IAM password policy requires at least one lowercase letter

Check ID: iam_password_policy_lowercase
Provider: AWS
Service: iam
Severity: LOW
Categories: identity-access
Resource type: AwsIamPolicy

What this check verifies

IAM password policy requires at least one lowercase character in user passwords via the Require lowercase setting

Risk

Without a lowercase requirement, passwords have reduced entropy, making brute force and password spraying more effective. Compromised IAM users can enable unauthorized access and changes, risking confidentiality, integrity, and availability of AWS resources.

Recommendation

Adopt a strong password policy that:

Enables Require at least one lowercase letter plus uppercase, number, and symbol
Sets sufficient length and blocks reuse
Requires MFA for all users
Applies least privilege to limit blast radius

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam update-account-password-policy —require-lowercase-characters

resource "aws_iam_account_password_policy" "<example_resource_name>" {
  require_lowercase_characters = true  # Critical: Enforces at least one lowercase letter in passwords
}

Resources:
  <example_resource_name>:
    Type: AWS::IAM::AccountPasswordPolicy
    Properties:
      RequireLowercaseCharacters: true  # Critical: Enforces at least one lowercase letter in passwords

References

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_password_policy_lowercase. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

IAM password policy expires passwords within 90 days IAM password policy requires 14 or more characters

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires