Changelog

Bug fixes

• Fixed the issue where the search path setting was not retained while navigating to a different dashboard. (#325)

What's new?

• Added support to process enable and disable real-time events for Dataplex.

Resource Types

• GCP > Dataplex
• GCP > Dataplex > Lake
• GCP > Dataplex > Task
• GCP > Dataplex > Zone

Control Types

• GCP > Dataplex > API Enabled
• GCP > Dataplex > CMDB
• GCP > Dataplex > Discovery
• GCP > Dataplex > Lake > Active
• GCP > Dataplex > Lake > Approved
• GCP > Dataplex > Lake > CMDB
• GCP > Dataplex > Lake > Discovery
• GCP > Dataplex > Lake > Labels
• GCP > Dataplex > Lake > Usage
• GCP > Dataplex > Task > Active
• GCP > Dataplex > Task > Approved
• GCP > Dataplex > Task > CMDB
• GCP > Dataplex > Task > Discovery
• GCP > Dataplex > Task > Labels
• GCP > Dataplex > Task > Usage
• GCP > Dataplex > Zone > Active
• GCP > Dataplex > Zone > Approved
• GCP > Dataplex > Zone > CMDB
• GCP > Dataplex > Zone > Discovery
• GCP > Dataplex > Zone > Labels
• GCP > Dataplex > Zone > Usage

Policy Types

• GCP > Dataplex > API Enabled
• GCP > Dataplex > Approved Regions [Default]
• GCP > Dataplex > CMDB
• GCP > Dataplex > Enabled
• GCP > Dataplex > Labels Template [Default]
• GCP > Dataplex > Lake > Active
• GCP > Dataplex > Lake > Active > Age
• GCP > Dataplex > Lake > Active > Last Modified
• GCP > Dataplex > Lake > Approved
• GCP > Dataplex > Lake > Approved > Custom
• GCP > Dataplex > Lake > Approved > Regions
• GCP > Dataplex > Lake > Approved > Usage
• GCP > Dataplex > Lake > CMDB
• GCP > Dataplex > Lake > Labels
• GCP > Dataplex > Lake > Labels > Template
• GCP > Dataplex > Lake > Regions
• GCP > Dataplex > Lake > Usage
• GCP > Dataplex > Lake > Usage > Limit
• GCP > Dataplex > Permissions
• GCP > Dataplex > Permissions > Levels
• GCP > Dataplex > Permissions > Levels > Modifiers
• GCP > Dataplex > Regions
• GCP > Dataplex > Task > Active
• GCP > Dataplex > Task > Active > Age
• GCP > Dataplex > Task > Active > Last Modified
• GCP > Dataplex > Task > Approved
• GCP > Dataplex > Task > Approved > Custom
• GCP > Dataplex > Task > Approved > Regions
• GCP > Dataplex > Task > Approved > Usage
• GCP > Dataplex > Task > CMDB
• GCP > Dataplex > Task > Labels
• GCP > Dataplex > Task > Labels > Template
• GCP > Dataplex > Task > Regions
• GCP > Dataplex > Task > Usage
• GCP > Dataplex > Task > Usage > Limit
• GCP > Dataplex > Zone > Active
• GCP > Dataplex > Zone > Active > Age
• GCP > Dataplex > Zone > Active > Last Modified
• GCP > Dataplex > Zone > Approved
• GCP > Dataplex > Zone > Approved > Custom
• GCP > Dataplex > Zone > Approved > Regions
• GCP > Dataplex > Zone > Approved > Usage
• GCP > Dataplex > Zone > CMDB
• GCP > Dataplex > Zone > Labels
• GCP > Dataplex > Zone > Labels > Template
• GCP > Dataplex > Zone > Regions
• GCP > Dataplex > Zone > Usage
• GCP > Dataplex > Zone > Usage > Limit
• GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter > @turbot/gcp-dataplex
• GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-dataplex
• GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-dataplex

Action Types

• GCP > Dataplex > Lake > Delete
• GCP > Dataplex > Lake > Router
• GCP > Dataplex > Lake > Set Labels
• GCP > Dataplex > Set API Enabled
• GCP > Dataplex > Task > Delete
• GCP > Dataplex > Task > Router
• GCP > Dataplex > Task > Set Labels
• GCP > Dataplex > Zone > Delete
• GCP > Dataplex > Zone > Router
• GCP > Dataplex > Zone > Set Labels

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage compute resources in Guardrails. This release includes breaking changes in the CMDB data for virtual machine. We recommend updating your existing policy settings to refer to the updated attributes as mentioned below

Added:

In Azure > Compute > Disk:

• supportedCapabilities.diskControllerTypes
• diskIopsReadWrite
• lastOwnershipUpdateTime

In Azure > Compute > Virtual Machine:

• resources
• timeCreated
• etag

In Azure > Compute > Virtual Machine Scale Set:

• constrainedMaximumCapacity
• etag
• scaleInPolicy
• timeCreated
• upgradePolicy
• storageProfile. diskControllerType

In Azure > Compute > Snapshot:

• dataAccessAuthMode
• incrementalSnapshotFamilyId

Removed:

In Azure > Compute > Virtual Machine:

• statuses.time

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage App Service resources in Guardrails.

Added:

Azure > App Service > App Service Plan

• elasticScaleEnabled
• numberOfWorkers
• zoneRedundant

Azure > App Service > Function App

• configuration.acrUseManagedIdentityCreds
• configuration.acrUserManagedIdentityID
• configuration.elasticWebAppScaleLimit
• configuration.ipSecurityRestrictionsDefaultAction
• configuration.metadata
• configuration.minTlsCipherSuite
• configuration.scmIpSecurityRestrictionsDefaultAction
• dnsConfiguration
• publicNetworkAccess
• vnetBackupRestoreEnabled
• vnetContentShareEnabled
• vnetImagePullEnabled
• vnetRouteAllEnabled

Azure > App Service > Web App

• configuration.acrUseManagedIdentityCreds
• configuration.acrUserManagedIdentityID
• configuration.elasticWebAppScaleLimit
• configuration.ipSecurityRestrictionsDefaultAction
• configuration.metadata
• configuration.minTlsCipherSuite
• configuration.scmIpSecurityRestrictionsDefaultAction
• dnsConfiguration
• publicNetworkAccess
• vnetBackupRestoreEnabled
• vnetContentShareEnabled
• vnetImagePullEnabled
• vnetRouteAllEnabled

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage API Management resources in Guardrails.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Security Center resources in Guardrails. This release includes breaking changes in the CMDB data for security center. We recommend updating your existing policy settings to refer to the updated attributes as mentioned below

Renamed:

• JitNetworkAccessPolicies to jitNetworkAccessPolicies
• Pricing to pricing
• Locations to locations

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage MySQL resources in Guardrails.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Front Door Service resources in Guardrails. This release includes breaking changes in the CMDB data for Front Door Service. We recommend updating your existing policy settings to refer to the updated attributes as mentioned below.

Added:

• frontdoorId
• rulesEngines
• extendedProperties
• backendPoolsSettings
• backendPool.privateLinkAlias
• backendPool.privateLinkLocation
• backendPool.privateEndpointStatus
• backendPool.privateLinkResourceId
• backendPool.privateLinkApprovalMessage
• routingRule.rulesEngine
• routingRule.routeConfiguration.odataType
• routingRule.routeConfiguration.cacheConfiguration.cacheDuration
• routingRule.routeConfiguration.cacheConfiguration.queryParameters
• routingRule.webApplicationFirewallPolicyLink

Modified:

• routingRule.backendPool to routingRule.routeConfiguration.backendPool
• routingRule.forwardingProtocol to routingRule.routeConfiguration.forwardingProtocol
• routingRule.customForwardingPath to routingRule.routeConfiguration.customForwardingPath
• routingRule.cacheConfiguration.dynamicCompression to routingRule.routeConfiguration.cacheConfiguration. dynamicCompression
• routingRule.cacheConfiguration.queryParameterStripDirective to routingRule.routeConfiguration.cacheConfiguration. queryParameterStripDirective

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Data Factory resources in Guardrails.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage AKS resources in Guardrails.

Added:

• networkProfile.podCidrs
• networkProfile.ipFamilies
• networkProfile.outboundType
• networkProfile.serviceCidrs
• networkProfile.networkPolicy
• networkProfile.loadBalancerProfile.backendPoolType
• networkProfile.loadBalancerProfile.countIPv6
• networkProfile.loadBalancerProfile.idleTimeoutInMinutes
• networkProfile.loadBalancerProfile.allocatedOutboundPorts
• agentPoolProfiles.mode
• agentPoolProfiles.osSKU
• agentPoolProfiles.enableFips
• agentPoolProfiles.osDiskType
• agentPoolProfiles.spotMaxPrice
• agentPoolProfiles.scaleDownMode
• agentPoolProfiles.enableUltraSSD
• agentPoolProfiles.kubeletDiskType
• agentPoolProfiles.upgradeSettings.maxSurge
• agentPoolProfiles.nodeImageVersion
• agentPoolProfiles.enableEncryptionAtHost
• agentPoolProfiles.currentOrchestratorVersion

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage SignalR resources in Guardrails.

Added:

• hostNamePrefix
• serverless. connectionTimeoutInSeconds

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Service Bus resources in Guardrails.

Added:

Azure > Service Bus > Namespace

• disableLocalAuth
• status
• zoneRedundant

Azure > Service Bus > Queue

• maxMessageSizeInKilobytes

Azure > Service Bus > Topic

• maxMessageSizeInKilobytes

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Relay resources in Guardrails.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Recovery Service resources in Guardrails.

Added: Azure > Recovery Service > Vault

• properties.backupStorageVersion
• properties.bcdrSecurityLevel
• properties.publicNetworkAccess
• properties.restoreSettings
• properties.secureScore
• properties.securitySettings

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The AWS > RoboMaker > Robot Application > CMDB, AWS > RoboMaker > Fleet > CMDB and AWS > RoboMaker > Robot > CMDB policies will now be set to Skip by default because the resource types have been deprecated and will be removed in the next major version. Please check end of support for more information.

What's new?

• Track and manage Fargate FIPS Mode for Gov cloud accounts via Guardrails. To get started, set the AWS > ECS > Account Settings > Fargate FIPS Mode policy.
• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Resource Types

• AWS > ECS > Account Settings

Control Types

• AWS > ECS > Account Settings > CMDB
• AWS > ECS > Account Settings > Discovery
• AWS > ECS > Account Settings > Fargate FIPS Mode

Policy Types

• AWS > ECS > Account Settings > CMDB
• AWS > ECS > Account Settings > Fargate FIPS Mode
• AWS > ECS > Account Settings > Regions

Action Types

• AWS > ECS > Account Settings > Router
• AWS > ECS > Account Settings > Update Fargate FIPS Mode

What's new?

• Server

  • Introduced support for multi-architecture images, now compatible with both ARM64 and x86_64.
  • Added a default resource query to the context of calculated policies.
  • Updated several node packages to newer versions for improved functionality and security.
  • Updated Lambda to support recursive loops.

• UI

  • Now you can use the + sign to grant permissions in the context of both the identity and resource.
  • Updated several node packages to newer versions for improved functionality and security.

Bug fixes

• Server

  • Azure Credential Resolver now respects proxy settings, adding full proxy support.

• UI

  • Updated policy pack Terraform to correctly reference turbot_policy_pack.
  • Adjusted the Admin page layout for improved usability.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Enhancements

• Added an optional param blocks to the post_message pipeline. (#24) (Thanks @johnlayton for the contribution!)

Bug fixes

• resource/turbot_policy_pack_attachment: terraform apply failed to detect existing Policy Pack attachments. (#181)

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Application Insights resources in Guardrails. This release includes changes in the CMDB data as below.

Added:

• flowType
• requestSource

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Application Gateway resources in Guardrails.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Resource Types

• AWS > Support

Policy Types

• AWS > Support > API Enabled
• AWS > Support > Enabled
• AWS > Support > Permissions
• AWS > Support > Permissions > Levels
• AWS > Support > Permissions > Levels > Modifiers
• AWS > Support > Permissions > Lockdown
• AWS > Support > Permissions > Lockdown > API Boundary
• AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-support
• AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-support
• AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-support

What's new?

