IAM password policy should require uppercase, lowercase, number, and symbol

What it checks

IAM password policy: complexity requirements are incomplete.

Where it applies

Terraform: aws_iam_account_password_policy

CloudFormation: no CloudFormation type maps to these resources yet.

How to fix it

1. Set require_uppercase_characters, require_lowercase_characters, require_numbers and require_symbols all to true

Frameworks

• AWS FSBP IAM.7
• SOC 2 CC6.1
• SOC 2 CC6.3
• PCI-DSS v4.0.1/8.3.6
• HIPAA 164.312(a)(1)
• HIPAA 164.312(d)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules