Back to Checks
aws

IAM password policy requires at least one symbol

iam_password_policy_symbol
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamPolicy

IAM account password policy includes the Require at least one non-alphanumeric character rule for IAM user passwords

Prowler logoProwlerprowler-provider-aws

Risk

Missing a symbol requirement lowers password entropy, increasing success of brute force and credential stuffing against console logins. A compromised IAM user can gain unauthorized access and modify resources, threatening confidentiality and integrity across the account.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_password_policy_symbol

Recommendation

Enforce the Require at least one non-alphanumeric character rule in the IAM password policy, alongside strong minimum length, mixed character sets, and password reuse prevention. Apply MFA for all human users and uphold least privilege to limit impact. Consider periodic rotation based on risk.

Remediation

CLI

aws iam update-account-password-policy --require-symbols

Terraform

resource "aws_iam_account_password_policy" "<example_resource_name>" {
  require_symbols = true  # Critical: require at least one symbol in passwords
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::IAM::AccountPasswordPolicy
    Properties:
      RequireSymbols: true  # Critical: requires at least one symbol in passwords

Other

1In the AWS console, open IAM
2Go to Account settings
3Click Edit in the Password policy section
4Check "Require at least one non-alphanumeric character (symbol)"
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_password_policy_symbol(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        if iam_client.password_policy:
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=iam_client.password_policy
            )
            report.region = iam_client.region
            report.resource_arn = iam_client.password_policy_arn_template
            report.resource_id = iam_client.audited_account
            # Check if symbol flag is set
            if iam_client.password_policy.symbols:
                report.status = "PASS"
                report.status_extended = (
                    "IAM password policy requires at least one symbol."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    "IAM password policy does not require at least one symbol."
                )
            findings.append(report)
        return findings

References