam.GetAccountPasswordPolicy: calling handler <bound method RetryHandler.needs_retry of <botocore.retries.standard.RetryHandler object at 0x7ff00d3c3190>>
2023-12-11 21:29:17,918 - MainThread - botocore.retries.standard - DEBUG - Not retrying request.
2023-12-11 21:29:17,918 - MainThread - botocore.hooks - DEBUG - Event after-call.iam.GetAccountPasswordPolicy: calling handler <function json_decode_policies at 0x7ff0109ff9c0>
2023-12-11 21:29:17,918 - MainThread - botocore.hooks - DEBUG - Event after-call.iam.GetAccountPasswordPolicy: calling handler <bound method RetryQuotaChecker.release_retry_quota of <botocore.retries.standard.RetryQuotaChecker object at 0x7ff00d3c2d90>>
2023-12-11 21:29:17,918 - MainThread - awscli.clidriver - DEBUG - Exception caught in main()
Traceback (most recent call last):
  File "awscli/clidriver.py", line 460, in main
  File "awscli/clidriver.py", line 595, in __call__
  File "awscli/clidriver.py", line 798, in __call__
  File "awscli/clidriver.py", line 929, in invoke
  File "awscli/clidriver.py", line 941, in _make_client_call
  File "awscli/botocore/client.py", line 342, in _api_call
  File "awscli/botocore/client.py", line 701, in _make_api_call
botocore.errorfactory.NoSuchEntityException: An error occurred (NoSuchEntity) when calling the GetAccountPasswordPolicy operation: The Password Policy with domain name <acct> cannot be found.

An error occurred (NoSuchEntity) when calling the GetAccountPasswordPolicy operation: The Password Policy with domain name <acct> cannot be found.

Examining the AWS console shows that I do in fact have an account password policy:
image

If I edit the default password policy, like so:
image

Then suddenly the CLI command works as expected:

$> aws iam get-account-password-policy
{
    "PasswordPolicy": {
        "MinimumPasswordLength": 16,
        "RequireSymbols": false,
        "RequireNumbers": false,
        "RequireUppercaseCharacters": false,
        "RequireLowercaseCharacters": false,
        "AllowUsersToChangePassword": false,
        "ExpirePasswords": false,
        "HardExpiry": false
    }
}

So it looks like the AWS API thinks that having the default password policy in place is equivalent to having no password policy set at all. This is incorrect.

@aBurmeseDev aBurmeseDev changed the title Didn't get DefalutAccountPasswordPolicy When Calling "GetAccountPasswordPolicy" API. Didn't get DefaultAccountPasswordPolicy When Calling "GetAccountPasswordPolicy" API. Jul 3, 2024
@aBurmeseDev
Copy link
Member

Apologies for the long silence here. I've reached out to IAM team to get their insight on this and will report back. (ref: V1439088932)

@aBurmeseDev aBurmeseDev added the service-api This issue is due to a problem in a service API, not the SDK implementation. label Jul 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
iam p2 This is a standard priority issue service-api This issue is due to a problem in a service API, not the SDK implementation.
Projects
None yet
Development

No branches or pull requests

4 participants