• Users can now manage whether AWS/User grant should include support:* permissions. To get started, set the AWS > Account > Permissions > Support Level policy.

Policy Types

• AWS > Account > Permissions > Support Level

Bug fixes

• The AWS > Turbot > IAM stack control did not correctly evaluate user memberships in custom IAM groups when the AWS > Turbot > Permissions > Custom Group Levels [Account] policy was set, and users were granted permissions for those custom IAM groups. This issue has now been fixed.

Bug fixes

• The AWS > EC2 > Volume > CMDB control would sometimes run unnecessarily due to a bad internal GraphQL dependency. This is now fixed.

Bug fixes

• Fixed put_s3_bucket_encryption pipeline to correctly encrypt an S3 bucket without returning an error. (#68) (Thanks @gcasilva for the contribution!)

Bug fixes

• A precheck dependency on the Kubernetes > Cluster > CMDB > Expiration policy was inadvertently added to the Kubernetes > Cluster > CMDB control. This precheck condition has now been removed.

Resource Types

• GCP > Vertex AI
• GCP > Vertex AI > Endpoint
• GCP > Vertex AI > Notebook Runtime Template

Control Types

• GCP > Vertex AI > API Enabled
• GCP > Vertex AI > CMDB
• GCP > Vertex AI > Discovery
• GCP > Vertex AI > Endpoint > Active
• GCP > Vertex AI > Endpoint > Approved
• GCP > Vertex AI > Endpoint > CMDB
• GCP > Vertex AI > Endpoint > Discovery
• GCP > Vertex AI > Endpoint > Labels
• GCP > Vertex AI > Endpoint > Usage
• GCP > Vertex AI > Notebook Runtime Template > Active
• GCP > Vertex AI > Notebook Runtime Template > Approved
• GCP > Vertex AI > Notebook Runtime Template > CMDB
• GCP > Vertex AI > Notebook Runtime Template > Discovery
• GCP > Vertex AI > Notebook Runtime Template > Router
• GCP > Vertex AI > Notebook Runtime Template > Usage

Policy Types

• GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter > @turbot/gcp-vertexai
• GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-vertexai
• GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-vertexai
• GCP > Vertex AI > API Enabled
• GCP > Vertex AI > Approved Regions [Default]
• GCP > Vertex AI > CMDB
• GCP > Vertex AI > Enabled
• GCP > Vertex AI > Endpoint > Active
• GCP > Vertex AI > Endpoint > Active > Age
• GCP > Vertex AI > Endpoint > Active > Last Modified
• GCP > Vertex AI > Endpoint > Approved
• GCP > Vertex AI > Endpoint > Approved > Custom
• GCP > Vertex AI > Endpoint > Approved > Regions
• GCP > Vertex AI > Endpoint > Approved > Usage
• GCP > Vertex AI > Endpoint > CMDB
• GCP > Vertex AI > Endpoint > Labels
• GCP > Vertex AI > Endpoint > Labels > Template
• GCP > Vertex AI > Endpoint > Regions
• GCP > Vertex AI > Endpoint > Usage
• GCP > Vertex AI > Endpoint > Usage > Limit
• GCP > Vertex AI > Labels Template [Default]
• GCP > Vertex AI > Notebook Runtime Template > Active
• GCP > Vertex AI > Notebook Runtime Template > Active > Age
• GCP > Vertex AI > Notebook Runtime Template > Active > Last Modified
• GCP > Vertex AI > Notebook Runtime Template > Approved
• GCP > Vertex AI > Notebook Runtime Template > Approved > Custom
• GCP > Vertex AI > Notebook Runtime Template > Approved > Regions
• GCP > Vertex AI > Notebook Runtime Template > Approved > Usage
• GCP > Vertex AI > Notebook Runtime Template > CMDB
• GCP > Vertex AI > Notebook Runtime Template > Regions
• GCP > Vertex AI > Notebook Runtime Template > Usage
• GCP > Vertex AI > Notebook Runtime Template > Usage > Limit
• GCP > Vertex AI > Permissions
• GCP > Vertex AI > Permissions > Levels
• GCP > Vertex AI > Permissions > Levels > Modifiers
• GCP > Vertex AI > Regions

Action Types

• GCP > Vertex AI > Endpoint > Delete
• GCP > Vertex AI > Endpoint > Router
• GCP > Vertex AI > Endpoint > Set Labels
• GCP > Vertex AI > Notebook Runtime Template > Delete
• GCP > Vertex AI > Set API Enabled

What's new?

• Added support to process real-time enable and disable events for Vertex AI API via Service Usage APIs.

What's new?

• New tables added
  • okta_authentication_policy (#139)

Bug fixes

• Fixed the rules column in okta_signon_policy, okta_password_policy, okta_idp_discovery_policy and okta_authentication_policy tables to correctly return data instead of null. (#145)

Dependencies

• Recompiled plugin with Go version 1.22. (#146)
• Recompiled plugin with steampipe-plugin-sdk v5.10.4 that fixes logging in the plugin export tool. (#146)

All Pipes workspaces are now running Steampipe v0.24.0.

For more information on this Steampipe release, see the release notes.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Search Management resources in Guardrails.

Added:

• authOptions
• disableLocalAuth
• encryptionWithCmk
• networkRuleSet
• privateEndpointConnections
• publicNetworkAccess
• semanticSearch
• sharedPrivateLinkResources

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Enhancements

• The Plugin and the Steampipe Anywhere binaries are now built with the netgo package.
• Added the version flag to the plugin's Export tool. (#65)

Bug fixes

• Fixed pagination across all the tables. (#34)

Dependencies

• Recompiled plugin with Go version 1.22. (#43)
• Recompiled plugin with steampipe-plugin-sdk v5.10.4 that fixes logging in the plugin export tool. (#43)

What's new?

• Initial release with support for installing Powerpipe and adding it to $PATH.

What's new?

