IAM password policy requires at least one uppercase letter

Check ID: iam_password_policy_uppercase
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: AwsIamPolicy

What this check verifies

IAM account password policy enforces the presence of at least one uppercase letter (A-Z) in IAM user passwords. This evaluates whether the uppercase complexity rule is enabled for console passwords.

Risk

Without an uppercase requirement, passwords have lower entropy, enabling brute force, credential stuffing, and offline cracking. Compromised IAM users can access the console, threatening confidentiality (data exposure), integrity (unauthorized changes), and availability (resource deletion).

Recommendation

Enable the uppercase rule within a strong password policy that also requires length, lowercase, numbers, and symbols. Pair with MFA and least privilege to reduce blast radius. Regularly review policy effectiveness and prefer federated SSO to minimize long-lived IAM passwords.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam update-account-password-policy —require-uppercase-characters

resource "aws_iam_account_password_policy" "<example_resource_name>" {
  require_uppercase_characters = true  # Critical: enforce at least one uppercase letter
}

Resources:
  <example_resource_name>:
    Type: AWS::IAM::AccountPasswordPolicy
    Properties:
      RequireUppercaseCharacters: true  # Critical: enforce at least one uppercase letter

References

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_password_policy_uppercase. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

IAM password policy requires at least one symbol Customer-managed IAM policy allows no privilege escalation

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires