5

Is there a way to implement a policy/rule to lock accounts that have failed login within a given time window? For instance, a user fails login 3 times in a 15 minute window, therefore their account is locked for either 60 minutes or until an admin grants them access.

Currently, there isn't an option for this in the AWS Identity & Access Management console, is there?

2 Answers 2

8

New IAM Features: Enhanced Password Management and Credential Reports

Lockout on login attempt failure is currently not supported. We have heard this request before and are evaluating it for inclusion on our roadmap.

Kai Zhao - Product Manager, AWS IAM

3
  • 3
    Thank you, would be very helpful in compliance with various standards/programs Jan 19, 2016 at 16:35
  • 1
    Yes I second this - PCI Compliance requires lockout after 6 failed attempts and their a 30 min cooldown or an administrator to manually re-anable
    – contool
    Jan 31, 2018 at 10:26
  • 2
    Has this been updated at all? Here for the same PCI Compliance requirements as @contool. If you were able to solve this 2 years ago, can you dm me?
    – dmorrow
    Sep 14, 2020 at 17:58
3

This is not available natively and you cannot temporarily disable console sign-in as far as I know (though you can deactivate IAM user keys).

You could potentially build a solution that tells you this kind of thing is happening, however, but it wouldn't be trivial. Failed Sign-in attempts are logged in CloudTrail so you could send the logs to CloudWatch Logs, and then process the relevant logs to detect sign-in anomalies, and take actions such as send notifications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.