Cognito.3: Cognito password policy is too weak

What does AWS Security Hub Cognito.3 check?

Cognito.3 reads a user pool's PasswordPolicy from DescribeUserPool and fails when the credential-strength settings fall below the recommended baseline: a minimum length of at least 8 characters and the four character-class requirements (uppercase, lowercase, numbers, symbols). The Security Hub defaults it checks against are minLength 8 with requireUppercase, requireLowercase, requireNumbers, and requireSymbols all true.

Why does Cognito.3 matter?

Attackers replay breached-password corpora and run dictionary attacks against any login endpoint they can find. A short minimum with no complexity requirement means a user can set a weak, easily guessed password like password1, and credential-stuffing tooling cracks it in seconds, especially for applications open to the internet. Once an attacker has a session, Cognito's downstream trust hands out STS credentials and identity tokens.

How do I fix Cognito.3?

1. Raise MinimumLength to at least 8 and set RequireUppercase, RequireLowercase, RequireNumbers, and RequireSymbols to true on the pool's PasswordPolicy (via UpdateUserPool or the console).
2. Communicate the change: the policy only applies to the next signup, ForgotPassword, or ChangePassword, not existing passwords.

# Find active credentials idle past 45 days and disable them (review before deleting).
CUTOFF=$(date -u -d '45 days ago' +%Y-%m-%d)
aws iam generate-credential-report >/dev/null
aws iam get-credential-report --query Content --output text | base64 -d \
  | awk -F, -v c="$CUTOFF" 'NR>1 && $9=="true" && $11<c {print $1, $10}'
aws iam update-access-key --user-name old-contractor \
  --access-key-id AKIAIOSFODNN7EXAMPLE --status Inactive

# Apply the CIS-aligned IAM password policy in one idempotent call.
aws iam update-account-password-policy --minimum-password-length 14 \
  --require-uppercase-characters --require-lowercase-characters \
  --require-numbers --require-symbols --password-reuse-prevention 24

# A clear-text key in a build project is compromised: rotate and delete, never just relocate.
aws iam delete-access-key --user-name ci-deploy --access-key-id AKIAIOSFODNN7EXAMPLE