question: Is there a Rule ID fo aws-iam-set-max-password-age

[peraltadavidtrvlx]

Is there any rule for aws-iam-set-max-password-age that can be added to tfsec exclusions? Reason is that, this is failing from our validations even though we already have the parameter added

resource "aws_iam_account_password_policy" "name_here" {
...
max_password_age               = var.max_password_age
...
}

The value is being passed using an ansible role so there's no default value for this on variables.tf

[owenrumney]

Hey @peraltadavidtrvlx - tfsec can only work with the information it has. If it doesn't have a default or the tfvars file with the used values it can only deduce there is no value.

You have a number of tfsec based options

1. Add an ignore on the line, so

resource "aws_iam_account_password_policy" "name_here" {
...
max_password_age  = var.max_password_age #tfsec:ignore:aws-iam-set-max-password-age
...
}

2. Add the exclusion to the config file
   https://aquasecurity.github.io/tfsec/v1.0.8/getting-started/configuration/config/

[peraltadavidtrvlx]

Hi, we're leaning towards option number 2 but there's no rule ID for aws-iam-set-max-password-age basing here - https://github.com/aquasecurity/tfsec/blob/master/internal/pkg/legacy/map.go

[owenrumney]

the rule id is aws-iam-set-max-password-age. the link you've pointed to is just a map to convert old style IDs to the new ones

[peraltadavidtrvlx]

oh okay. so should we use that now instead of AWS** IDs?

[liamg]

👍 That's right - we switched the ID format so they're a bit easier to interpret at a glance, without needing to look up the meaning of AWS-*. The legacy ones still work in ignores, but we'll remove them eventually.

[peraltadavidtrvlx]

Awesome. Thank you