# Ensure IAM password policy requires at least one uppercase letter

- Source: https://support.icompaas.com/support/solutions/articles/62000080729-ensure-iam-password-policy-requires-at-least-one-uppercase-letter
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS Benchmark Level 1](https://support.icompaas.com/support/solutions/62000039484) › [CIS Control 16](https://support.icompaas.com/support/solutions/folders/62000066021)
- Last updated: 2026-06-04
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability: Level 1

Description:

Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure passwords are comprised of different character sets. It is recommended that the password policy requires at least one uppercase letter.

  

Rationale:

At least one symbol in the password and similar conditions such as minimum length, whether it requires nonalphabetic characters, and how frequently it must be rotated in users account will make a strong password, one of the best security practices.

  

Impact:

Setting a password complexity policy increases account resiliency against brute force login attempts.

  

Default Value:

By default, AWS will have only a few password policy and if you want to make custom policies you can follow the remediation steps.

  

Remediation:

Test Plan:

1.  Login to AWS Console 
    
2.  Go to IAM Service on the AWS Console [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/)
    
3.  Click on Account Settings on the Left Pane
    

4.  Check the list of policies shown under the Password policy section to know whether the particular policy is enabled or not
    

  

Using AWS CLI:

To view the password policy

aws iam get-account-password-policy

  

Pre-requisites:

-   Login to AWS console with Administrator access
    
-   After auditing, if the found uppercase letter condition is not enabled then only perform the below steps.
    

Implementation steps:

Perform the following to set the password policy as prescribed:

1.  Login to AWS Console 
    
2.  Go to IAM Service on the AWS Console [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/)
    
3.  Click on Account Settings on the Left Pane  
      
     
    
4.  Click on edit button in the password policy section  
    
5.   Go to Custom , Check the Require at least one uppercase letter from Latin alphabet (A-Z) check box and click on save changes.  
    

  

Using AWS CLI:

To create or change the custom password policy

aws iam update-account-password-policy --require-uppercase-characters

  

Backout plan:

1.  Login to AWS Console 
    
2.  Go to IAM Service on the AWS Console [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/)
    
3.  Click on Account Settings on the Left Pane
    

4.  If you want to delete or change the custom policies, go to edit in Password Policy section and unmark the checkboxes  in Custom Policy then save changes.
    

  

Using AWS CLI:

To delete the custom password policy

aws iam delete-account-password-policy

  

References:

-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_credentials\_passwords\_account-policy.html#IAMPasswordPolicy](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#IAMPasswordPolicy)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.