title: Updating Cognito user pool password policy
body: <p>New security guidelines in the organisation require to change our password policy from 8 characters to 12 (and require uppercase, lowercase and special characters).</p>
  <p>Our users are currently managed in a user pool on AWS Cognito.
  The policy change on first look seems straightforward, since you can do it in the UI.
  But what does this mean for existing users ?</p>
  <ul>
  <li>Will their state change to <code>FORCE_CHANGE_PASSWORD</code> ?</li>
  <li>Will they get automatically get an email to reset their password</li>
  </ul>
  <p>Or will they just be denied access next time they try to login? Or is the policy gonna be applied only for new users ?</p>
  <p>If that is not the case, I suppose this has to be handled by the developer, and change the status of ALL users to <code>FORCE_CHANGE_PASSWORD</code> via script. Since passwords are hashed, there's no way to tell which current users already have passwords which comply even to the new policy.</p>