AWS Certified Cloud Practitioner / Identity and Access Management

IAM MFA Overview

🛡️ Protecting IAM Users — Password Policy & MFA

Once users exist, the next job is keeping their accounts from getting compromised. Two main defenses:

🔐 1. Password Policy

Passwords are the first layer of defense. The stronger the policy, the harder an account is to guess, crack, brute-force, or compromise through reused credentials. A weak password can put your whole AWS environment at risk.

What you can configure:

  • Minimum length — set how long passwords must be

  • Complexity — require uppercase, lowercase, numbers, and symbols (@, #, !)

  • Who can change passwords — users themselves, or admins only

  • Expiration — force rotation on a schedule (e.g. every 90 days)

  • No reuse — block users from recycling old passwords

This protects against brute-force attempts, credential stuffing, and weak reused passwords. But passwords alone aren't enough.

🔑 2. Multi-Factor Authentication (MFA)

MFA is the stronger layer. Turn it on for the root account, admins, and anyone with elevated permissions — a compromised account with real access can delete resources or wreck infrastructure.

MFA = two things combined:

  1. Something you know → your password

  2. Something you have → a device

Even if Alice's password leaks, an attacker still can't log in without her device too.

Bottom line: 🔐 Password policy stops weak-credential attacks. 🔑 MFA stops attackers even when a password is stolen.