account-password-policy.yaml

---
# Copyright 2024 Electromech
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'Security: Account Password Policy'
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
    - Label:
        default: 'Password Policy Parameters'
      Parameters:
      - AllowUsersToChangePassword
      - HardExpiry
      - MaxPasswordAge
      - MinimumPasswordLength
      - PasswordReusePrevention
      - RequireLowercaseCharacters
      - RequireNumbers
      - RequireSymbols
      - RequireUppercaseCharacters
    - Label:
        default: 'Operational Parameters'
      Parameters:
      - LogsRetentionInDays
    - Label:
        default: 'Permission Parameters'
      Parameters:
      - PermissionsBoundary
Parameters:
  PermissionsBoundary:
    Description: 'Optional ARN for a policy that will be used as the permission boundary for all roles created by this template.'
    Type: String
    Default: ''
  AllowUsersToChangePassword:
    Description: 'You can permit all IAM users in your account to use the IAM console to change their own passwords.'
    Type: String
    Default: true
    AllowedValues:
    - true
    - false
  HardExpiry:
    Description: 'You can prevent IAM users from choosing a new password after their current password has expired.'
    Type: String
    Default: false
    AllowedValues:
    - true
    - false
  MaxPasswordAge:
    Description: 'You can set IAM user passwords to be valid for only the specified number of days. Choose 0 if you don not want passwords to expire.'
    Type: Number
    Default: 90
    ConstraintDescription: 'Must be in the range [0-1095]'
    MinValue: 0
    MaxValue: 1095
  MinimumPasswordLength:
    Description: 'You can specify the minimum number of characters allowed in an IAM user password.'
    Type: Number
    Default: 14
    ConstraintDescription: 'Must be in the range [6-128]'
    MinValue: 6
    MaxValue: 128
  PasswordReusePrevention:
    Description: 'You can prevent IAM users from reusing a specified number of previous passwords.'
    Type: Number
    Default: 24
    ConstraintDescription: 'Must be in the range [0-24]'
    MinValue: 0
    MaxValue: 24
  RequireLowercaseCharacters:
    Description: 'You can require that IAM user passwords contain at least one lowercase character from the ISO basic Latin alphabet (a to z).'
    Type: String
    Default: true
    AllowedValues:
    - true
    - false
  RequireNumbers:
    Description: 'You can require that IAM user passwords contain at least one numeric character (0 to 9).'
    Type: String
    Default: true
    AllowedValues:
    - true
    - false
  RequireSymbols:
    Description: 'You can require that IAM user passwords contain at least one of the following nonalphanumeric characters: ! @ # $ % ^ & * ( ) _ + - = [ ] {} | '''
    Type: String
    Default: true
    AllowedValues:
    - true
    - false
  RequireUppercaseCharacters:
    Description: 'You can require that IAM user passwords contain at least one uppercase character from the ISO basic Latin alphabet (A to Z).'
    Type: String
    Default: true
    AllowedValues:
    - true
    - false
  LogsRetentionInDays:
    Description: 'Specifies the number of days you want to retain log events in the specified log group.'
    Type: Number
    Default: 14
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
Conditions:
  HasPermissionsBoundary: !Not [!Equals [!Ref PermissionsBoundary, '']]
Resources:
  LambdaRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'lambda.amazonaws.com'
          Action: 'sts:AssumeRole'
      PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
      Policies:
      - PolicyName: iam
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - 'iam:UpdateAccountPasswordPolicy'
            - 'iam:DeleteAccountPasswordPolicy'
            Resource: '*'
  LambdaPolicy:
    Type: 'AWS::IAM::Policy'
    Properties:
      Roles:
      - !Ref LambdaRole
      PolicyName: lambda
      PolicyDocument:
        Statement:
        - Effect: Allow
          Action:
          - 'logs:CreateLogStream'
          - 'logs:PutLogEvents'
          Resource: !GetAtt 'LambdaLogGroup.Arn'
  LambdaFunctionV2: # needs no monitoring because it is used as a custom resource
    Type: 'AWS::Lambda::Function'
    Properties:
      Code:
        ZipFile: |
          const https = require('https');
          const { IAMClient, DeleteAccountPasswordPolicyCommand, UpdateAccountPasswordPolicyCommand } = require('@aws-sdk/client-iam');
          const iam = new IAMClient({});
          function sendResponse(event, context, status) {
            return new Promise((resolve, reject) => {
              const body = JSON.stringify({
                Status: status,
                Reason: `See CloudWatch Log Stream: ${context.logStreamName}`,
                PhysicalResourceId: context.logStreamName,
                StackId: event.StackId,
                RequestId: event.RequestId,
                LogicalResourceId: event.LogicalResourceId,
                Data: {}
              });
              const u = new URL(event.ResponseURL);
              const req = https.request({ hostname: u.hostname, path: u.pathname + u.search, method: 'PUT', headers: { 'Content-Type': '', 'Content-Length': Buffer.byteLength(body) } }, resolve);
              req.on('error', reject);
              req.write(body);
              req.end();
            });
          }
          exports.handler = async (event, context) => {
            console.log(`Invoke: ${JSON.stringify(event)}`);
            try {
              if (event.RequestType === 'Delete') {
                await iam.send(new DeleteAccountPasswordPolicyCommand({}));
              } else if (event.RequestType === 'Create' || event.RequestType === 'Update') {
                const params = {
                  MinimumPasswordLength: parseInt(event.ResourceProperties.MinimumPasswordLength, 10),
                  RequireSymbols: event.ResourceProperties.RequireSymbols === 'true',
                  RequireNumbers: event.ResourceProperties.RequireNumbers === 'true',
                  RequireUppercaseCharacters: event.ResourceProperties.RequireUppercaseCharacters === 'true',
                  RequireLowercaseCharacters: event.ResourceProperties.RequireLowercaseCharacters === 'true',
                  AllowUsersToChangePassword: event.ResourceProperties.AllowUsersToChangePassword === 'true',
                  HardExpiry: event.ResourceProperties.HardExpiry === 'true'
                };
                if (parseInt(event.ResourceProperties.MaxPasswordAge, 10) > 0) {
                  params.MaxPasswordAge = parseInt(event.ResourceProperties.MaxPasswordAge, 10);
                }
                if (parseInt(event.ResourceProperties.PasswordReusePrevention, 10) > 0) {
                  params.PasswordReusePrevention = parseInt(event.ResourceProperties.PasswordReusePrevention, 10);
                }
                await iam.send(new UpdateAccountPasswordPolicyCommand(params));
              } else {
                throw new Error(`unsupported RequestType: ${event.RequestType}`);
              }
              await sendResponse(event, context, 'SUCCESS');
            } catch (err) {
              console.log(`Error: ${err.message || err}`);
              await sendResponse(event, context, 'FAILED');
            }
          };
      Handler: 'index.handler'
      MemorySize: 128
      Role: !GetAtt 'LambdaRole.Arn'
      Runtime: 'nodejs24.x'
      Timeout: 60
  LambdaLogGroup:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      LogGroupName: !Sub '/aws/lambda/${LambdaFunctionV2}'
      RetentionInDays: !Ref LogsRetentionInDays
  PasswordPolicy:
    Type: 'Custom::PasswordPolicy'
    DependsOn:
    - LambdaLogGroup
    - LambdaPolicy
    Version: '1.0'
    Properties:
      HardExpiry: !Ref HardExpiry
      AllowUsersToChangePassword: !Ref AllowUsersToChangePassword
      MaxPasswordAge: !Ref MaxPasswordAge
      MinimumPasswordLength: !Ref MinimumPasswordLength
      PasswordReusePrevention: !Ref PasswordReusePrevention
      RequireLowercaseCharacters: !Ref RequireLowercaseCharacters
      RequireNumbers: !Ref RequireNumbers
      RequireSymbols: !Ref RequireSymbols
      RequireUppercaseCharacters: !Ref RequireUppercaseCharacters
      ServiceToken: !GetAtt 'LambdaFunctionV2.Arn'
Outputs:
  TemplateID:
    Description: 'Template id.'
    Value: 'account-password-policy'
  TemplateVersion:
    Description: 'Template version.'
    Value: '__VERSION__'
  StackName:
    Description: 'Stack name.'
    Value: !Sub '${AWS::StackName}'