How Do I Configure a Password Expiration Policy for My RDS for MySQL Instance?

Changing the Global Automatic Password Expiration Policy

Change the value of the default_password_lifetime parameter on the RDS console. For details, see Modifying Parameters of an RDS for MySQL Instance.

Checking the Password Expiration Date of All Users

Run the following command:

mysql> select user,host,password_expired,password_last_changed,password_lifetime from user;

Checking the Password Expiration Policy of a Specified User

Run the following command:

mysql> show create user jeffrey@'localhost';

EXPIRE DEFAULT indicates that the password follows the global expiration policy.

Configuring the Password Expiration Policy for a Specified User

• Configuring the password expiration policy during user creation

  create user 'script'@'localhost' identified by '*********' password expire interval 90 day;

• Configuring the password expiration policy after user creation

  ALTER USER 'script'@'localhost' PASSWORD EXPIRE INTERVAL 90 DAY;

• Setting the password to be permanently valid

  CREATE USER 'mike'@'%' PASSWORD EXPIRE NEVER;
  ALTER USER 'mike'@'%' PASSWORD EXPIRE NEVER;

• Setting the password to follow the global expiration policy

  CREATE USER 'mike'@'%' PASSWORD EXPIRE DEFAULT;
  ALTER USER 'mike'@'%' PASSWORD EXPIRE DEFAULT;