Description

Detects if AWS IAM password policies are configured without requiring lowercase characters in passwords, which weakens password security. A password policy that doesn't require lowercase characters reduces password complexity and makes passwords more vulnerable to brute force attacks.

Detection Strategy

• Retrieves the AWS account password policy configuration

• Checks if the 'RequireLowercaseCharacters' setting is either false or not set

• Reports a vulnerability if lowercase characters are not required in the password policy