Cognito password policy requires 14 or more characters

Check ID: cognito_user_pool_password_policy_minimum_length_14
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

Amazon Cognito user pools should have a password policy requiring a minimum length of 14. This evaluation detects pools without a policy or with minimum_length below 14.

Risk

Low or missing password minimums enable weak credentials, increasing successful brute force, password spraying, and credential stuffing against sign-in endpoints. Resulting account takeover threatens confidentiality (data exposure) and integrity/availability (unauthorized changes and abuse).

Recommendation

Adopt a strong password policy with minimum_length 14, favoring long passphrases.

Require mixed character types and block common passwords
Enforce password history where appropriate
Pair with MFA and adaptive risk controls for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cognito-idp update-user-pool --user-pool-id <example_resource_id> --policies "PasswordPolicy={MinimumLength=14}"

resource "aws_cognito_user_pool" "<example_resource_name>" {
  name = "<example_resource_name>"

  password_policy {
    minimum_length = 14  # Critical: enforce min length >=14 to pass the check
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      Policies:
        PasswordPolicy:
          MinimumLength: 14  # Critical: sets minimum password length to >=14 to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_password_policy_minimum_length_14. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Cognito password policy requires one lowercase letter Cognito password policy requires one number

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires