Thanks to @cristianchiriac for contributing most of the fixes in this release!

Enhancements

• Added the opensearch_domain_uses_latest_tls_security_policy control to the All AWS Compliance Controls benchmark.
• Updated the foundational_security_opensearch_8 control to match the current AWS Security Hub control, "Connections to OpenSearch domains should be encrypted using the latest TLS security policy". The control now passes only OpenSearch domains that enforce HTTPS and use Policy-Min-TLS-1-2-PFS-2023-10, which can be changed with the new opensearch_domain_latest_tls_security_policies variable.

Bug fixes

• Fixed the api_gatewayv2_route_authorization_type_configured query to alarm when a route's authorization_type is NONE. (#1016)
• Fixed the iam_root_last_used query to alarm when a root access key was used in the last 90 days, instead of when it was last used more than 90 days ago. (#1010)
• Fixed the kinesis_stream_retention_period_168_hours query to pass streams with a retention period longer than 168 hours. (#1013)
• Fixed the lightsail_instance_ssh_rdp_http_ports_disabled query to check port 3389 instead of 338 for RDP. (#1009)
• Fixed the opensearch_domain_audit_logging_enabled query always returning ok. OpenSearch domains without audit logging enabled now alarm. (#1011)
• Fixed the opensearch_domain_data_node_fault_tolerance query comparing InstanceCount as text, which alarmed for domains with 10 or more data nodes. (#1014)
• Fixed the opensearch_domain_https_required query comparing the TLS security policy with a literal string, which alarmed for every OpenSearch domain that enforces HTTPS. Domains now pass when they enforce HTTPS with a TLS 1.2 or later security policy. (#1017)