IAM Password Policy and MFA Enforcer

IAM Password Policy and MFA Enforcer

Two of the most commonly failed AWS security checks — weak password policy and no MFA enforcement — fixed in a single CloudFormation deployment. Covers both IAM console access and programmatic API calls.

What Gets Deployed

• IAM Account Password Policy — minimum 14 characters, uppercase, lowercase, numbers and symbols required, password reuse prevention (24 passwords), 90-day expiry, no password reset by user after expiry
• Service Control Policy (SCP) — attached to the AWS Organizations root (or a specified OU), denying all API calls for IAM users who have not enrolled an MFA device. Includes an exception list for the IAM actions needed to self-enroll MFA so users are never permanently locked out.
• MFA Enrollment Reminder — EventBridge rule + Lambda that scans IAM users without MFA daily and sends a formatted SES email listing violating users.

Developer Experience

Parameters let you scope the SCP to specific OUs rather than the full organization, set a grace period (default 7 days) before enforcement begins for existing users, and configure the reminder email recipient. The Lambda is written in Python 3.12 with no external dependencies.

What You Get

• iam-enforcer.yaml — CloudFormation template
• mfa-reminder/ — Lambda source with unit tests
• scp-policy.json — standalone SCP JSON if you prefer to apply manually
• README.md — parameter reference and rollout strategy for existing accounts

Requirements

AWS Organizations with SCPs enabled. SES must be out of sandbox for the reminder emails (or swap the notifier for SNS — instructions included).