fix formatting of latest post (#14)

1 files changed, 26 insertions, 22 deletions

diff --git a/content/blog/2026-02-21-auditing-aws-passwords.org b/content/blog/2026-02-21-auditing-aws-passwords.org
index 503fc4a..548e6d7 100644
--- a/content/blog/2026-02-21-auditing-aws-passwords.org
+++ b/content/blog/2026-02-21-auditing-aws-passwords.org
@@ -29,11 +29,12 @@ testing.
 
 The process runs in two steps:
 1. ~gather_policy.sh~ calls the AWS CLI to fetch the current IAM password policy,
-captures metadata (timestamp, AWS account, region, caller identity), and writes
-everything to a JSON file. This file is evidence of the policy's current state.
-2. ~evaluate_policy.py~ reads that JSON file, prompts you for the expected value of
-each setting, and exports a CSV report with a value of ~PASS~ or ~FAIL~ for each
-rule.
+   captures metadata (timestamp, AWS account, region, caller identity), and
+   writes everything to a JSON file. This file is evidence of the policy's
+   current state.
+2. ~evaluate_policy.py~ reads that JSON file, prompts you for the expected value
+   of each setting, and exports a CSV report with a value of ~PASS~ or ~FAIL~ for
+   each rule.
 
 * Prerequisites
 
@@ -182,32 +183,35 @@ allows you to prove that the data was not modified after the script was run.
 * Common Exceptions and False Positives
 
 - *No policy defined*: If ~gather_policy.sh~ exits with a ~NoSuchEntity~ error, the
-account has no IAM password policy configured. If you were expecting a password
-policy, document it as a missing control.
+  account has no IAM password policy configured. If you were expecting a
+  password policy, document it as a missing control.
 - *HardExpiry: false*: This setting controls whether users are locked out
-immediately when their password expires or given a grace period to change it.
-~false~ is often intentional to avoid lockouts. Check the organization's policy
-before calling it a finding. Additionally, check if the organization has
-security exceptions in place before noting a deficiency.
+  immediately when their password expires or given a grace period to change it.
+  ~false~ is often intentional to avoid lockouts. Check the organization's policy
+  before calling it a finding. Additionally, check if the organization has
+  security exceptions in place before noting a deficiency.
 - *MaxPasswordAge and forced rotation*: A 90-day rotation requirement is common in
-older policies and frameworks like CIS. NIST 800-63B no longer recommends forced
-rotation unless there's evidence of compromise. Know which framework you're
-auditing against before writing up a finding for this setting. Confirm with the
-organization to understand which framework they used to write their policy.
-- *PasswordReusePrevention*: AWS allows a maximum of 24 previous passwords. If your
-organization's policy requires a higher number than AWS supports, document the
-platform limitation rather than raising it as a deficiency.
+  older policies and frameworks like CIS. NIST 800-63B no longer recommends
+  forced rotation unless there's evidence of compromise. Know which framework
+  you're auditing against before writing up a finding for this setting. Confirm
+  with the organization to understand which framework they used to write their
+  policy.
+- *PasswordReusePrevention*: AWS allows a maximum of 24 previous passwords. If
+  your organization's policy requires a higher number than AWS supports,
+  document the platform limitation rather than raising it as a deficiency.
 
 * How to Write Up the Finding
 
 If a setting fails, here's how to frame it:
-- *Deficiency:* The ~MinimumPasswordLength~ setting in the AWS IAM password policy is
-configured to ~6~, which is below the organization's requirement of ~8~ characters.
+
+- *Deficiency:* The ~MinimumPasswordLength~ setting in the AWS IAM password policy
+  is configured to ~6~, which is below the organization's requirement of ~8~
+  characters.
 - *Root Cause:* Due to {{ root cause }}, the policy was configured to enforce a
   ~MinimumPasswordLength~ of ~6~.
 - *Risk:* Shorter passwords are more susceptible to brute-force and credential
-stuffing attacks, increasing the likelihood of unauthorized access to the AWS
-console.
+  stuffing attacks, increasing the likelihood of unauthorized access to the AWS
+  console.
 - *Evidence:* Refer to ~policy_audit_<timestamp>.csv~ for documentation of testing.
 
 The same structure applies to any other failing rule. For boolean settings, the