Skip to content

Commit 437bd3b

Browse files
andywick-awsandywick-aws
committed
Adding password policy solution
1 parent 8cf246a commit 437bd3b

File tree

13 files changed

+674
-2
lines changed

13 files changed

+674
-2
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ platform (e.g. AWS Control Tower and AWS CloudFormation StackSets).
2828
* [Organization GuardDuty](solutions/guardduty/guardduty-org)
2929
* IAM
3030
* [Access Analyzer](solutions/iam/access-analyzer)
31+
* [Account Password Policy](solutions/iam/password-policy-acct)
3132
* Macie
3233
* [Organization Macie](solutions/macie/macie-org)
3334
* SecurityHub

‎extras/aws-control-tower/prerequisites/prereq-lambda-s3-bucket.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ Parameters:
3030
Resources:
3131
rLambdaS3Bucket:
3232
Type: AWS::S3::Bucket
33+
DeletionPolicy: Retain
34+
UpdateReplacePolicy: Retain
3335
Metadata:
3436
cfn_nag:
3537
rules_to_suppress:
@@ -54,6 +56,8 @@ Resources:
5456

5557
rLambdaS3BucketPolicy:
5658
Type: AWS::S3::BucketPolicy
59+
DeletionPolicy: Retain
60+
UpdateReplacePolicy: Retain
5761
Metadata:
5862
cfn_nag:
5963
rules_to_suppress:
@@ -69,7 +73,7 @@ Resources:
6973
StringEquals:
7074
aws:PrincipalOrgID: !Ref pOrganizationId
7175
ArnLike:
72-
aws:PrincipalArn: !Sub arn:${AWS::Partition}:iam::*:${pDeploymentRoleName}
76+
aws:PrincipalArn: !Sub arn:${AWS::Partition}:iam::*:role/${pDeploymentRoleName}
7377
Effect: Allow
7478
Principal: "*"
7579
Resource: !Sub arn:${AWS::Partition}:s3:::${rLambdaS3Bucket}/*

‎extras/lambda-s3-buckets.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ Resources:
5757
rLambdaS3Bucket:
5858
Type: AWS::S3::Bucket
5959
DeletionPolicy: Retain
60+
UpdateReplacePolicy: Retain
6061
Metadata:
6162
cfn_nag:
6263
rules_to_suppress:
@@ -82,6 +83,7 @@ Resources:
8283
rLambdaS3BucketPolicy:
8384
Type: AWS::S3::BucketPolicy
8485
DeletionPolicy: Retain
86+
UpdateReplacePolicy: Retain
8587
Metadata:
8688
cfn_nag:
8789
rules_to_suppress:
@@ -97,7 +99,7 @@ Resources:
9799
StringEquals:
98100
aws:PrincipalOrgID: !Ref pOrganizationId
99101
ArnLike:
100-
aws:PrincipalArn: !Sub arn:${AWS::Partition}:iam::*:${pDeploymentRoleName}
102+
aws:PrincipalArn: !Sub arn:${AWS::Partition}:iam::*:role/${pDeploymentRoleName}
101103
Effect: Allow
102104
Principal: "*"
103105
Resource: !Sub arn:${AWS::Partition}:s3:::${rLambdaS3Bucket}/*

