Which statement about an AWS account password policy is correct?
Show answer and explanation
Answer: B
An IAM account password policy defines the rules passwords must satisfy for IAM users in that account: minimum length, character mix, rotation cadence, and reuse limits.
The root user's password is managed directly by the account owner and is outside this policy, federated users keep their password rules with the external identity provider, and satisfying a strong-password rule has no effect on what permissions a user holds.
Why the other options are wrong
- A. The password policy applies to IAM users' passwords; the root user's password is set and reset by the account owner directly.
- C. Federated users authenticate outside AWS, so their password rules live with the external identity provider, not in the AWS password policy.
- D. Permissions come exclusively from attached policies; password strength never changes what a user may do.