Configuring the Password Policy

The final step

The last thing we want to do to secure our account is to apply an IAM password policy. There are a couple of interesting things here. For instance, you want to know that the IAM password policy does not apply to the AWS account root user password. Also, you can’t create a lockout policy. What AWS recommends, instead, is that you use multi-factor authentication. We enabled MFA on the root account, but you can enable it on other accounts as well. It’s best practice to do so for any administrative users that have significant privileges.