update password requirements
Open
- Dominant language
- HCL
- Stars
- 4
- Forks
- 5
- PR merge metrics
- No merged PRs in 30d
Description
Per [NIST SP 800-63B](https://pages.nist.gov/800-63-3/sp800-63b.html#5111-memorized-secret-authenticators):
> Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. … No other complexity requirements for memorized secrets SHOULD be imposed.
Suggest updating the defaults to match.
https://github.com/GSA/grace-config/blob/50ee1c6ea0e2a4d1642591d973ea3b84d68fab18/variables.tf#L65-L105
Contributor guide
Research direction
Start with variables.tf lines 65-105 and compare the current password defaults with the linked NIST SP 800-63B guidance. Confirm which defaults need updating and verify that the resulting configuration reflects the requested minimum length and complexity policy.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, terraform
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100