Check provider logo

IAM password policy requires at least one number

iam_password_policy_number

Severitymedium
Serviceiam
by Prowler
identity-access

IAM account password policy requires at least one numeric character (0-9) in IAM user passwords

Risk

Passwords without numbers have lower entropy, making brute-force and credential-stuffing more effective. A compromised IAM user can gain console access, enabling data exposure (confidentiality), configuration changes (integrity), and resource abuse or deletion (availability).

Run this check with Prowler CLI

prowler aws --checks iam_password_policy_number

Run in Prowler Cloud
Fix finding with Prowler CLI

prowler aws --checks iam_password_policy_number --fixer

Recommendation

Enforce the password policy option to require at least one number. Combine with strong length, mixed case, and symbols, and prevent reuse. Enable MFA for all users and prefer federated access to limit static credentials, supporting defense in depth against guessing attacks.

Remediation

CLI

aws iam update-account-password-policy --require-numbers

Native IaC
Terraform
Other
  1. Open the AWS Management Console and go to IAM
  2. In the left menu, click Account settings
  3. In Password policy, click Edit
  4. Check Require at least one number
  5. Click Save changes and confirm Set custom

Source Code

Resource Type

AwsIamPolicy

References