diff --git a/heat/engine/clients/os/keystone/fake_keystoneclient.py b/heat/engine/clients/os/keystone/fake_keystoneclient.py
index 9715c952f0..d2d287961d 100644
--- a/heat/engine/clients/os/keystone/fake_keystoneclient.py
+++ b/heat/engine/clients/os/keystone/fake_keystoneclient.py
@@ -51,7 +51,7 @@ class FakeKeystoneClient(object):
             secret = self.secret
         self.creds = FakeCred()
 
-    def create_stack_user(self, username, password=''):
+    def create_stack_user(self, username, password):
         self.username = username
         return self.user_id
 
diff --git a/heat/engine/clients/os/keystone/heat_keystoneclient.py b/heat/engine/clients/os/keystone/heat_keystoneclient.py
index a8dd7a6ed1..2cf8ee9976 100644
--- a/heat/engine/clients/os/keystone/heat_keystoneclient.py
+++ b/heat/engine/clients/os/keystone/heat_keystoneclient.py
@@ -283,7 +283,7 @@ class KsClientWrapper(object):
         # get the last 255 characters of the username
         return username[-255:]
 
-    def create_stack_user(self, username, password=''):
+    def create_stack_user(self, username, password):
         """Create a user defined as part of a stack.
 
         The user is defined either via template or created internally by a
diff --git a/tox.ini b/tox.ini
index e40e28c356..7dbbd6c212 100644
--- a/tox.ini
+++ b/tox.ini
@@ -101,7 +101,6 @@ deps =
 # The following bandit tests are being skipped:
 # B101: Test for use of assert
 # B104: Test for binding to all interfaces
-# B107: Test for use of hard-coded password argument defaults
 # B110: Try, Except, Pass detected.
 # B113: Requests call without timeout
 # B310: Audit url open for permitted schemes
@@ -112,7 +111,7 @@ deps =
 # B506: Test for use of yaml load
 # B603: Test for use of subprocess with shell equals true
 # B607: Test for starting a process with a partial path
-commands = bandit -r heat -x tests --skip B101,B104,B107,B110,B113,B310,B311,B404,B410,B504,B506,B603,B607
+commands = bandit -r heat -x tests --skip B101,B104,B110,B113,B310,B311,B404,B410,B504,B506,B603,B607
 
 [flake8]
 show-source = true