Back to Checks
aws

Cognito user pool has a password policy with a minimum length of 14 characters or more

cognito_user_pool_password_policy_minimum_length_14
Service: cognitoSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

Amazon Cognito user pools should have a password policy requiring a minimum length of 14.

This evaluation detects pools without a policy or with minimum_length below 14.

Prowler logoProwlerprowler-provider-aws

Risk

Low or missing password minimums enable weak credentials, increasing successful brute force, password spraying, and credential stuffing against sign-in endpoints.

Resulting account takeover threatens confidentiality (data exposure) and integrity/availability (unauthorized changes and abuse).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cognito_user_pool_password_policy_minimum_length_14

Recommendation

Adopt a strong password policy with minimum_length 14, favoring long passphrases.

  • Require mixed character types and block common passwords
  • Enforce password history where appropriate
  • Pair with MFA and adaptive risk controls for defense in depth

Remediation

CLI

aws cognito-idp update-user-pool --user-pool-id <example_resource_id> --policies "PasswordPolicy={MinimumLength=14}"

Terraform

resource "aws_cognito_user_pool" "<example_resource_name>" {
  name = "<example_resource_name>"

  password_policy {
    minimum_length = 14  # Critical: enforce min length >=14 to pass the check
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      Policies:
        PasswordPolicy:
          MinimumLength: 14  # Critical: sets minimum password length to >=14 to pass the check

Other

1Open the Amazon Cognito console and go to User pools
2Select your user pool
3Go to Authentication (or Authentication methods) > Password policy
4Set Minimum password length to 14
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cognito.cognito_idp_client import cognito_idp_client


class cognito_user_pool_password_policy_minimum_length_14(Check):
    def execute(self):
        findings = []
        for pool in cognito_idp_client.user_pools.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=pool)
            if pool.password_policy:
                if pool.password_policy.minimum_length >= 14:
                    report.status = "PASS"
                    report.status_extended = f"User pool {pool.name} has a password policy with a minimum length of 14 characters."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"User pool {pool.name} does not have a password policy with a minimum length of 14 characters."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"User pool {pool.name} has not a password policy set."
                )
            findings.append(report)

        return findings

References