Updating PC-AWS-IAM-9 policy's RQL

[tplisson]

Description

Updating PC-AWS-IAM-9 policy's RQL (AWS IAM Password policy is unsecure)

Motivation and Context

Current RQL is only covering a corner case by using logical AND’s meaning the policy only alerts if all options are not compliant. The proposed RQL uses logical OR’s to cover any deviation from the recommended values.

Also the current RQL only alerts if the minimum password length matches exactly 6. The proposed RQL alerts if the minimum password length is less than 14, in line with build policy CKV_AWS_10 “AWS IAM password policy does not have a minimum of 14 characters”

Finally to avoid false positives, I’ve added a condition to ignore the AWS default password policy (isDefaultPolicy = false) which is not compliant but present in every account.

How Has This Been Tested?

The proposed RQL has been tested in production environment with many different passwords policies.

Screenshots (if appropriate)

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes if appropriate.
• All new and existing tests passed.