‎solutions/iam/password-policy-acct/README.md‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: CC-BY-SA-4.0
2+
3+
# IAM Password Policy
4+
5+
The IAM Password Policy solution updates the AWS account password policy within all accounts in an AWS Organization.
6+
7+
----
8+
9+
# Table of Contents
10+
* [Deployed Resource Details](#deployed-resource-details)
11+
* [Implementation Instructions](#implementation-instructions)
12+
* [References](#references)
13+
14+
----
15+
16+
# Deployed Resource Details
17+
18+
![Architecture](./documentation/Password-Policy-Architecture.png "Architecture")
19+
20+
## 1.0 Organization Management Account
21+
22+
### 1.1 AWS CloudFormation
23+
24+
**Description:**
25+
26+
All resources deployed via CloudFormation StackSet and Stacks within member accounts
27+
28+
**Configuration:**
29+
30+
* StackSet Names:
31+
* StackSet-...-PasswordPolicy-...
32+
33+
### 1.2 AWS Lambda Function
34+
35+
**Description:**
36+
37+
The custom CloudFormation Lambda resource is required to update the existing IAM account password policy.
38+
39+
**Configuration:**
40+
41+
* Lambda Function Name - [Prefix]-password-policy-acct
42+
* Lambda S3 Bucket Name - Management account S3 bucket with the Lambda zip file
43+
* Lambda Zip File Name - Default = password-policy-acct.zip
44+
* Log Level - Default = debug, Valid Values = debug, info, warning, error, critical
45+
* Allow Users To Change Password - Default = true
46+
* Hard Expiry - Default = false
47+
* Max Password Age - Default = 90
48+
* Minimum Password Length - Default = 14
49+
* Password Reuse Prevention - Default = 24
50+
* Require Lowercase Characters - Default = true
51+
* Require Numbers - Default = true
52+
* Require Symbols - Default = true
53+
* Require Uppercase Characters - Default = true
54+
55+
56+
### 1.3 Amazon CloudWatch Log Group
57+
58+
**Description:**
59+
60+
Contains the Lambda function execution logs
61+
62+
**Configuration:**
63+
64+
* Log group name = /aws/lambda/[Lambda Function Name]
65+
* Retention = Never expire
66+
67+
68+
### 1.4 Lambda Execution IAM Role
69+
70+
**Description:**
71+
72+
Used by the custom CloudFormation Lambda function to update the account password policy
73+
74+
**Configuration:**
75+
76+
* Execution role name = [Prefix]-password-policy-lambda
77+
* Permissions:
78+
* CloudWatch Logs - Limited: Write on LogGroupName like /aws/lambda/[Lambda Function Name]
79+
* IAM - Limited: Write All resources
80+
81+
82+
### 1.5 IAM Password Policy
83+
84+
**Description:**
85+
86+
AWS account password policy for IAM users
87+
88+
**Configuration:**
89+
90+
* [Custom password policy options](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#password-policy-details)
91+
92+
----
93+
94+
## 2.0 All Organization Member Accounts
95+
96+
Same configuration details as 1.0 Organization Management Account
97+
98+
----
99+
100+
# Implementation Instructions
101+
102+
### [AWS Control Tower](./aws-control-tower)
103+
### CloudFormation StackSets
104+
105+
#### Solution Deployment Order
106+
1. All Accounts (PasswordPolicy)
107+
108+
#### Instructions
109+
110+
1. Create new or use an existing S3 bucket within the region owned by the Organization Management Account
111+
* Example bucket name: lambda-zips-[Management Account ID]-us-east-1
112+
* [Example CloudFormation Template](../../../extras/lambda-s3-buckets.yaml)
113+
2. Package the Lambda code into a zip file and upload it to the S3 bucket
114+
* Package and Upload the Lambda zip file to S3 (Packaging script: /extras/packaging-scripts/package-lambda.sh)
115+
3. Create CloudFormation StackSets using the following templates
116+
117+
| Account | StackSet Name | Template |
118+
| --------------- | ----------------- | ---------- |
119+
| All Accounts | PasswordPolicy | templates/password-policy-acct.yaml |
120+
121+
----
122+
123+
# References
124+
* [Setting an account password policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html)
125+
* [CIS AWS Foundations Benchmark controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls.html)

‎solutions/iam/password-policy-acct/aws-control-tower/README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: CC-BY-SA-4.0
2+
3+
----
4+
5+
# Implementation Instructions
6+
7+
1. Make sure the required [prerequisites](../../../../extras/aws-control-tower/prerequisites/README.md) are completed
8+
2. Package and upload the password-policy-acct Lambda function
9+
```shell
10+
export AWS_ACCESS_KEY_ID=INSERT_AWS_ACCESS_KEY_ID
11+
export AWS_SECRET_ACCESS_KEY=INSERT_AWS_SECRET_ACCESS_KEY
12+
export AWS_SESSION_TOKEN=INSERT_AWS_SESSION_TOKEN
13+
14+
export BUCKET=lambda-zips-CHANGE_ME_ACCOUNT_ID-CHANGE_ME_REGION
15+
sh ~/aws-security-reference-architecture-examples/extras/packaging-scripts/package-lambda.sh \
16+
--file_name password-policy-acct.zip \
17+
--bucket $BUCKET \
18+
--src_dir ~/aws-security-reference-architecture-examples/solutions/iam/password-policy-acct/code/src
19+
```
20+
3. Copy the files to the Customizations for AWS Control Tower configuration
21+
1. customizations-for-control-tower-configuration
22+
1. [manifest.yaml](manifest.yaml) -> manifest.yaml
23+
2. [parameters/password-policy-acct.json](parameters/password-policy-acct.json)
24+
-> parameters/password-policy-acct.json
25+
3. [templates/password-policy-acct.yaml](../templates/password-policy-acct.yaml)
26+
-> templates/password-policy-acct.yaml
27+
28+
4. Update the parameter files with any specific values for your environment
29+
5. Update the manifest.yaml file with your account names and SSM parameters
30+
6. Deploy the Customizations for AWS Control Tower configuration
31+
7. How to verify after the pipeline completes?
32+
1. Log into any account within the AWS Organization
33+
1. Navigate to the IAM -> Account settings page
34+
2. Verify the custom password policy settings
35+
36+
# Delete Instructions
37+
38+
1. Within the Customizations for AWS Control Tower configuration
39+
1. Remove the Password Policy configuration from the manifest.yaml file
40+
2. (Optional) Delete the parameter and template files for the Password Policy solution
41+
2. Deploy the Customizations for AWS Control Tower configuration
42+
3. After the pipeline completes, log into the Management account and navigate to the CloudFormation StackSet page
43+
1. Delete the Stack Instances from the CustomControlTower-PasswordPolicy CloudFormation StackSet
44+
2. After the Stack Instance deletes, delete the CustomControlTower-PasswordPolicy CloudFormation StackSet

‎solutions/iam/password-policy-acct/aws-control-tower/manifest-v2.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
#Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets
3+
region: us-east-1
4+
version: 2021-03-15
5+
6+
# Control Tower Custom Resources (Service Control Policies or CloudFormation)
7+
resources:
8+
# -----------------------------------------------------------------------------
9+
# IAM Password Policy
10+
# -----------------------------------------------------------------------------
11+
- name: PasswordPolicy
12+
resource_file: templates/password-policy-acct.yaml
13+
parameters:
14+
- parameter_key: pAllowUsersToChangePassword
15+
parameter_value: "true"
16+
- parameter_key: pHardExpiry
17+
parameter_value: "false"
18+
- parameter_key: pMaxPasswordAge
19+
parameter_value: "90"
20+
- parameter_key: pMinimumPasswordLength
21+
parameter_value: "14"
22+
- parameter_key: pPasswordReusePrevention
23+
parameter_value: "24"
24+
- parameter_key: pRequireLowercaseCharacters
25+
parameter_value: "true"
26+
- parameter_key: pRequireNumbers
27+
parameter_value: "true"
28+
- parameter_key: pRequireSymbols
29+
parameter_value: "true"
30+
- parameter_key: pRequireUppercaseCharacters
31+
parameter_value: "true"
32+
- parameter_key: pLambdaExecutionRoleName
33+
parameter_value: "cfct-password-policy-acct-lambda"
34+
- parameter_key: pLambdaFunctionName
35+
parameter_value: "cfct-password-policy-acct"
36+
- parameter_key: pLambdaS3BucketName
37+
parameter_value: $[alfred_ssm_/org/primary/lambda_zips_bucket/us-east-1]
38+
- parameter_key: pLambdaZipFileName
39+
parameter_value: "password-policy-acct.zip"
40+
- parameter_key: pLogLevel
41+
parameter_value: "debug"
42+
deploy_method: stack_set
43+
deployment_targets:
44+
organizational_units:
45+
- Core
46+
- management
47+
- workloads

‎solutions/iam/password-policy-acct/aws-control-tower/manifest.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
#Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets
3+
region: us-east-1
4+
version: 2020-01-01
5+
6+
# Control Tower Custom Service Control Policies
7+
organization_policies: []
8+
9+
# Control Tower Custom CloudFormation Resources
10+
cloudformation_resources:
11+
# -----------------------------------------------------------------------------
12+
# IAM Password Policy
13+
# -----------------------------------------------------------------------------
14+
- name: PasswordPolicy
15+
template_file: templates/password-policy-acct.yaml
16+
parameter_file: parameters/password-policy-acct.json
17+
deploy_method: stack_set
18+
deploy_to_ou:
19+
- Core
20+
- management
21+
- workloads

‎solutions/iam/password-policy-acct/aws-control-tower/parameters/password-policy-acct.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
[
2+
{
3+
"ParameterKey": "pAllowUsersToChangePassword",
4+
"ParameterValue": "true"
5+
},
6+
{
7+
"ParameterKey": "pHardExpiry",
8+
"ParameterValue": "false"
9+
},
10+
{
11+
"ParameterKey": "pMaxPasswordAge",
12+
"ParameterValue": "90"
13+
},
14+
{
15+
"ParameterKey": "pMinimumPasswordLength",
16+
"ParameterValue": "14"
17+
},
18+
{
19+
"ParameterKey": "pPasswordReusePrevention",
20+
"ParameterValue": "24"
21+
},
22+
{
23+
"ParameterKey": "pRequireLowercaseCharacters",
24+
"ParameterValue": "true"
25+
},
26+
{
27+
"ParameterKey": "pRequireNumbers",
28+
"ParameterValue": "true"
29+
},
30+
{
31+
"ParameterKey": "pRequireSymbols",
32+
"ParameterValue": "true"
33+
},
34+
{
35+
"ParameterKey": "pRequireUppercaseCharacters",
36+
"ParameterValue": "true"
37+
},
38+
{
39+
"ParameterKey": "pLambdaExecutionRoleName",
40+
"ParameterValue": "cfct-password-policy-acct-lambda"
41+
},
42+
{
43+
"ParameterKey": "pLambdaFunctionName",
44+
"ParameterValue": "cfct-password-policy-acct"
45+
},
46+
{
47+
"ParameterKey": "pLambdaS3BucketName",
48+
"ParameterValue": "$[alfred_ssm_/org/primary/lambda_zips_bucket/us-east-1]"
49+
},
50+
{
51+
"ParameterKey": "pLambdaZipFileName",
52+
"ParameterValue": "password-policy-acct.zip"
53+
},
54+
{
55+
"ParameterKey": "pLogLevel",
56+
"ParameterValue": "debug"
57+
}
58+
]

0 commit comments

Comments
 (0)