A security engineer discovers that a company's user passwords have no required minimum length.

Action for Amazon Cognito User Pools:

Update the password policy in the Cognito user pool configuration.

Set the required minimum password length and other password complexity settings as needed.

Navigate toAmazon Cognito>User Pools>Policies, and configure the password requirements.

Action for On-Premises Active Directory:

Update the password policy in the on-premises Active Directory.

Use Group Policy Management to configure the minimum password length.

Apply the updated policy to all relevant organizational units (OUs).

IAM Password Policy:

Note that IAM does not manage Active Directory or Cognito password policies. Instead, focus on federated configurations and user pool settings.

Amazon Cognito User Pool Policies

Active Directory Password Policy