• Initial release with support for running Powerpipe benchmarks and controls, creating annotations for Infrastructure as Code (IaC) checks, and uploading snapshots to Turbot Pipes.

What's new?

Action Types

• GCP > Storage > Bucket > Set Fine-grained Access Control
• GCP > Storage > Bucket > Set Uniform Access Control

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Synapse Analytics resources in Guardrails.

Added: Azure > Synapse Analytics > Workspace

• azureADOnlyAuthentication
• createManagedPrivateEndpoint
• encryption
• extraProperties
• publicNetworkAccess
• settings
• trustedServiceBypassEnabled
• workspaceUID

Azure > Synapse Analytics > SQL Pool

• storageAccountType

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

Action Types

• Azure > Storage > Storage Account > Set Minimum TLS Version

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage PostgreSQL resources in Guardrails. This release includes breaking changes in the CMDB data for server and flexible server. We recommend updating your existing policy settings to refer to the updated attributes as mentioned below

Added:

• authConfig

• dataEncryption

• standbyAvailabilityZone

• network. delegatedSubnetResourceId

• network. privateDnsZoneArmResourceId

• replicaCapacity

• replicationRole

• systemData

• configurations.documentationLink

• configurations.isConfigPendingRestart

• configurations.isDynamicConfig

• configurations.isReadOnly

• configurations.unit

Modified:

• The data type of the attribute firewallRules has been changed from array ([]) to object ({}).

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Network Watcher resources in Guardrails.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• Fixed an issue where credentials from the imported foreign schema were lost after restarting the session in the Postgres FDW extension of the plugin. (#2275)

Dependencies

• Recompiled plugin with Go version 1.22. (#450)
• Recompiled plugin with steampipe-plugin-sdk v5.10.4 that fixes logging in the plugin export tool. (#450)

What's new?

• New tables added
  • gcp_composer_environment (#649)
  • gcp_dataplex_lake (#642)
  • gcp_dataplex_zone (#642)
  • gcp_dataplex_task (#642)
  • gcp_dataplex_asset (#642)
  • gcp_dataproc_metastore_service (#654)
  • gcp_vpc_access_connector (#647)

Enhancements

• Added connection_info column to the gcp_alloydb_instance table. (#651)

Bug fixes

• Removed the name column from the gcp_bigquery_table table since the API response did not include this field. (#648)

Dependencies

• Recompiled plugin with Go version 1.22. (#635)
• Recompiled plugin with steampipe-plugin-sdk v5.10.4 that fixes logging in the plugin export tool. (#635)

Enhancements

• Added the event_region column to the aws_health_event table. (#2293)
• Added the location_type column to the aws_ec2_instance_type table. (#2294)

Bug fixes

• Removed unnecessary hydration of the instance_type column in aws_ec2_instance_type table. (#2294)
• Fixed an issue where credentials from import foreign schema were lost after restarting session in the Posgres FDW extensions of the plugin. (#2275)

Bug fixes

• Fixed the CLI to correctly display the latest released version when using the steampipe -v command. (#4388)

Bug fixes

• Fixed an issue where Steampipe failed to download the embedded PostgreSQL database and FDW during installation. (#4382)

Deprecations

• This GitHub Action is deprecated and will no longer be maintained. Please use Powerpipe Action Check instead.

Bug fixes

• Fixed secret references for AWS creds in README.

Dependencies

• Bumped @actions/core from v0.10.0 to v0.10.1.
• Bumped @vercel/ncc from v0.38.0 to v0.38.1.
• Bumped actions/setup-node from 3 to 4. (#95)
• Bumped actions/upload-artifact from 3 to 4. (#100)
• Bumped braces from 3.0.2 to 3.0.3. (#109)
• Bumped eslint from 8.52.0 to 8.56.0. (#101)
• Bumped eslint from 8.56.0 to 9.2.0. (#108)
• Bumped github/codeql-action from 2 to 3. (#99)
• Bumped semver from v7.5.4 to v7.6.3.
• Update to node v20 in action and check-dist workflow (#104) (Thanks @francois2metz for the contribution!)

Bug fixes

• trigger introspection output correctly shows param attribute. (#900)

Bug fixes

• The serviceProperties.table.clientRequestId and serviceProperties.table.requestId properties for storage accounts have now been made dynamic to avoid unnecessary notifications in the activity tab.

Bug fixes

• Fixed incorrect references to various Quick Actions.

Whats new

• Added the ability to configure plugin startup timeout. (#4320)
• Installed FDW and embedded Postgres database from GHCR instead of GCP. (#4344)
• Updated query JSON output format to add a columns property containing the column information. This allows us to handle duplicate column names by appending a unique suffix to duplicate column name (#4317)

Existing query JSON format:

$ steampipe query "select account_id, arn from aws_account" --output json
{
 "rows": [
  {
   "account_id": "123456789012",
   "arn": "arn:aws:::123456789012"
  }
 ]
}

New query JSON format(with new columns property):

$ steampipe query "select account_id, arn from aws_account" --output json
{
 "columns": [
  {
   "name": "account_id",
   "data_type": "text"
  },
  {
   "name": "arn",
   "data_type": "text"
  }
 ],
 "rows": [
  {
   "account_id": "123456789012",
   "arn": "arn:aws:::123456789012"
  }
 ]
}

Bug fixes

• Fixed the issue where the plugin manager was incorrectly reporting a shutdown. (#4365)

What's new?

• tags argument in pipeline param and mod variable resources. (#898).
• Updated Docker dependency to v27.1.2.

What's new?

Policy Types

• Kubernetes > Cluster > ServiceNow > Import Set > Insert Mode
• Kubernetes > ConfigMap > ServiceNow > Import Set > Insert Mode
• Kubernetes > Deployment > ServiceNow > Import Set > Insert Mode
• Kubernetes > Namespace > ServiceNow > Import Set > Insert Mode
• Kubernetes > Node > ServiceNow > Import Set > Insert Mode
• Kubernetes > Pod > ServiceNow > Import Set > Insert Mode
• Kubernetes > ReplicaSet > ServiceNow > Import Set > Insert Mode
• Kubernetes > Service > ServiceNow > Import Set > Insert Mode

Bug fixes

• Improved error handling for osquery error events.

Bug fixes

• Query controls for various resource types will now go into an invalid state if we receive an error from the osquery agent.

What's new?

• New tables added
  • azure_key_vault_certificate (#698)
  • azure_web_application_firewall_policy (#834)

Enhancements

• Added time_created column to the azure_compute_virtual_machine table. (#831)
• Added ip_configuration, linked_public_ip_address, nat_gateway and service_public_ip_address columns to the azure_public_ip table. (#836)
• Added 20 new columns to the azure_postgresql_flexible_server table. (#824)

Bug fixes

• Fixed the ip_configurations column of the azure_subnet table to correctly return data instead of null. (#822)
• Fixed the web_application_firewall_configuration column of azure_application_gateway table to correctly return data instead of null. (#835)

Dependencies

• Recompiled plugin with Go version 1.22. (#832)
• Recompiled plugin with steampipe-plugin-sdk v5.10.4 that fixes logging in the plugin export tool.
• Updated the azure_mysql_flexible_server and azure_postgresql_flexible_server tables to use the new Azure ARM Go package. (#820)

What's new?

• New tables added
  • aws_app_runner_service (#2279)
  • aws_ec2_load_balancer_listener_rule (#2272)
  • aws_lightsail_bucket (#2258)
  • aws_memorydb_cluster (#2268)
  • aws_securityhub_enabled_product_subscription (#2281)
  • aws_timestreamwrite_database (#2269)
  • aws_timestreamwrite_table (#2269)

Enhancements

• Updated the aws_ec2_ami table to correctly return disabled AMIs on passing the disabled value to the state optional qual (where state = 'disabled'). (#2277)
• Added 100+ new columns across all tables per AWS Go SDK v2 1.27.0. (#2139)

Dependencies

• Recompiled plugin with Go version 1.22. (#2283)
• Recompiled plugin with steampipe-plugin-sdk v5.10.4 that fixes logging in the plugin export tool. (#2286)

Bug fixes

• source attribute in function step is now evaluated relative to the its mod directory rather than the root mod directory. (#895).

What's new?

• Added Australian Cyber Security Center (ACSC) Essential Eight benchmark (powerpipe benchmark run aws_compliance.benchmark.acsc_essential_eight). (#823)

What's new?

Policy Types

• GCP > Storage > Bucket > ServiceNow > Import Set > Insert Mode
• GCP > Storage > Object > ServiceNow > Import Set > Insert Mode

Control Types

• GCP > Kubernetes Engine > Region Cluster > ServiceNow > Import Set
• GCP > Kubernetes Engine > Region Node Pool > ServiceNow > Import Set
• GCP > Kubernetes Engine > Zone Cluster > ServiceNow > Import Set
• GCP > Kubernetes Engine > Zone Node Pool > ServiceNow > Import Set

Policy Types

• GCP > Kubernetes Engine > Region Cluster > ServiceNow > Import Set
• GCP > Kubernetes Engine > Region Cluster > ServiceNow > Import Set > Archive Columns
• GCP > Kubernetes Engine > Region Cluster > ServiceNow > Import Set > Insert Mode
• GCP > Kubernetes Engine > Region Cluster > ServiceNow > Import Set > Record
• GCP > Kubernetes Engine > Region Cluster > ServiceNow > Import Set > Table Name
• GCP > Kubernetes Engine > Region Node Pool > ServiceNow > Import Set
• GCP > Kubernetes Engine > Region Node Pool > ServiceNow > Import Set > Archive Columns
• GCP > Kubernetes Engine > Region Node Pool > ServiceNow > Import Set > Insert Mode
• GCP > Kubernetes Engine > Region Node Pool > ServiceNow > Import Set > Record
• GCP > Kubernetes Engine > Region Node Pool > ServiceNow > Import Set > Table Name
• GCP > Kubernetes Engine > Zone Cluster > ServiceNow > Import Set
• GCP > Kubernetes Engine > Zone Cluster > ServiceNow > Import Set > Archive Columns
• GCP > Kubernetes Engine > Zone Cluster > ServiceNow > Import Set > Insert Mode
• GCP > Kubernetes Engine > Zone Cluster > ServiceNow > Import Set > Record
• GCP > Kubernetes Engine > Zone Cluster > ServiceNow > Import Set > Table Name
• GCP > Kubernetes Engine > Zone Node Pool > ServiceNow > Import Set
• GCP > Kubernetes Engine > Zone Node Pool > ServiceNow > Import Set > Archive Columns
• GCP > Kubernetes Engine > Zone Node Pool > ServiceNow > Import Set > Insert Mode
• GCP > Kubernetes Engine > Zone Node Pool > ServiceNow > Import Set > Record
• GCP > Kubernetes Engine > Zone Node Pool > ServiceNow > Import Set > Table Name

What's new?

Policy Types

• GCP > Global Region > ServiceNow > Import Set > Insert Mode
• GCP > Multi-Region > ServiceNow > Import Set > Insert Mode
• GCP > Project > ServiceNow > Import Set > Insert Mode
• GCP > Region > ServiceNow > Import Set > Insert Mode
• GCP > Zone > ServiceNow > Import Set > Insert Mode

Control Types

• Azure > AKS > Managed Cluster > ServiceNow > Import Set

Policy Types

• Azure > AKS > Managed Cluster > ServiceNow > Import Set
• Azure > AKS > Managed Cluster > ServiceNow > Import Set > Archive Columns
• Azure > AKS > Managed Cluster > ServiceNow > Import Set > Insert Mode
• Azure > AKS > Managed Cluster > ServiceNow > Import Set > Record
• Azure > AKS > Managed Cluster > ServiceNow > Import Set > Table Name

What's new?

Policy Types

• Azure > Subscription > ServiceNow > Import Set > Insert Mode

What's new?

Policy Types

• ServiceNow > Import Set > Insert Mode [Default]

Bug fixes

• Guardrails did not correctly raise the real-time modifyVolume event for EBS Volume Notifications. This issue is now fixed.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

Action Types

• AWS > SWF > Domain > Delete from AWS

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

Bug fixes

• Fixed incorrect references to various Quick Actions.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

What's new?

