Cognito password policy requires one number

Check ID: cognito_user_pool_password_policy_number
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

Amazon Cognito user pools are evaluated for a password policy that requires at least one number. The assessment checks whether the policy enforces a numeric character via RequireNumbers and also identifies pools with no password policy configured.

Risk

Absent a numeric requirement-or any password policy-reduces password entropy, enabling brute force and credential stuffing. Successful account takeover grants valid tokens to protected APIs, risking data confidentiality, unauthorized actions affecting integrity, and resource abuse impacting availability.

Recommendation

Enforce a strong password policy: require numbers (RequireNumbers=true), adequate length (e.g., >=8), and mixed case/symbols. Complement with MFA, login throttling/lockout, and password reuse limits for defense in depth. Apply least privilege to applications using tokens and monitor authentication activity.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cognito-idp update-user-pool --user-pool-id <USER_POOL_ID> --policies '{"PasswordPolicy":{"RequireNumbers":true}}'

# Terraform: Enable number requirement in Cognito password policy
resource "aws_cognito_user_pool" "<example_resource_name>" {
  name = "<example_resource_name>"

  password_policy {
    require_numbers = true  # Critical: enforces at least one numeric character in passwords
  }
}

# CloudFormation: Set password policy to require at least one number
Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      Policies:
        PasswordPolicy:
          RequireNumbers: true  # Critical: enforces at least one numeric character in passwords

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_password_policy_number. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Cognito password policy requires 14 or more characters Cognito password policy requires one symbol

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires