Merge pull request #19 from quantum-sec/feature/EN-473

EN-473: Add IAM Password Policy module

modules/aws-iam-password-policy/main.tf

@@ -0,0 +1,19 @@
+terraform {
+  required_version = ">= 0.12"
+}
+
+# --------------------------------------------------------------------------------------------------
+# Password Policy
+# --------------------------------------------------------------------------------------------------
+
+resource "aws_iam_account_password_policy" "default" {
+  minimum_password_length        = var.minimum_password_length
+  password_reuse_prevention      = var.password_reuse_prevention
+  require_lowercase_characters   = var.require_lowercase_characters
+  require_numbers                = var.require_numbers
+  require_uppercase_characters   = var.require_uppercase_characters
+  require_symbols                = var.require_symbols
+  allow_users_to_change_password = var.allow_users_to_change_password
+  max_password_age               = var.max_password_age
+  count                          = var.create_password_policy ? 1 : 0
+}

modules/aws-iam-password-policy/vars.tf

@@ -0,0 +1,45 @@
+variable "max_password_age" {
+  description = "The number of days that an user password is valid."
+  default     = 90
+}
+
+variable "minimum_password_length" {
+  description = "Minimum length to require for user passwords."
+  default     = 14
+}
+
+variable "password_reuse_prevention" {
+  description = "The number of previous passwords that users are prevented from reusing."
+  default     = 24
+}
+
+variable "require_lowercase_characters" {
+  description = "Whether to require lowercase characters for user passwords."
+  default     = true
+}
+
+variable "require_numbers" {
+  description = "Whether to require numbers for user passwords."
+  default     = true
+}
+
+variable "require_uppercase_characters" {
+  description = "Whether to require uppercase characters for user passwords."
+  default     = true
+}
+
+variable "require_symbols" {
+  description = "Whether to require symbols for user passwords."
+  default     = true
+}
+
+variable "allow_users_to_change_password" {
+  description = "Whether to allow users to change their own password."
+  default     = true
+}
+
+variable "create_password_policy" {
+  type        = bool
+  description = "Define if the password policy should be created."
+  default     = true
+}