Back to Checks
aws

IAM password policy requires at least one number

iam_password_policy_number
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamPolicy

IAM account password policy requires at least one numeric character (0-9) in IAM user passwords

Prowler logoProwlerprowler-provider-aws

Risk

Passwords without numbers have lower entropy, making brute-force and credential-stuffing more effective. A compromised IAM user can gain console access, enabling data exposure (confidentiality), configuration changes (integrity), and resource abuse or deletion (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_password_policy_number

Recommendation

Enforce the password policy option to require at least one number. Combine with strong length, mixed case, and symbols, and prevent reuse. Enable MFA for all users and prefer federated access to limit static credentials, supporting defense in depth against guessing attacks.

Remediation

CLI

aws iam update-account-password-policy --require-numbers

Terraform

# Enforce at least one number in IAM user passwords
resource "aws_iam_account_password_policy" "<example_resource_name>" {
  require_numbers = true  # Critical: requires at least one number in passwords
}

NativeIaC

# CloudFormation: Enforce at least one number in IAM user passwords
Resources:
  <example_resource_name>:
    Type: AWS::IAM::AccountPasswordPolicy
    Properties:
      RequireNumbers: true  # Critical: requires at least one number in passwords

Other

1Open the AWS Management Console and go to IAM
2In the left menu, click Account settings
3In Password policy, click Edit
4Check Require at least one number
5Click Save changes and confirm Set custom

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_password_policy_number(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        if iam_client.password_policy:
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=iam_client.password_policy
            )
            report.region = iam_client.region
            report.resource_arn = iam_client.password_policy_arn_template
            report.resource_id = iam_client.audited_account
            # Check if number flag is set
            if iam_client.password_policy.numbers:
                report.status = "PASS"
                report.status_extended = (
                    "IAM password policy requires at least one number."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    "IAM password policy does not require at least one number."
                )
            findings.append(report)
        return findings

References