Back to Checks
aws

IAM password policy requires at least one uppercase letter

iam_password_policy_uppercase
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamPolicy

IAM account password policy enforces the presence of at least one uppercase letter (A-Z) in IAM user passwords.

This evaluates whether the uppercase complexity rule is enabled for console passwords.

Prowler logoProwlerprowler-provider-aws

Risk

Without an uppercase requirement, passwords have lower entropy, enabling brute force, credential stuffing, and offline cracking. Compromised IAM users can access the console, threatening confidentiality (data exposure), integrity (unauthorized changes), and availability (resource deletion).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_password_policy_uppercase

Recommendation

Enable the uppercase rule within a strong password policy that also requires length, lowercase, numbers, and symbols. Pair with MFA and least privilege to reduce blast radius. Regularly review policy effectiveness and prefer federated SSO to minimize long-lived IAM passwords.

Remediation

CLI

aws iam update-account-password-policy --require-uppercase-characters

Terraform

resource "aws_iam_account_password_policy" "<example_resource_name>" {
  require_uppercase_characters = true  # Critical: enforce at least one uppercase letter
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::IAM::AccountPasswordPolicy
    Properties:
      RequireUppercaseCharacters: true  # Critical: enforce at least one uppercase letter

Other

1In the AWS Console, go to IAM
2Open Account settings > Password policy > Edit
3Check "Require at least one uppercase letter (A-Z)"
4Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_password_policy_uppercase(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        if iam_client.password_policy:
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=iam_client.password_policy
            )
            report.region = iam_client.region
            report.resource_arn = iam_client.password_policy_arn_template
            report.resource_id = iam_client.audited_account
            # Check if uppercase flag is set
            if iam_client.password_policy.uppercase:
                report.status = "PASS"
                report.status_extended = (
                    "IAM password policy requires at least one uppercase letter."
                )
            else:
                report.status = "FAIL"
                report.status_extended = "IAM password policy does not require at least one uppercase letter."
            findings.append(report)
        return findings

References