turbot / steampipe-mod-aws-compliance

Run individual controls or full compliance benchmarks for CIS, PCI, NIST, HIPAA and more across all of your AWS accounts using Powerpipe and Steampipe.

AWS Compliance Mod for Powerpipe

Important

Powerpipe is now the preferred way to run this mod! Migrating from Steampipe →

All v0.x versions of this mod will work in both Steampipe and Powerpipe, but v1.0.0 onwards will be in Powerpipe format only.

540+ checks covering industry defined security best practices across all AWS regions. Includes full support for multiple best practice benchmarks including the latest (v3.0.0) CIS benchmark, PCI DSS, AWS Foundational Security, CISA Cyber Essentials, FedRAMP, FFIEC, GxP 21 CFR Part 11, GxP EU Annex 11, HIPAA Final Omnibus Security Rule 2013, HIPAA Security Rule 2003, NIST 800-53, NIST CSF, Reserve Bank of India, Audit Manager Control Tower, and more!

Run checks in a dashboard:

Or in a terminal:

Documentation

• Benchmarks and controls →
• Named queries →

Getting Started

Installation

Install Powerpipe (https://powerpipe.io/downloads), or use Brew:

brew install turbot/tap/powerpipe

This mod also requires Steampipe with the AWS plugin as the data source. Install Steampipe (https://steampipe.io/downloads), or use Brew:

brew install turbot/tap/steampipe
steampipe plugin install aws

Steampipe will automatically use your default AWS credentials. Optionally, you can setup multiple accounts or customize AWS credentials.

Finally, install the mod:

mkdir dashboards
cd dashboards
powerpipe mod init
powerpipe mod install github.com/turbot/steampipe-mod-aws-compliance

Browsing Dashboards

Start Steampipe as the data source:

steampipe service start

Start the dashboard server:

powerpipe server

Browse and view your dashboards at http://localhost:9033.

Running Checks in Your Terminal

Instead of running benchmarks in a dashboard, you can also run them within your terminal with the powerpipe benchmark command:

List available benchmarks:

powerpipe benchmark list

Run a benchmark:

powerpipe benchmark run aws_compliance.benchmark.cis_v300

Different output formats are also available, for more information please see Output Formats.

Common and Tag Dimensions

The benchmark queries use common properties (like account_id, connection_name and region) and tags that are defined in the form of a default list of strings in the variables.sp file. These properties can be overwritten in several ways:

It's easiest to setup your vars file, starting with the sample:

cp steampipe.spvars.example steampipe.spvars
vi steampipe.spvars

Alternatively you can pass variables on the command line:

powerpipe benchmark run aws_compliance.benchmark.cis_v300 --var 'tag_dimensions=["Environment", "Owner"]'

Or through environment variables:

export PP_VAR_common_dimensions='["account_id", "connection_name", "region"]'
export PP_VAR_tag_dimensions='["Environment", "Owner"]'
powerpipe benchmark run aws_compliance.benchmark.cis_v300

Open Source & Contributing

This repository is published under the Apache 2.0 license. Please see our code of conduct. We look forward to collaborating with you!

Steampipe and Powerpipe are products produced from this open source software, exclusively by Turbot HQ, Inc. They are distributed under our commercial terms. Others are allowed to make their own distribution of the software, but cannot use any of the Turbot trademarks, cloud services, etc. You can learn more in our Open Source FAQ.

Get Involved

Join #powerpipe on Slack →

Want to help but don't know where to start? Pick up one of the help wanted issues:

• Powerpipe
• AWS Compliance Mod

steampipe-mod-aws-compliance's Issues

Query config_enabled_all_regions should check all regions even if connections don't include all regions

Describe the bug
This query will not properly report if a configuration recorder is enabled in a region, as it will always report alarm even if a configuration recorder is setup correctly in that region, if the region is not included in the aws.spc connection file.

