Back to Checks
aws

Cognito user pool password policy requires at least one number

cognito_user_pool_password_policy_number
Service: cognitoSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

Amazon Cognito user pools are evaluated for a password policy that requires at least one number. The assessment checks whether the policy enforces a numeric character via RequireNumbers and also identifies pools with no password policy configured.

Prowler logoProwlerprowler-provider-aws

Risk

Absent a numeric requirement-or any password policy-reduces password entropy, enabling brute force and credential stuffing. Successful account takeover grants valid tokens to protected APIs, risking data confidentiality, unauthorized actions affecting integrity, and resource abuse impacting availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cognito_user_pool_password_policy_number

Recommendation

Enforce a strong password policy: require numbers (RequireNumbers=true), adequate length (e.g., >=8), and mixed case/symbols. Complement with MFA, login throttling/lockout, and password reuse limits for defense in depth. Apply least privilege to applications using tokens and monitor authentication activity.

Remediation

CLI

aws cognito-idp update-user-pool --user-pool-id <USER_POOL_ID> --policies '{"PasswordPolicy":{"RequireNumbers":true}}'

Terraform

# Terraform: Enable number requirement in Cognito password policy
resource "aws_cognito_user_pool" "<example_resource_name>" {
  name = "<example_resource_name>"

  password_policy {
    require_numbers = true  # Critical: enforces at least one numeric character in passwords
  }
}

NativeIaC

# CloudFormation: Set password policy to require at least one number
Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      Policies:
        PasswordPolicy:
          RequireNumbers: true  # Critical: enforces at least one numeric character in passwords

Other

1In the AWS Console, go to Amazon Cognito > User pools
2Select your user pool
3Open Authentication (or Password policy) settings
4Enable Requires at least one number (Require numbers)
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cognito.cognito_idp_client import cognito_idp_client


class cognito_user_pool_password_policy_number(Check):
    def execute(self):
        findings = []
        for pool in cognito_idp_client.user_pools.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=pool)
            if pool.password_policy:
                if pool.password_policy.require_numbers:
                    report.status = "PASS"
                    report.status_extended = f"User pool {pool.name} has a password policy with a number requirement."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"User pool {pool.name} does not have a password policy with a number requirement."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"User pool {pool.name} has not a password policy set."
                )
            findings.append(report)

        return findings

References