---
title: IAM user LoginProfile password is in plaintext
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Infrastructure as Code (IaC)
  Security > IaC Security Rules > IAM user LoginProfile password is in plaintext
---

# IAM user LoginProfile password is in plaintext

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**Id:** `cloudformation-aws-iam-user-login-profile-password-is-in-plaintext` 

**Provider:** AWS

**Platform:** CloudFormation

**Severity:** High

**Category:** Secret Management

#### Learn More{% #learn-more %}

- [Provider Reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-user.html)

### Description{% #description %}

Defining an IAM user's console password as a plaintext string in an AWS CloudFormation template embeds credentials in source control and template history, increasing the risk of credential leakage and unauthorized account access. For `AWS::IAM::User` resources, `Properties.LoginProfile.Password` must not be a string literal. Resources where `Properties.LoginProfile.Password` is a literal string will be flagged. Use an AWS Secrets Manager dynamic reference to supply the password so it is not stored directly in the template.

Secure configuration example using a Secrets Manager dynamic reference:

```yaml
MyUser:
  Type: AWS::IAM::User
  Properties:
    UserName: example-user
    LoginProfile:
      Password: "{{resolve:secretsmanager:my-app/iam/user-password:SecretString:password}}"
      PasswordResetRequired: true
```

## Compliant Code Examples{% #compliant-code-examples %}

```yaml
AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
Resources:
    myTopuser:
      Type: AWS::IAM::User
      Properties:
        Path: "/"
        LoginProfile:
         Password:
         - !Ref NoEcho
         PasswordResetRequired: false
        Policies:
        - PolicyName: giveaccesstoqueueonly
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - sqs:*
              Resource:
              - !GetAtt myqueue.Arn
            - Effect: Deny
              Action:
              - sqs:*
              NotResource:
              - !GetAtt myqueue.Arn
```

```yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
Resources:
    myNewuser:
      Type: AWS::IAM::User
      Properties:
        Path: "/"
        LoginProfile:
         Password:
         - !Ref secretsmanager
         PasswordResetRequired: false
        Policies:
        - PolicyName: giveaccesstoqueueonly
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - sqs:*
              Resource:
              - !GetAtt myqueue.Arn
            - Effect: Deny
              Action:
              - sqs:*
              NotResource:
              - !GetAtt myqueue.Arn
```

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```yaml
AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
Resources:
    myuser:
      Type: AWS::IAM::User
      Properties:
        Path: "/"
        LoginProfile:
         Password: myP@ssW0rd
         PasswordResetRequired: false
        Policies:
        - PolicyName: giveaccesstoqueueonly
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - sqs:*
              Resource:
              - !GetAtt myqueue.Arn
            - Effect: Deny
              Action:
              - sqs:*
              NotResource:
              - !GetAtt myqueue.Arn
```