Steampipe version (steampipe -v)
v0.5.0

Plugin version (steampipe plugin list)
aws v0.18.0

To reproduce

• Create a configuration recorder in us-west-1 and configure it so:

  recording_group -> 'IncludeGlobalResourceTypes' = 'true'
  and recording_group -> 'AllSupported' = 'true'
  and status ->> 'Recording' = 'true'
  and status ->> 'LastStatus' = 'SUCCESS'
  

• Do not include us-west-1 in the regions argument in aws.spc
• Run the query

Expected behavior
The query should return ok instead of alarm

Additional context
Add any other context about the problem here.

Add AWS Foundational Security Best Practices DMS benchmark

Is your feature request related to a problem? Please describe.
I'd like to be able to run the DMS benchmark for the AWS Foundational Security Best Practices framework.

Describe the solution you'd like
Implement the benchmark, starting with DMS controls.

Describe alternatives you've considered
N/A

Additional context
Add any other context or screenshots about the feature request here.

Add PCI v3.2.1 SSM benchmark and controls

Is your feature request related to a problem? Please describe.
https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html#pcidss-ssm-1

Describe the solution you'd like
Add the Config benchmark and related controls

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add initial AWS Foundational Security Best Practices benchmark with ACM benchmark

Is your feature request related to a problem? Please describe.
I'd like to be able to run a benchmark for the AWS Foundational Security Best Practices framework.

Describe the solution you'd like
Implement the benchmark, starting with ACM controls.

Describe alternatives you've considered
N/A

Additional context
Add any other context or screenshots about the feature request here.

Add AWS Foundational Security Best Practices S3 benchmark

Is your feature request related to a problem? Please describe.
I'd like to be able to run theS3 benchmark for the AWS Foundational Security Best Practices framework.

Describe the solution you'd like
Implement S3 benchmark..

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add AWS Foundational Security Best Practices SNS benchmark

Is your feature request related to a problem? Please describe.
I'd like to be able to run the SNS benchmark for the AWS Foundational Security Best Practices framework.

Describe the solution you'd like
Implement the benchmark, starting with SNS controls.

Describe alternatives you've considered
N/A

Additional context
Add any other context or screenshots about the feature request here.

Add AWS Security Hub PCI v3.2.1 cloudtrail.3 & 4 docs

Is your feature request related to a problem? Please describe.
PCI v3.2.1 cloudtrail.3 & cloudtrail.4 benchmark and controls should have supporting documents.

Describe the solution you'd like
Add documents for PCI v3.2.1 cloudtrail.3 & cloudtrail.4 benchmark and controls.

Describe alternatives you've considered
N/A

Additional context
Add any other context or screenshots about the feature request here.

Add AWS Foundational Security Best Practices IAM docs.

Is your feature request related to a problem? Please describe.
Aws foundational security best practices benchmarks and controls should have supporting documents for IAM section.

Describe the solution you'd like
Add documents for aws foundational security best practices IAM benchmark and controls section.

Describe alternatives you've considered
N/A

Additional context
N/A

Add AWS Foundational Security Best Practices DynamoDB benchmark

Is your feature request related to a problem? Please describe.
I'd like to be able to run the DynamoDB benchmark for the AWS Foundational Security Best Practices framework.

Describe the solution you'd like
Implement DynamoDB benchmark.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add PCI v3.2.1 GuardDuty benchmark and controls

Is your feature request related to a problem? Please describe.
We're currently missing the GuardDuty control from https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html#pcidss-guardduty-1

Describe the solution you'd like
Add the GuardDuty benchmark and related controls.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Update README image links

Update README image links

Add AWS Foundational Security Best Practices ES docs.

Is your feature request related to a problem? Please describe.
Aws foundational security best practices benchmarks and controls should have supporting documents for ElasticSearch.

Describe the solution you'd like
Add documents for aws foundational security best practices es.1,es.2 & es.3 benchmark and controls.

Describe alternatives you've considered
N/A

Additional context
Add any other context or screenshots about the feature request here.

Add AWS Foundational Security Best Practices SecretsManager benchmark

Is your feature request related to a problem? Please describe.
I'd like to be able to run the SecretsManager benchmark for the AWS Foundational Security Best Practices framework.

Describe the solution you'd like
Implement SecretsManager benchmark.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add AWS Foundational Security Best Practices Lambda benchmark

Is your feature request related to a problem? Please describe.
I'd like to be able to run the Lambda benchmark for the AWS Foundational Security Best Practices framework.

Describe the solution you'd like
Implement Lambda benchmark.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add PCI v3.2.1 Config benchmark and controls

Is your feature request related to a problem? Please describe.
https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html#pcidss-config-1

Describe the solution you'd like
Add the Config benchmark and related controls

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add AWS Foundational Security Best Practices EC2 benchmark

Is your feature request related to a problem? Please describe.
I'd like to be able to run the EC2 benchmark for the AWS Foundational Security Best Practices framework.

Describe the solution you'd like
Implement EC2 benchmark.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add PCI v3.2.1 S3.3 control

Is your feature request related to a problem? Please describe.
we're currently missing the S3.3 control from https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html#pcidss-s3-3

Describe the solution you'd like
Add the S3.3 control

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add PCI v3.2.1 CW benchmark and controls

Is your feature request related to a problem? Please describe.
We're currently missing the CW control from https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html#pcidss-cw-1

Describe the solution you'd like
Add the CW benchmark and related controls

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add `arn` column in `aws_api_gateway_stage` table

Is your feature request related to a problem? Please describe.
Add arn for REST API stages

Describe the solution you'd like

Describe alternatives you've considered

Additional context
N/A

Add AWS Foundational Security Best Practices S3 docs.

Is your feature request related to a problem? Please describe.
Aws foundational security best practices benchmarks and controls should have supporting documents for S3 section.

Describe the solution you'd like
Add documents for aws foundational security best practices S3 benchmark and controls section.

Describe alternatives you've considered
N/A

Additional context
N/A

Add AWS > PCI > Autoscaling, CodeBuild & Config docs.

Is your feature request related to a problem? Please describe.
N/A

Describe the solution you'd like
N/A

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

v0.3

Getting error `'List' call requires an '=' qual for column: service_namespace` from table `aws_appautoscaling_target`

Describe the bug

select * from aws_appautoscaling_target;
Error: 'List' call requires an '=' qual for column: service_namespace

Steampipe version (steampipe -v)
Example: v0.5.0

Plugin version (steampipe plugin list)
AWS: v0.18.0

To reproduce

Expected behavior
No errors

Additional context
N/A

Add PCI v3.2.1 ELBV2 benchmark and controls

Is your feature request related to a problem? Please describe.
We're currently missing the ELBV2 control from https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html#pcidss-elbv2-1

Describe the solution you'd like
Add the ELBV2 benchmark and related controls

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Update autoscaling_group_with_lb_use_healthcheck

Describe the bug
Update autoscaling_group_with_lb_use_healthcheck to check only autoscaling groups that are associated with load balancer. (PCI.AutoScaling.1)

Steampipe version (steampipe -v)
0.5.0

Plugin version (steampipe plugin list)
v0.18.0

To reproduce

Expected behavior
It should check the autoscaling groups that are associated with load balancers, not all the autoscaling groups.

Additional context

Add AWS Foundational Security Best Practices EFS benchmark control 1

Is your feature request related to a problem? Please describe.
I'd like to be able to run the EFS benchmark for the AWS Foundational Security Best Practices framework.

Describe the solution you'd like
Implement the benchmark, starting with EFS controls.

Describe alternatives you've considered
N/A

Additional context
Add any other context or screenshots about the feature request here.

Add PCI v3.2.1 Redshift benchmark and controls

Is your feature request related to a problem? Please describe.
We're currently missing the Redshift control from https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html#pcidss-redshift-1

Describe the solution you'd like
Add the Redshift benchmark and related controls

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add PCI v3.2.1 RDS benchmark and controls

Is your feature request related to a problem? Please describe.
We're currently missing the RDS control from https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html#pcidss-rds-1

Describe the solution you'd like
Add the RDS benchmark and related controls

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Fix formatting in config_enabled_all_regions query and remove any `order by` keywords

Add AWS Foundational Security Best Practices Elasticsearch benchmark

Is your feature request related to a problem? Please describe.
I'd like to be able to run the Elasticsearch (ES) benchmark for the AWS Foundational Security Best Practices framework.

Describe the solution you'd like
Implement ES benchmark.

Describe alternatives you've considered
N/A

Additional context
Add any other context or screenshots about the feature request here.

Add AWS PCI SSM, CW, GuardDuty Docs.

Is your feature request related to a problem? Please describe.
N/A

Describe the solution you'd like
N/A

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add AWS PCI Elasticsearch, Lamda, KMS, Sagemaker docs.

Is your feature request related to a problem? Please describe.
N/A

Describe the solution you'd like
N/A

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add PCI v3.2.1 SageMaker benchmark and controls

Is your feature request related to a problem? Please describe.
https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html#pcidss-sagemaker-1

Describe the solution you'd like
Add the Config benchmark and related controls

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add AWS Foundational Security Best Practices Config benchmark

Is your feature request related to a problem? Please describe.
I'd like to be able to run the Config benchmark for the AWS Foundational Security Best Practices framework.

Describe the solution you'd like
Implement the benchmark, starting with Config controls.

Describe alternatives you've considered
N/A

Additional context
Add any other context or screenshots about the feature request here.

Add PCI v3.2.1 ES benchmark and controls

Is your feature request related to a problem? Please describe.
https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html#pcidss-es-1

Describe the solution you'd like
Add the ES benchmark and related controls

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add AWS Foundational Security Best Practices CloudTrail benchmark

Is your feature request related to a problem? Please describe.
I'd like to be able to run the CloudTrail benchmark for the AWS Foundational Security Best Practices framework.

Describe the solution you'd like
Implement the benchmark, starting with CloudTrail controls.

Describe alternatives you've considered
N/A

Additional context
Add any other context or screenshots about the feature request here.

Cleanup CIS v1.3.0 and PCI v3.2.1 docs

• Remove ## Rationale section
• Fix incorrect newline spacing
• Add documentation arguments for controls missing it

Add AWS PCI S3 Docs.

Is your feature request related to a problem? Please describe.
N/A

Describe the solution you'd like
N/A

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add AWS Foundational Security Best Practices IAM benchmark

Is your feature request related to a problem? Please describe.
I'd like to be able to run the IAM benchmark for the AWS Foundational Security Best Practices framework

Describe the solution you'd like
Implement IAM benchmark.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add AWS PCI EC2 & ELBv2 docs.

Is your feature request related to a problem? Please describe.
N/A

Describe the solution you'd like
N/A

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add AWS Foundational Security Best Practices ELB benchmark

Is your feature request related to a problem? Please describe.
I'd like to be able to run the ELB benchmark for the AWS Foundational Security Best Practices framework.

Describe the solution you'd like
Implement the benchmark, starting with ELB controls.

Describe alternatives you've considered
N/A

Additional context
Add any other context or screenshots about the feature request here.

