Back to Checks
aws

Cognito user pool password policy requires at least one symbol

cognito_user_pool_password_policy_symbol
Service: cognitoSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

Amazon Cognito user pool password policy includes a symbol requirement for user passwords.

Assesses the presence of a policy and whether require_symbols is configured.

Prowler logoProwlerprowler-provider-aws

Risk

Absent a symbol requirement, passwords have lower entropy, increasing success of brute force and credential stuffing.

Compromised accounts enable unauthorized token issuance, data access, and profile changes, impacting confidentiality and integrity across apps relying on the pool.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cognito_user_pool_password_policy_symbol

Recommendation

Enforce a strong password complexity policy with require_symbols=true, adequate length, and mixed character sets. Combine with MFA, throttling or lockout, and credential hygiene to reduce takeover risk. Apply defense in depth and least privilege to limit blast radius if an account is compromised.

Remediation

CLI

aws cognito-idp update-user-pool --user-pool-id <example_resource_id> --policies "PasswordPolicy={RequireSymbols=true}"

Terraform

# Terraform: ensure Cognito User Pool requires at least one symbol in passwords
resource "aws_cognito_user_pool" "<example_resource_name>" {
  name = "<example_resource_name>"

  password_policy {
    require_symbols = true  # Critical: enforce at least one symbol to pass the check
  }
}

NativeIaC

# CloudFormation: ensure Cognito User Pool requires at least one symbol in passwords
Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      Policies:
        PasswordPolicy:
          RequireSymbols: true  # Critical: enforce at least one symbol to pass the check

Other

1Open the Amazon Cognito console and go to User pools
2Select the target user pool
3Go to Authentication (or Sign-in experience) > Password policy
4Enable Require special characters (Require symbols)
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cognito.cognito_idp_client import cognito_idp_client


class cognito_user_pool_password_policy_symbol(Check):
    def execute(self):
        findings = []
        for pool in cognito_idp_client.user_pools.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=pool)
            if pool.password_policy:
                if pool.password_policy.require_symbols:
                    report.status = "PASS"
                    report.status_extended = f"User pool {pool.name} has a password policy with a symbol requirement."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"User pool {pool.name} does not have a password policy with a symbol requirement."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"User pool {pool.name} has not a password policy set."
                )
            findings.append(report)

        return findings

References