Cognito password policy requires one uppercase letter

Check ID: cognito_user_pool_password_policy_uppercase
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

Amazon Cognito user pool password policy is evaluated for an uppercase character requirement (require_uppercase). The check also identifies user pools that have no password policy configured.

Risk

Missing an uppercase requirement lowers password entropy, easing password spraying, brute force, and offline cracking. Account takeover risks user data (confidentiality), enables unauthorized changes (integrity), and may disrupt services through abuse or lockouts (availability).

Recommendation

Enforce a strong password policy requiring uppercase characters, sufficient minimum_length, and diverse character sets. Layer defenses: MFA, rate limiting/lockout, and password reuse history. Where feasible, prefer long passphrases and monitor authentication events to prevent account takeover.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cognito-idp update-user-pool --user-pool-id <USER_POOL_ID> --policies PasswordPolicy={RequireUppercase=true}

# Require uppercase in Cognito User Pool password policy
resource "aws_cognito_user_pool" "<example_resource_name>" {
  name = "<example_resource_name>"

  password_policy {
    require_uppercase = true  # Critical: enforce at least one uppercase letter
  }
}

# CloudFormation to require uppercase in Cognito User Pool password policy
Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      Policies:
        PasswordPolicy:
          RequireUppercase: true  # Critical: enforce at least one uppercase letter

References

https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_password_policy_uppercase. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Cognito password policy requires one symbol Amazon Cognito user pool has self registration disabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires