IAM password policy requires at least one number

Check ID: iam_password_policy_number
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: AwsIamPolicy

What this check verifies

IAM account password policy requires at least one numeric character (0-9) in IAM user passwords

Risk

Passwords without numbers have lower entropy, making brute-force and credential-stuffing more effective. A compromised IAM user can gain console access, enabling data exposure (confidentiality), configuration changes (integrity), and resource abuse or deletion (availability).

Recommendation

Enforce the password policy option to require at least one number. Combine with strong length, mixed case, and symbols, and prevent reuse. Enable MFA for all users and prefer federated access to limit static credentials, supporting defense in depth against guessing attacks.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam update-account-password-policy —require-numbers

# Enforce at least one number in IAM user passwords
resource "aws_iam_account_password_policy" "<example_resource_name>" {
  require_numbers = true  # Critical: requires at least one number in passwords
}

# CloudFormation: Enforce at least one number in IAM user passwords
Resources:
  <example_resource_name>:
    Type: AWS::IAM::AccountPasswordPolicy
    Properties:
      RequireNumbers: true  # Critical: requires at least one number in passwords

References

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_password_policy_number. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

IAM password policy requires 14 or more characters IAM password policy prevents reuse of the last 24 passwords

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires