Project: KICS (Provisioning / Security & Compliance)
File: a964d6e3-8e1e-4d93-8120-61fa640dd55a.md

title: IAM User Without Password Reset hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a964d6e3-8e1e-4d93-8120-61fa640dd55a Query name: IAM User Without Password Reset Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Best Practices URL: IAM User Login Profile should exist and have PasswordResetRequired property set to true<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="10" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: myuser: Type: AWS::IAM::User Properties: Path: "/" LoginProfile: Password: myP@ssW0rd PasswordResetRequired: false Policies: PolicyName: giveaccesstoqueueonly PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: sqs:* Resource: !GetAtt myqueue.Arn Effect: Deny Action: sqs:* NotResource: !GetAtt myqueue.Arn ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="8" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: newuser: Type: AWS::IAM::User Properties: Path: "/" LoginProfile: Password: myP@ssW0rd Policies: PolicyName: giveaccesstoqueueonly PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: sqs:* Resource: !GetAtt myqueue.Arn Effect: Deny Action: sqs:* NotResource: !GetAtt myqueue.Arn ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="6" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: topuser: Type: AWS::IAM::User Properties: Path: "/" Policies: PolicyName: giveaccesstoqueueonly PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: sqs:* Resource: !GetAtt myqueue.Arn Effect: Deny Action: sqs:* NotResource: !GetAtt myqueue.Arn ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="38" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "myuser": { "Properties": { "Policies": [ { "PolicyName": "giveaccesstoqueueonly", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sqs:*" ], "Resource": [ "myqueue.Arn" ] }, { "Effect": "Deny", "Action": [ "sqs:*" ], "NotResource": [ "myqueue.Arn" ] } ] } } ], "Path": "/", "LoginProfile": { "Password": "myP@ssW0rd", "PasswordResetRequired": false } }, "Type": "AWS::IAM::User" } } } ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="9" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "newuser": { "Type": "AWS::IAM::User", "Properties": { "Path": "/", "LoginProfile": { "Password": "myP@ssW0rd" }, "Policies": [ { "PolicyName": "giveaccesstoqueueonly", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sqs:*" ], "Resource": [ "myqueue.Arn" ] }, { "Effect": "Deny", "Action": [ "sqs:*" ], "NotResource": [ "myqueue.Arn" ] } ] } } ] } } } } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="7" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "topuser": { "Type": "AWS::IAM::User", "Properties": { "Path": "/", "Policies": [ { "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Action": [ "sqs:*" ], "Resource": [ "myqueue.Arn" ], "Effect": "Allow" }, { "Effect": "Deny", "Action": [ "sqs:*" ], "NotResource": [ "myqueue.Arn" ] } ] }, "PolicyName": "giveaccesstoqueueonly" } ] } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: myuser: Type: AWS::IAM::User Properties: Path: "/" LoginProfile: Password: myP@ssW0rd PasswordResetRequired: true Policies: PolicyName: giveaccesstoqueueonly PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: sqs:* Resource: !GetAtt myqueue.Arn Effect: Deny Action: sqs:* NotResource: !GetAtt myqueue.Arn ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "myuser": { "Type": "AWS::IAM::User", "Properties": { "Path": "/", "LoginProfile": { "Password": "myP@ssW0rd", "PasswordResetRequired": true }, "Policies": [ { "PolicyName": "giveaccesstoqueueonly", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sqs:*" ], "Resource": [ "myqueue.Arn" ] }, { "Effect": "Deny", "Action": [ "sqs:*" ], "NotResource": [ "myqueue.Arn" ] } ] } } ] } } } } ```