Using the password validation plugins for RDS for MariaDB

Starting with RDS for MariaDB version 11.4, you can use the following password validation plugins to enhance the security of your database connections:

To enable these plugins, set the value of the parameter simple_password_check or cracklib_password_check to FORCE_PLUS_PERMANENT in the DB parameter group associated with the DB instance. When this value is set, the plugin can't be uninstalled by using the UNINSTALL PLUGIN statement at runtime.

To disable these plugins, set the value of the parameter simple_password_check or cracklib_password_check to OFF in the DB parameter group associated with the DB instance. When this value is set, the plugin validation rules no longer apply for new passwords.

For information about setting the values of parameters in parameter groups, see Modifying parameters in a DB parameter group in Amazon RDS.

After enabling the plugin, reset existing passwords to comply with your new validation policies.

Your MariaDB DB instance handles password validation for Amazon RDS. To change a password, you first submit a password update request through the Amazon Web Services Management Console, modify-db-instance Amazon CLI command, or ModifyDBInstance API operation. Amazon RDS initially accepts your request, even if the password doesn't meet your policies. Amazon RDS then processes the request asynchronously. It updates the password in your MariaDB DB instance only if the password meets your defined policies. If the password doesn't meet these policies, Amazon RDS keeps the existing password and logs an error event.

    Unable to reset your password. Error information: Password failed to meet validation rules.
            

For more information about Amazon RDS events, see Working with Amazon RDS event notification.