Password policies and Password validation in Aurora MySQL

Password policies

Aurora MySQL supports the following MySQL password policy features. For more information on these policies, see MySQL Password Management documentation.

Password expiration

Password reuse restrictions

Current password verification

Dual password support

Failed-login tracking and temporary account locking

Using the validate_password component

The validate_password component is a MySQL server component that provides password strength validation and enforcement capabilities. It tests passwords against configurable rules to ensure they meet the specified security requirements before being accepted.

When enabled, the validate_password component automatically validates passwords during:

This helps organizations maintain strong password hygiene across their database users and comply with security policies and regulatory requirements.

Aurora MySQL version 8.4 provides a parameter-based approach to enable and manage the validate_password component, eliminating the need for manual INSTALL COMPONENT and UNINSTALL COMPONENT commands.

Enabling the validate_password component

To enable password validation in your Aurora MySQL cluster, use the cluster parameter:

Parameter name: aurora_enable_validate_password_component

To enable: Set aurora_enable_validate_password_component to true (or 1) in your DB cluster parameter group.

To disable: Set aurora_enable_validate_password_component to false (or 0) in your DB cluster parameter group.

SELECT @@global.aurora_enable_validate_password_component;

Supported validate_password component parameters

For more information on MySQL validate_password parameters, see MySQL Password Validation Options and Variables documentation.

validate_password plugin and component migration from RDS for MySQL or Aurora MySQL version 3 to Aurora MySQL version 8.4

Starting from Aurora MySQL version 8.4, if you had previously installed the validate_password plugin through the INSTALL PLUGIN command, you can migrate to the validate_password component by enabling the parameter aurora_enable_validate_password_component and then remove the plugin through the UNINSTALL PLUGIN command on your writer instance.

If you previously installed the validate_password component manually using INSTALL COMPONENT 'file://component_validate_password', ensure you set the aurora_enable_validate_password_component parameter in your target DB cluster parameter group when upgrading. After upgrading, the component will no longer be listed in the mysql.component table. You can use the aurora_enable_validate_password_component global variable to verify the status of the component.

On the first DB engine startup after upgrade, you will see the following message in your MySQL error log if you had previously installed the component manually:

Component 'file://component_validate_password' is being removed from mysql.component table.
validate_password component can be enabled/disabled through 'aurora_enable_validate_password_component' cluster parameter.

Manual installation restrictions

Starting Aurora MySQL version 8.4 releases, manual validate_password component install and uninstall commands are not allowed:

mysql> INSTALL COMPONENT 'file://component_validate_password';
ERROR HY000: Cannot load component from specified URN: 'validate_password component can be
enabled/disabled through 'aurora_enable_validate_password_component' cluster parameter.'

Monitoring component status

Aurora MySQL logs component state changes to the MySQL error log:

When enabled:

Component 'validate_password' is enabled by parameter aurora_enable_validate_password_component

When disabled:

Component 'validate_password' is disabled by parameter aurora_enable_validate_password_component

Password validation impact on master user password

When resetting the master user password through the modify-db-cluster API, if the new password does not comply with the configured password validation rules, Aurora MySQL will emit a customer-visible event indicating the failure, and you will have to retry the operation with a compliant password.

Password validation impact on Amazon RDS managed master user password

For clusters using Amazon RDS-managed master user credentials stored in AWS Secrets Manager, if the automatically generated password during rotation does not comply with the configured validation requirements, the rotation will fail. You will need to adjust your password validation parameters to allow the rotation to succeed. We suggest not using the validate_password component and managed master user password together.

Related documentation