DR Password Requirements Policy

This is a record in the Decision Records on Solutions Adopted.

Issue

• DR: Password Requirements policy #62
• DR: Max attempts before account lockdown policy #64 was closed as "covered by #62", so the max-login-attempts decision is recorded here rather than on a page of its own.

Problem Statement

• We need to document what our password requirements are, so that we can create further issues to get compliance across all our password locations. This needs to cover password length, password complexity, and max login attempts.

Potential Solution

Recommendation by @bltomlin, 2025-03-07.

Password length

• Minimum: 16 characters.
• Longer passwords are encouraged for added security.

Password complexity

• Must include a mix of uppercase letters, lowercase letters, numbers, and symbols.
• No personal information (e.g. names, birthdays, or common words).
• Use a password manager for secure storage.

Max login attempts

• Accounts lock after 5 failed attempts.
• Locked accounts require DevOps-Security verification to reset.
• Multi-Factor Authentication (MFA) is required for all critical accounts.

Feasibility Determination

• Adopted. Approved by @ale210 on 2025-03-13; the issue was closed the same day.
• No separate feasibility analysis was recorded on the issue — the recommendation above was approved as written.

Summary

• Adopted but not implemented. The issue's last action item, "Create an issue to write code and implement policy", was never done: no implementation issue exists in devops-security, no aws_iam_account_password_policy is declared anywhere in that repo's Terraform, and the incubator AWS account (035866691871) returns NoSuchEntity for iam get-account-password-policy. Checked 2026-08-24. The org account was not checked.