AWS > Iam > Require Lowercase In Passwords
MEDIUM
Source
Trivy/CSPM
CSPM ID
password-requires-lowercase
Frameworks

CIS AWS 1.2

ID
AVD-AWS-0058

IAM Password policy should have requirement for at least one lowercase character.

IAM account password policies should ensure that passwords content including at least one lowercase character.

Impact

Short, simple passwords are easier to compromise

Follow the appropriate remediation steps below to resolve the issue.

  1. Log into the AWS Management Console.
  2. Select the “Services” option and search for IAM. Step
  3. Scroll down the left navigation panel and choose “Account Settings”. Step
  4. Under the “Password Policy” configuration panel scroll down and check the “Require at least one lowercase letter”. If the checkbox is not selected than the password policy does not requires at least one lowercase letter.Step
  5. Repeat steps number 3 and 4 to ensures password policy requires at least one lowercase letter.
  6. Click on the checkbox next to “Require at least one lowercase letter” so “Password Policy” requires at least one lowercase letter to make the password more strong and secure. Step
  7. Click on the “Apply Password Policy” button to make the necessary changes.Step

Enforce longer, more complex passwords in the policy

1
2
3
4
5
resource "aws_iam_account_password_policy" "good_example" {
  # ...
  require_lowercase_characters = true
  # ...
}