---
title: Password policy should prevent password reuse
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Password policy should prevent password
  reuse
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Password policy should prevent password reuse
 
## Description{% #description %}

AWS IAM account password policies should prevent password reuse by remembering at least the last 24 passwords for each user. Allowing password reuse increases the risk of account compromise, particularly when previously exposed or weak passwords are reused. This rule fails when **Prevent password reuse** is not enabled or when `PasswordReusePrevention` is set below 24.

## Remediation{% #remediation %}

1. In the [IAM console](https://console.aws.amazon.com/iam), select **Account settings**, check **Prevent password reuse**, and set **Remember XX password(s)** to 24 or greater.
1. Alternatively, run `aws iam update-account-password-policy --password-reuse-prevention 24`, as described in [update-account-password-policy](https://docs.aws.amazon.com/cli/latest/reference/iam/update-account-password-policy.html). The command replaces the entire password policy, so also pass the account's existing settings, which you can get with `aws iam get-account-password-policy`.

## References{% #references %}

- [Set an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)