Back to Checks
aws

IAM password policy requires at least one lowercase letter

iam_password_policy_lowercase
Service: iamSeverity: low
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamPolicy

IAM password policy requires at least one lowercase character in user passwords via the Require lowercase setting

Prowler logoProwlerprowler-provider-aws

Risk

Without a lowercase requirement, passwords have reduced entropy, making brute force and password spraying more effective. Compromised IAM users can enable unauthorized access and changes, risking confidentiality, integrity, and availability of AWS resources.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_password_policy_lowercase

Recommendation

Adopt a strong password policy that:

  • Enables Require at least one lowercase letter plus uppercase, number, and symbol
  • Sets sufficient length and blocks reuse
  • Requires MFA for all users
  • Applies least privilege to limit blast radius

Remediation

CLI

aws iam update-account-password-policy --require-lowercase-characters

Terraform

resource "aws_iam_account_password_policy" "<example_resource_name>" {
  require_lowercase_characters = true  # Critical: Enforces at least one lowercase letter in passwords
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::IAM::AccountPasswordPolicy
    Properties:
      RequireLowercaseCharacters: true  # Critical: Enforces at least one lowercase letter in passwords

Other

1In the AWS Console, open IAM
2Go to Account settings
3In Password policy, click Edit
4Check "Require at least one lowercase letter (a-z)"
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_password_policy_lowercase(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        if iam_client.password_policy:
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=iam_client.password_policy
            )
            report.region = iam_client.region
            report.resource_arn = iam_client.password_policy_arn_template
            report.resource_id = iam_client.audited_account
            # Check if lowercase flag is set
            if iam_client.password_policy.lowercase:
                report.status = "PASS"
                report.status_extended = (
                    "IAM password policy requires at least one lowercase letter."
                )
            else:
                report.status = "FAIL"
                report.status_extended = "IAM password policy does not require at least one lowercase letter."
            findings.append(report)
        return findings

References