Cognito password policy requires one symbol

Check ID: cognito_user_pool_password_policy_symbol
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

Amazon Cognito user pool password policy includes a symbol requirement for user passwords. Assesses the presence of a policy and whether require_symbols is configured.

Risk

Absent a symbol requirement, passwords have lower entropy, increasing success of brute force and credential stuffing. Compromised accounts enable unauthorized token issuance, data access, and profile changes, impacting confidentiality and integrity across apps relying on the pool.

Recommendation

Enforce a strong password complexity policy with require_symbols=true, adequate length, and mixed character sets. Combine with MFA, throttling or lockout, and credential hygiene to reduce takeover risk. Apply defense in depth and least privilege to limit blast radius if an account is compromised.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cognito-idp update-user-pool --user-pool-id <example_resource_id> --policies "PasswordPolicy={RequireSymbols=true}"

# Terraform: ensure Cognito User Pool requires at least one symbol in passwords
resource "aws_cognito_user_pool" "<example_resource_name>" {
  name = "<example_resource_name>"

  password_policy {
    require_symbols = true  # Critical: enforce at least one symbol to pass the check
  }
}

# CloudFormation: ensure Cognito User Pool requires at least one symbol in passwords
Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      Policies:
        PasswordPolicy:
          RequireSymbols: true  # Critical: enforce at least one symbol to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_password_policy_symbol. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Cognito password policy requires one number Cognito password policy requires one uppercase letter

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires