Check provider logo

IAM password policy requires at least one symbol

iam_password_policy_symbol

Severitymedium
Serviceiam
by Prowler
identity-access

IAM account password policy includes the Require at least one non-alphanumeric character rule for IAM user passwords

Risk

Missing a symbol requirement lowers password entropy, increasing success of brute force and credential stuffing against console logins. A compromised IAM user can gain unauthorized access and modify resources, threatening confidentiality and integrity across the account.

Run this check with Prowler CLI

prowler aws --checks iam_password_policy_symbol

Run in Prowler Cloud
Fix finding with Prowler CLI

prowler aws --checks iam_password_policy_symbol --fixer

Recommendation

Enforce the Require at least one non-alphanumeric character rule in the IAM password policy, alongside strong minimum length, mixed character sets, and password reuse prevention. Apply MFA for all human users and uphold least privilege to limit impact. Consider periodic rotation based on risk.

Remediation

CLI

aws iam update-account-password-policy --require-symbols

Native IaC
Terraform
Other
  1. In the AWS console, open IAM
  2. Go to Account settings
  3. Click Edit in the Password policy section
  4. Check "Require at least one non-alphanumeric character (symbol)"
  5. Click Save changes

Source Code

Resource Type

AwsIamPolicy

References