• Volume's metadata will now also include createdBy details in Guardrails CMDB.
• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• The AWS > EC2 > Volume > Performance Configuration control would sometimes fail to set the expected configuration per AWS > EC2 > Volume > Performance Configuration > * policies and move to an Invalid state if the required data was not available for new volumes in the CMDB. The control will now move to TBD instead and retry after 5 minutes to fetch the required data correctly and set the performance configuration as expected.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

What's new?

• Support for Node.js 20 in the Lambda runtime.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Enhancements

• The VPC Security Group detail page now includes information on the following associated services: (#352) (Thanks @maxcorbin for the contribution!)
  • Amazon MQ broker
  • ECS service
  • ECS task

GCP integrations now make use of temporary credentials via service account impersonation using the Service Account Token Creator role.

For more information, check out the docs.

What's new?

• trigger list command includes triggers from root mod's immediate dependencies. (#892).

Bug fixes

• Function step will no longer randomly fail in slower host machines. (#888).
• Mod variable definition now matches Powerpipe's definition. (#889).

What's new?

• The Azure > Storage> Storage Account > CMDB control will now also fetch diagnostic settings details and store them in CMDB.
• Track and manage storage account access keys in Guardrails CMDB.

Resource Types

• Azure > Storage > Access Key

Control Types

• Azure > Storage > Access Key > CMDB
• Azure > Storage > Access Key > Discovery

Policy Types

• Azure > Storage > Access Key > CMDB

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed the AKA format for rule group v2 global and regional resource types.

What's new?

• Added SOC2 2017 benchmark (powerpipe benchmark run gcp_compliance.benchmark.soc_2_2017). (#181)

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Control Types

• GCP > Global Region > ServiceNow
• GCP > Global Region > ServiceNow > Configuration Item
• GCP > Global Region > ServiceNow > Import Set
• GCP > Global Region > ServiceNow > Table
• GCP > Multi-Region > ServiceNow
• GCP > Multi-Region > ServiceNow > Configuration Item
• GCP > Multi-Region > ServiceNow > Import Set
• GCP > Multi-Region > ServiceNow > Table
• GCP > Region > ServiceNow
• GCP > Region > ServiceNow > Configuration Item
• GCP > Region > ServiceNow > Import Set
• GCP > Region > ServiceNow > Table
• GCP > Zone > ServiceNow
• GCP > Zone > ServiceNow > Configuration Item
• GCP > Zone > ServiceNow > Import Set
• GCP > Zone > ServiceNow > Table

Policy Types

• GCP > Global Region > ServiceNow
• GCP > Global Region > ServiceNow > Configuration Item
• GCP > Global Region > ServiceNow > Configuration Item > Record
• GCP > Global Region > ServiceNow > Configuration Item > Table Definition
• GCP > Global Region > ServiceNow > Import Set
• GCP > Global Region > ServiceNow > Import Set > Archive Columns
• GCP > Global Region > ServiceNow > Import Set > Record
• GCP > Global Region > ServiceNow > Import Set > Table Name
• GCP > Global Region > ServiceNow > Table
• GCP > Global Region > ServiceNow > Table > Definition
• GCP > Multi-Region > ServiceNow
• GCP > Multi-Region > ServiceNow > Configuration Item
• GCP > Multi-Region > ServiceNow > Configuration Item > Record
• GCP > Multi-Region > ServiceNow > Configuration Item > Table Definition
• GCP > Multi-Region > ServiceNow > Import Set
• GCP > Multi-Region > ServiceNow > Import Set > Archive Columns
• GCP > Multi-Region > ServiceNow > Import Set > Record
• GCP > Multi-Region > ServiceNow > Import Set > Table Name
• GCP > Multi-Region > ServiceNow > Table
• GCP > Multi-Region > ServiceNow > Table > Definition
• GCP > Region > ServiceNow
• GCP > Region > ServiceNow > Configuration Item
• GCP > Region > ServiceNow > Configuration Item > Record
• GCP > Region > ServiceNow > Configuration Item > Table Definition
• GCP > Region > ServiceNow > Import Set
• GCP > Region > ServiceNow > Import Set > Archive Columns
• GCP > Region > ServiceNow > Import Set > Record
• GCP > Region > ServiceNow > Import Set > Table Name
• GCP > Region > ServiceNow > Table
• GCP > Region > ServiceNow > Table > Definition
• GCP > Zone > ServiceNow
• GCP > Zone > ServiceNow > Configuration Item
• GCP > Zone > ServiceNow > Configuration Item > Record
• GCP > Zone > ServiceNow > Configuration Item > Table Definition
• GCP > Zone > ServiceNow > Import Set
• GCP > Zone > ServiceNow > Import Set > Archive Columns
• GCP > Zone > ServiceNow > Import Set > Record
• GCP > Zone > ServiceNow > Import Set > Table Name
• GCP > Zone > ServiceNow > Table
• GCP > Zone > ServiceNow > Table > Definition

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

What's new?

• You can now configure parameter groups for DB clusters. To get started, set the AWS > RDS > DB Cluster > Parameter Group > * policies.

Control Types

• AWS > RDS > DB Cluster > Parameter Group

Policy Types

• AWS > RDS > DB Cluster > Parameter Group
• AWS > RDS > DB Cluster > Parameter Group > Name

Action Types

• AWS > RDS > DB Cluster > Update Parameter Group

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Whats new

• Added JSON extension support for DuckDB backends. (#467)

Bug fixes

• Fixed the incorrect mod reference in the output of powerpipe help command. (#471)

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• Added detect_and_correct_sql_database_instances_with_incorrect_labels pipleine for SQL Database Instance. (#6)

Enhancements

• Added a default value for the base_label_rules variable. (#7)

Enhancements

• Added a default value for the base_tag_rules variable. (#18)

Enhancements

• Added a default value for the base_tag_rules variable. (#28)

Bug fixes

• Fixed an issue where Steampipe failed to create a new connection if it was outside the defined search path. (#4353)

Bug fixes

• Server

  • Resolved an issue where policy values were not being terminated due to a race condition.
  • The ServiceNow credentials resolver will now display a clear message when the instance is hibernate or unavailable state.

