Cognito password policy requires one lowercase letter

Check ID: cognito_user_pool_password_policy_lowercase
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

Amazon Cognito user pools are assessed for a password policy that includes a lowercase character requirement. Pools with require_lowercase set are distinguished from those without a policy, which inherently lack this requirement.

Risk

Absent a lowercase requirement reduces password complexity and the overall keyspace, making brute-force and credential stuffing more feasible. Successful guessing enables account takeover, exposing user data and tokens and permitting profile changes, harming confidentiality and integrity.

Recommendation

Enforce a strong password policy with require_lowercase: true, adequate length, and mixed character types. Complement with defense in depth: enable MFA, apply rate limiting or lockout for failed attempts, and block common passwords. Review regularly to match business risk and user population.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cognito-idp update-user-pool --user-pool-id <example_resource_id> --policies "PasswordPolicy={RequireLowercase=true}"

resource "aws_cognito_user_pool" "pool" {
  name = "<example_resource_name>"

  password_policy {
    require_lowercase = true  # Critical: enforces at least one lowercase character
  }
}

Resources:
  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      Policies:
        PasswordPolicy:
          RequireLowercase: true  # Critical: requires at least one lowercase letter in passwords

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_password_policy_lowercase. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Cognito user pool requires Multi-Factor Authentication (MFA)Cognito password policy requires 14 or more characters

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires