Back to Checks
aws

Cognito user pool password policy requires at least one uppercase letter

cognito_user_pool_password_policy_uppercase
Service: cognitoSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

Amazon Cognito user pool password policy is evaluated for an uppercase character requirement (require_uppercase). The check also identifies user pools that have no password policy configured.

Prowler logoProwlerprowler-provider-aws

Risk

Missing an uppercase requirement lowers password entropy, easing password spraying, brute force, and offline cracking. Account takeover risks user data (confidentiality), enables unauthorized changes (integrity), and may disrupt services through abuse or lockouts (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cognito_user_pool_password_policy_uppercase

Recommendation

Enforce a strong password policy requiring uppercase characters, sufficient minimum_length, and diverse character sets. Layer defenses: MFA, rate limiting/lockout, and password reuse history. Where feasible, prefer long passphrases and monitor authentication events to prevent account takeover.

Remediation

CLI

aws cognito-idp update-user-pool --user-pool-id <USER_POOL_ID> --policies PasswordPolicy={RequireUppercase=true}

Terraform

# Require uppercase in Cognito User Pool password policy
resource "aws_cognito_user_pool" "<example_resource_name>" {
  name = "<example_resource_name>"

  password_policy {
    require_uppercase = true  # Critical: enforce at least one uppercase letter
  }
}

NativeIaC

# CloudFormation to require uppercase in Cognito User Pool password policy
Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      Policies:
        PasswordPolicy:
          RequireUppercase: true  # Critical: enforce at least one uppercase letter

Other

1Open the Amazon Cognito console and go to User pools
2Select your user pool
3Go to Authentication methods (or Sign-in experience) > Password policy
4Check Requires at least one uppercase letter
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cognito.cognito_idp_client import cognito_idp_client


class cognito_user_pool_password_policy_uppercase(Check):
    def execute(self):
        findings = []
        for pool in cognito_idp_client.user_pools.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=pool)
            if pool.password_policy:
                if pool.password_policy.require_uppercase:
                    report.status = "PASS"
                    report.status_extended = f"User pool {pool.name} has a password policy with an uppercase requirement."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"User pool {pool.name} does not have a password policy with an uppercase requirement."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"User pool {pool.name} has not a password policy set."
                )
            findings.append(report)

        return findings

References