c8.5 Enforce password policy and account-lockout controls
Where passwords are used, enforce PCI-compliant length, complexity, history, and change rules, and apply account-lockout where the platform supports it. IAM users have no native lockout, so AWS relies on MFA and anomaly detection for those.
Requirement 8
Identify Users and Authenticate Access to System Components
PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.
8.3 Strong authentication for users and administrators is established and managed
- 8.3.1 All access authenticated via at least one strong auth factor Covered
- 8.3.2 Strong cryptography protects auth factors in transit and storage Covered
- 8.3.3 User identity verified before modifying an auth factor Your responsibility
- 8.3.4 Invalid auth attempts limited (lockout) — Cognito/IdP; IAM users need MFA Roadmap
- 8.3.5 Passwords/passphrases set and reset securely Covered
- 8.3.6 Minimum password length and complexity Covered
- 8.3.7 No reuse of the last four passwords/passphrases Covered
- 8.3.8 Authentication policies documented and communicated to users Your responsibility
- 8.3.9 If single-factor password: change every 90 days or dynamic analysis Covered
- 8.3.10 SP customer password guidance (service providers only) Your responsibility
- 8.3.11 Physical/logical tokens, smart cards, certificates assigned individually Out of scope
How to implement on AWS
Set an IAM account password policy (minimum length, complexity, reuse prevention, expiry) for IAM users. Important: IAM does NOT support account lockout after failed sign-in attempts — AWS’s guidance is to pair a strong password policy with MFA, and detect anomalous sign-ins with GuardDuty. Lockout (PCI 8.3.4) is achievable where you control authentication: Amazon Cognito advanced security (application users), and the external IdP or AWS Managed Microsoft AD for workforce users via IAM Identity Center. Prefer federation and MFA so passwords are never the only factor.
Practical implementation
How this control is implemented in each reference architecture:
Apply a compliant password policy everywhere local passwords exist; add lockout where the platform supports it, and MFA where it does not (IAM).
- Set the IAM account password policy: minimum length 12+, require character classes, prevent reuse of last 4, and set expiry per your policy. (IAM has no lockout parameter.)Whole account
IAM - Require MFA for all IAM users and detect brute-force/anomalous sign-ins with GuardDuty — the compensating controls for the missing IAM lockout.Whole account IAM
GuardDuty - For application users, enable Amazon Cognito advanced security (adaptive auth / compromised-credential protection) and account-lockout behavior after repeated failed attempts.
- For workforce users, enforce lockout in the external IdP (or AWS Managed Microsoft AD) that backs their sign-in (connected to IAM Identity Center where you use it).
How to validate: IAM password policy meets length/complexity/reuse/expiry; MFA is enforced for IAM users; Cognito and the workforce IdP enforce lockout after ≤10 failed attempts.
Avoid: Claiming IAM enforces lockout. It does not — use MFA + GuardDuty for IAM users, and real lockout in Cognito / the IdP / AD.
Standardize password policy across the org; enforce real lockout in Cognito and the workforce IdP; compensate IAM users with MFA and org-wide anomaly detection.
- Enforce a baseline IAM password policy in every account via a Config conformance pack and remediate drift. (No lockout parameter exists in IAM.)All accounts
AWS Config 
AWS Organizations - Centralize workforce access in IAM Identity Center backed by an IdP (or AWS Managed Microsoft AD) that enforces account lockout; require MFA.
- Apply Cognito advanced security and lockout to all customer-facing applications.
- Aggregate GuardDuty anomalous-sign-in findings org-wide to compensate for the absence of IAM lockout.Security account GuardDuty
Security Hub
How to validate: Config reports the password-policy baseline compliant across accounts; the workforce IdP and Cognito enforce lockout; MFA is required for IAM users.
Avoid: Assuming a single IAM setting delivers PCI 8.3.4. Lockout lives in Cognito / the IdP / AD, not IAM.
PCI validation
Testing procedures
- Examine the IAM account password policy, IAM Identity Center / IdP (or AWS Managed Microsoft AD), and Cognito user-pool configurations to verify length, complexity, reuse, change, and — where supported — account-lockout requirements are enforced.
- Verify MFA is enforced for IAM users as the compensating control where native lockout is unavailable.
Evidence in AWS
- IAM get-account-password-policy output
- MFA enforcement status for IAM users
- Cognito user-pool advanced-security and lockout settings
- Workforce IdP / AWS Managed Microsoft AD lockout policy
- GuardDuty findings for anomalous sign-ins
Customized approach
Customized Approach Objective
- 8.3 — Accounts are protected against unauthorized access by enforcing strong, well-managed authentication-factor rules.
AWS services
AWS IAM Amazon Cognito AWS Organizations Amazon GuardDuty Learning resources
References
- https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html
- https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html