IAM password policy requires at least one symbol

Check ID: iam_password_policy_symbol
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: AwsIamPolicy

What this check verifies

IAM account password policy includes the Require at least one non-alphanumeric character rule for IAM user passwords

Risk

Missing a symbol requirement lowers password entropy, increasing success of brute force and credential stuffing against console logins. A compromised IAM user can gain unauthorized access and modify resources, threatening confidentiality and integrity across the account.

Recommendation

Enforce the Require at least one non-alphanumeric character rule in the IAM password policy, alongside strong minimum length, mixed character sets, and password reuse prevention. Apply MFA for all human users and uphold least privilege to limit impact. Consider periodic rotation based on risk.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam update-account-password-policy —require-symbols

resource "aws_iam_account_password_policy" "<example_resource_name>" {
  require_symbols = true  # Critical: require at least one symbol in passwords
}

Resources:
  <example_resource_name>:
    Type: AWS::IAM::AccountPasswordPolicy
    Properties:
      RequireSymbols: true  # Critical: requires at least one symbol in passwords

References

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_password_policy_symbol. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

IAM password policy prevents reuse of the last 24 passwords IAM password policy requires at least one uppercase letter

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires