# Ensure IAM password policy requires at least one lowercase letter

- Source: https://support.icompaas.com/support/solutions/articles/a_17932922126439-ensure-iam-password-policy-requires-at-least-one-lowercase-letter
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that the AWS account's IAM password policy requires IAM user passwords to contain at least one lowercase letter (a-z). The password policy applies to all IAM users who sign in to the AWS Management Console with a password.

**Rationale**

Passwords without lowercase letters have fewer possible combinations, which makes brute-force and password spraying attacks more effective. A compromised IAM user password gives an attacker console access to the account, allowing unauthorized changes, data exposure and deletion of resources. Requiring at least one lowercase letter, together with a strong minimum length, uppercase letters, numbers, symbols, password reuse prevention and MFA, makes passwords harder to guess.

**Impact**

-   Strengthens IAM user passwords against brute-force and password-guessing attacks
    
-   Existing passwords are not changed immediately; the new rule applies the next time each user creates or changes their password
    
-   Users must include a lowercase letter in new passwords, which may require communicating the change to them in advance
    

**Default Value**

No custom password policy is set by default. Without a custom policy, AWS applies its default rules, which do not require a lowercase letter.

**Pre-Requisites**

-   IAM permissions: iam:GetAccountPasswordPolicy and iam:UpdateAccountPasswordPolicy
    
-   Agreement on the other password policy settings to keep (for example, minimum length, character types, password reuse and expiration), because updating the policy replaces all of its settings
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the IAM console and select **Account settings** in the left menu.
    
3.  In the **Password policy** section, check whether **Require at least one lowercase letter from the Latin alphabet (a-z)** is enabled.
    
4.  If no custom password policy is set, or the lowercase requirement is not enabled, follow the implementation steps.
    

**CLI:**

Show the current password policy:

aws iam get-account-password-policy

The account fails if RequireLowercaseCharacters is false, or if the command returns a NoSuchEntity error (no custom policy is set, so lowercase letters are not required).

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the IAM console and select **Account settings** in the left menu.
    
3.  In the **Password policy** section, choose **Edit**.
    
4.  Select **Custom** (if the default policy is in use).
    
5.  Select **Require at least one lowercase letter from the Latin alphabet (a-z)**.
    
6.  Leave the other password settings as they are, unless they also need to be changed.
    
7.  Choose **Save changes**.
    

**CLI:**

Require at least one lowercase letter in passwords:

aws iam update-account-password-policy --require-lowercase-characters

This command replaces the whole password policy, and any setting not included reverts to its default. To keep the existing settings, add the matching options from the Test Plan output, for example:

aws iam update-account-password-policy --require-lowercase-characters --minimum-password-length 14 --require-uppercase-characters --require-numbers --require-symbols --allow-users-to-change-password --password-reuse-prevention 24 --max-password-age 90

**Backout Plan**

Before making changes, save the current password policy:

aws iam get-account-password-policy > password-policy-backup.json

To roll back:

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the IAM console and select **Account settings** in the left menu.
    
3.  In the **Password policy** section, choose **Edit**.
    
4.  Clear **Require at least one lowercase letter from the Latin alphabet (a-z)** and set the other settings back to the values in the saved backup. If no custom policy existed before, select **IAM default** instead.
    
5.  Choose **Save changes**.
    

Note: rolling back allows weaker passwords without lowercase letters again. Use it only as a temporary measure.

**Reference**

-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_credentials\_passwords\_account-policy.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/iam/update-account-password-policy.html](https://docs.aws.amazon.com/cli/latest/reference/iam/update-account-password-policy.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/iam/get-account-password-policy.html](https://docs.aws.amazon.com/cli/latest/reference/iam/get-account-password-policy.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.