Add PCI v3.2.1 S3 benchmark and controls

Is your feature request related to a problem? Please describe.
We're currently missing the S3 control from https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html#pcidss-s3-1

Describe the solution you'd like
Add the S3 benchmark and related controls

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add AWS PCI S3 Docs

Is your feature request related to a problem? Please describe.
N/A

Describe the solution you'd like
N/A

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add PCI v3.2.1 EC2.3 control

Is your feature request related to a problem? Please describe.
We're currently missing the EC2.3 control from https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html#pcidss-ec2-3

Describe the solution you'd like
Add the EC2.3 control

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

v0.2

Add PCI v3.2.1 CodeBuild benchmark and controls

Is your feature request related to a problem? Please describe.
We're currently missing the CodeBuild control from https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html#pcidss-codebuild-2

Describe the solution you'd like
Add the CodeBuild benchmark and related controls

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add AWS PCI DMS, RDS, Redshift Docs

Is your feature request related to a problem? Please describe.
N/A

Describe the solution you'd like
N/A

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Incorrect report for CIS 3.5 (AWS Config)

Describe the bug
The CIS 3.5 control requires that only one region has includeGlobalResourceTypes enabled. However, this check appears to fail unless includeGlobalResourceTypes is true in every region.

Steampipe version (steampipe -v)
0.5.0

Plugin version (steampipe plugin list)
hub.steampipe.io/plugins/turbot/aws@latest | 0.18.0 | aws

To reproduce

1. Enable AWS Config in every region of the account and ensure that recording is enabled and status is successful.
2. In exactly one region, ensure includeGlobalResourceTypes is true.
3. Run steampipe check benchmark.cis_v130
4. Note that the output shows ALARM state for every region except the region where includeGlobalResourceTypes is true.

ALARM: eu-north-1 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. ................................................ eu-north-1 000476352289
ALARM: us-east-1 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. .................................................. us-east-1 000476352289
ALARM: me-south-1 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. ................................................ me-south-1 000476352289
ALARM: ap-northeast-2 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. ........................................ ap-northeast-2 000476352289
ALARM: ca-central-1 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. ............................................ ca-central-1 000476352289
ALARM: us-west-1 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. .................................................. us-west-1 000476352289
OK   : us-west-2 IncludeGlobalResourceTypes enabled, AllSupported enabled, Recording enabled and LastStatus is SUCCESS. ......................................................... us-west-2 000476352289
ALARM: ap-northeast-1 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. ........................................ ap-northeast-1 000476352289
ALARM: ap-east-1 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. .................................................. ap-east-1 000476352289
ALARM: ap-southeast-2 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. ........................................ ap-southeast-2 000476352289
ALARM: us-east-2 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. .................................................. us-east-2 000476352289
ALARM: eu-west-2 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. .................................................. eu-west-2 000476352289
ALARM: ap-southeast-1 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. ........................................ ap-southeast-1 000476352289
ALARM: sa-east-1 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. .................................................. sa-east-1 000476352289
ALARM: eu-south-1 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. ................................................ eu-south-1 000476352289
ALARM: eu-central-1 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. ............................................ eu-central-1 000476352289
ALARM: ap-northeast-3 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. ........................................ ap-northeast-3 000476352289
ALARM: eu-west-1 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. .................................................. eu-west-1 000476352289
ALARM: ap-south-1 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. ................................................ ap-south-1 000476352289
ALARM: af-south-1 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. ................................................ af-south-1 000476352289
ALARM: eu-west-3 IncludeGlobalResourceTypes disabled, AllSupported disabled, Recording disabled and LastStatus is not SUCCESS. .................................................. eu-west-3 000476352289

Expected behavior
As long as one region has IncludeGlobalResourceTypes enabled, all regions should report OK.

Add AWS PCI IAM Docs

Is your feature request related to a problem? Please describe.
N/A

Describe the solution you'd like
N/A

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

IAM account password policy queries should alarm if no password policy is set

Describe the bug
For queries that check if certain account password policy settings are configured, if no policy is set, they should move to alarm instead of ok as the password policy isn't them.

Steampipe version (steampipe -v)
v0.5.0

Plugin version (steampipe plugin list)
aws v0.17.0

To reproduce

• Delete the account password policy if it exists
• Run the iam_account_password_policy_reuse_24 query

Expected behavior
The query should return ok

Additional context
Add any other context about the problem here.