I don’t know about a min length; setting a lenient lower bound means that any passwords in that space are going to be absolutely brute force-able (and because humans are lazy, there are almost certainly be passwords clustered around the minimum).
I very much agree with the rest though, it’s unnerving when sites have a low max length. It almost feels like advertising that passwords aren’t being hashed, and if that’s the case there’s a snowball’s chance in hell that they’re also salted. Really restrictive character sets also tell me that said site / company either has super old infra or doesn’t know how to sanitize strings (or entirely likely both)…
Enh, the tech space is very much innovate or die. So yeah, they could probably throw everything in maintenance mode and make a reduced headcount work, but if AWS goes stagnant it’s entirely likely that Amazon goes the way of IBM and Motorol. Especially when someone (likely, Microsoft or Google) comes to take a slice of the AWS market share.