diff --git a/backend/apps/monitor/views.py b/backend/apps/monitor/views.py
index 58080f7..66da080 100644
--- a/backend/apps/monitor/views.py
+++ b/backend/apps/monitor/views.py
@@ -253,6 +253,16 @@ def iam_user_create_view(request):
             svc.create_login_profile(d['username'], password)
             result_info['login_enabled'] = True
         except VolcengineAPIError as e:
+            if 'InvalidPassword' in str(e):
+                # Rollback: delete the user we just created
+                try:
+                    svc.client.call("DeleteUser", {"UserName": d['username']})
+                except Exception:
+                    pass
+                return Response({
+                    'message': f'火山控制台密码不符合要求（需包含大小写字母、数字和特殊字符，至少8位）',
+                    'detail': str(e),
+                }, status=status.HTTP_400_BAD_REQUEST)
             result_info['login_error'] = str(e)
 
     # 3. Create access key
diff --git a/frontend/src/views/iam/IAMUserList.vue b/frontend/src/views/iam/IAMUserList.vue
index a444be2..19095c7 100644
--- a/frontend/src/views/iam/IAMUserList.vue
+++ b/frontend/src/views/iam/IAMUserList.vue
@@ -327,7 +327,8 @@
           <el-input v-model="createForm.password" type="password" show-password
                     placeholder="选填" />
           <div style="font-size:12px;color:#999;margin-top:4px;">
-            火山引擎网页后台的登录密码。不填则子账号无法登录火山网页后台，仅能通过 API Key 使用服务
+            火山引擎网页后台的登录密码。不填则子账号无法登录火山网页后台，仅能通过 API Key 使用服务。
+            密码需包含大小写字母、数字和特殊字符，至少8位（如 User@1234）
           </div>
         </el-form-item>
         <el-form-item label="关联项目">