Cognito password policy is too weak

What it means

The user pool allows passwords shorter than eight characters or does not require mixed character types.

Why it matters

This pool is the front door to every account in the product. A weak policy makes credential stuffing cheap: attackers replay leaked password lists, and short passwords without complexity requirements are exactly what those lists contain.

How to fix it

Set a `passwordPolicy` with `minLength: 12` and require digits, symbols and mixed case. Consider requiring MFA for anything privileged.

See it fail

This stack trips AwsSolutions-COG1 for real. Open it in the playground, press Run, and the finding appears with everything else the engine has to say about it.

Other rules