• UI

  • Fixed an issue where filters on the Resource Explorer page were not functioning correctly.
  • The Import button on the Connect page has been updated to Connect.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

What's new?

• We have updated various policies set during project imports to allow for a smoother import experience. We recommend upgrading your TE to v5.42.21 or higher to enable these changes to take effect.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• You can now configure Master Authorized Networks for region and zone clusters via Guardrails. To get started, set the GCP > Kubernetes Engine > Region Cluster > Master Authorized Networks Config and GCP > Kubernetes Engine > Zone Cluster > Master Authorized Networks Config policies respectively.

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Control Types

• GCP > Kubernetes Engine > Zone Cluster > Master Authorized Networks Config

Policy Types

• GCP > Kubernetes Engine > Zone Cluster > Master Authorized Networks Config

Action Types

• GCP > Kubernetes Engine > Region Cluster > Set Desired Master Authorized Network Config
• GCP > Kubernetes Engine > Zone Cluster > Set Desired Master Authorized Network Config

What's new?

• We have updated various policies set during subscription imports to allow for a smoother import experience. We recommend upgrading your TE to v5.42.21 or higher to enable these changes to take effect.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Resource Types

• Azure > Network > Private Link Service

Control Types

• Azure > Network > Private Link Service > Active
• Azure > Network > Private Link Service > Approved
• Azure > Network > Private Link Service > CMDB
• Azure > Network > Private Link Service > Discovery
• Azure > Network > Private Link Service > Tags

Policy Types

• Azure > Network > Private Link Service > Active
• Azure > Network > Private Link Service > Active > Age
• Azure > Network > Private Link Service > Active > Last Modified
• Azure > Network > Private Link Service > Approved
• Azure > Network > Private Link Service > Approved > Custom
• Azure > Network > Private Link Service > Approved > Regions
• Azure > Network > Private Link Service > Approved > Usage
• Azure > Network > Private Link Service > CMDB
• Azure > Network > Private Link Service > Regions
• Azure > Network > Private Link Service > Tags
• Azure > Network > Private Link Service > Tags > Template

Action Types

• Azure > Network > Private Link Service > Delete
• Azure > Network > Private Link Service > Router
• Azure > Network > Private Link Service > Set Tags

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• In version 5.25.0, we added support to ignore permission errors on a bucket via the CMDB policy Enforce: Enabled but ignore permission errors. However, the CMDB control previously ignored permission errors only on the HeadBucket operation and still entered an error state for permission errors on sub-API calls. The CMDB control will now ignore all sub-API calls if the HeadBucket operation is denied access. If the HeadBucket operation is successful, the control will attempt to make all sub-API calls and ignore access denied errors if encountered.

Bug fixes

• Complex nested map data type in pipeline param no longer fails with a mismatched types error. (#879).

What's new?

• On-demand trigger execution. (#864).
• param support for trigger. (#840).

Bug fixes

• Complex data type in pipeline param no longer fails with a mismatched types error. (#879).
• Pipeline param default value is not nested in a map data type. (#880).

Whats new

• Recompiled CLI with Go v1.22. (#448)

Bug fixes

• Fixed issue where CLI notifications interfered with the Powerpipe JSON outputs resulting in invalid JSON outputs. (#452)
• Fixed an issue where Powerpipe crashed when running a benchmark with the --dry-run flag set. (#455)

What's new?

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Resource Types

• Azure > Provider > Container Registry

Control Types

• Azure > Provider > Container Registry > CMDB
• Azure > Provider > Container Registry > Discovery
• Azure > Provider > Container Registry > Registered

Policy Types

• Azure > Provider > Container Registry > CMDB
• Azure > Provider > Container Registry > Registered

Action Types

• Azure > Provider > Container Registry > Set Registered

Resource Types

• Azure > Container Registry
• Azure > Container Registry > Registry

Control Types

• Azure > Container Registry > Registry > Active
• Azure > Container Registry > Registry > Approved
• Azure > Container Registry > Registry > CMDB
• Azure > Container Registry > Registry > Discovery
• Azure > Container Registry > Registry > Tags

Policy Types

• Azure > Container Registry > Approved Regions [Default]
• Azure > Container Registry > Enabled
• Azure > Container Registry > Permissions
• Azure > Container Registry > Permissions > Levels
• Azure > Container Registry > Permissions > Levels > Modifiers
• Azure > Container Registry > Regions
• Azure > Container Registry > Registry > Active
• Azure > Container Registry > Registry > Active > Age
• Azure > Container Registry > Registry > Active > Last Modified
• Azure > Container Registry > Registry > Approved
• Azure > Container Registry > Registry > Approved > Custom
• Azure > Container Registry > Registry > Approved > Regions
• Azure > Container Registry > Registry > Approved > Usage
• Azure > Container Registry > Registry > CMDB
• Azure > Container Registry > Registry > Regions
• Azure > Container Registry > Registry > Tags
• Azure > Container Registry > Registry > Tags > Template
• Azure > Container Registry > Tags Template [Default]
• Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-containerregistry
• Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-containerregistry

Action Types

• Azure > Container Registry > Registry > Delete
• Azure > Container Registry > Registry > Router
• Azure > Container Registry > Registry > Set Tags

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The AWS > VPC > VPC > Stack control would sometimes go into an error state while upserting newly created flow logs in Guardrails due to incorrect mapping of its parent resource. This issue has now been fixed, and the control will upsert flow logs more consistently and reliably than before.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.

What's new?

• Added support for Postgres versions 13.14, 13.15, 13.16, 14.11, 14.12, 14.13 and 15.8.
• Updated Default value for the RDS certificate to rds-ca-rsa4096-g1.

5.0.0 (2024-08-13)

Resource Types

• Azure > Managed Identity
• Azure > Managed Identity > User Assigned Identity

Control Types

• Azure > Managed Identity > User Assigned Identity > Active
• Azure > Managed Identity > User Assigned Identity > Approved
• Azure > Managed Identity > User Assigned Identity > CMDB
• Azure > Managed Identity > User Assigned Identity > Discovery
• Azure > Managed Identity > User Assigned Identity > Tags

Policy Types

• Azure > Managed Identity > Approved Regions [Default]
• Azure > Managed Identity > Enabled
• Azure > Managed Identity > Permissions
• Azure > Managed Identity > Permissions > Levels
• Azure > Managed Identity > Permissions > Levels > Modifiers
• Azure > Managed Identity > Regions
• Azure > Managed Identity > Tags Template [Default]
• Azure > Managed Identity > User Assigned Identity > Active
• Azure > Managed Identity > User Assigned Identity > Active > Age
• Azure > Managed Identity > User Assigned Identity > Active > Last Modified
• Azure > Managed Identity > User Assigned Identity > Approved
• Azure > Managed Identity > User Assigned Identity > Approved > Custom
• Azure > Managed Identity > User Assigned Identity > Approved > Regions
• Azure > Managed Identity > User Assigned Identity > Approved > Usage
• Azure > Managed Identity > User Assigned Identity > CMDB
• Azure > Managed Identity > User Assigned Identity > Regions
• Azure > Managed Identity > User Assigned Identity > Tags
• Azure > Managed Identity > User Assigned Identity > Tags > Template
• Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-managedidentity
• Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-managedidentity

Action Types

• Azure > Managed Identity > User Assigned Identity > Delete
• Azure > Managed Identity > User Assigned Identity > Router
• Azure > Managed Identity > User Assigned Identity > Set Tags

Whats new

• Recompiled CLI with Go v1.22. (#4340)

Bug fixes

• Fixed query error message to not include internal function names. (#4335)

What's new?

• Added CIS AWS Compute Services v1.0.0 benchmark (powerpipe benchmark run aws_compliance.benchmark.cis_compute_service_v100). (#814)

Bug fixes

• Fixed iam_root_user_hardware_mfa_enabled query to correctly return ok when hardware MFA is enabled for the root user. (#815)

What's new?

• The AWS > Turbot > Logging > Bucket > Default Encryption policy is now deprecated because all buckets are now encrypted by default in AWS. As a result, all buckets created and managed via the AWS > Turbot > Logging > Bucket stack control will now be encrypted by AWS SSE by default. We've also removed ACL settings for buckets and now apply bucket ownership controls instead via the stack control to align with the latest AWS recommendations. Please upgrade the @turbot/aws-s3 mod to v5.26.0 for the stack control to work reliably as before.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Policy Types

Renamed

• AWS > Turbot > Logging > Bucket > Default Encryption to AWS > Turbot > Logging > Bucket > Default Encryption [Deprecated]

What's new?

• Added support for aws_s3_bucket_ownership_controls Terraform resource for buckets.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

• Resource's metadata will now also include createdBy details in Turbot CMDB.

What's new?

• Users can now configure the Terraform version for the AWS > Config > Configuration Recording stack control. To get started, set the AWS > Config > Configuration Recording > Terraform Version policy. We recommend using versions 0.11, 0.12, or 0.15 for this control to create and manage resources effectively and reliably.

Policy Types

• AWS > Config > Configuration Recording > Terraform Version

What's new?

• New tables added
  • prismacloud_account
  • prismacloud_alert
  • prismacloud_alert_rule
  • prismacloud_compliance_breakdown_requirement_summary
  • prismacloud_compliance_breakdown_statistic
  • prismacloud_compliance_breakdown_summary
  • prismacloud_compliance_requirement
  • prismacloud_compliance_standard
  • prismacloud_iam_permission
  • prismacloud_iam_role
  • prismacloud_iam_user
  • prismacloud_inventory_api_endpoint
  • prismacloud_inventory_asset_explorer
  • prismacloud_inventory_asset_view
  • prismacloud_inventory_workload
  • prismacloud_inventory_workload_container_image
  • prismacloud_inventory_workload_host
  • prismacloud_permission_group
  • prismacloud_policy
  • prismacloud_prioritized_vulnerabilitiy
  • prismacloud_report
  • prismacloud_resource
  • prismacloud_trusted_alert_ip
  • prismacloud_vulnerabilitiy_asset
  • prismacloud_vulnerabilitiy_burndown
  • prismacloud_vulnerabilitiy_overview

What's new?

• New tables added
  • linode_firewall
  • linode_node_balancer

Enhancements

• The euuid column has now been assigned as a connection key column across all the tables which facilitates more precise and efficient querying across multiple Linode accounts. (#56)
• The Plugin and the Steampipe Anywhere binaries are now built with the netgo package. (#60)
• Added the version flag to the plugin's Export tool. (#65)

Dependencies

• Recompiled plugin with linode-sdk-for-go v1.37.0. (#56)
• Recompiled plugin with steampipe-plugin-sdk v5.10.1 which ensures that QueryData passed to ConnectionKeyColumns value callback is populated with ConnectionManager. (#55)

What's new?

• Users can now create and manage labels on Pub/Sub topics created via the GCP > Turbot > Event Handlers > Pub/Sub control. To get started, set the GCP > Turbot > Event Handlers > Pub/Sub > Topic > Labels policy.

Policy Types

• GCP > Turbot > Event Handlers > Pub/Sub > Subscription > Labels > Ignore Changes
• GCP > Turbot > Event Handlers > Pub/Sub > Topic > Labels
• GCP > Turbot > Event Handlers > Pub/Sub > Topic > Labels > Ignore Changes

Bug fixes

• Guardrails failed to cleanup deleted security group rules via the real-time ec2:RevokeSecurityGroupEgress and ec2:RevokeSecurityGroupIngress events. This issue is now fixed.

Bug fixes

• The AWS > Turbot > Event Handlers control did not correctly raise the real-time CreateTags and DeleteTags events for VPC security group rules. This issue is now fixed.

Bug fixes

• Fixed the okta_factor table to correctly return data instead of a nil pointer dereference error. (#137)
• Fixed the caching issue in the standalone plugin FDW extensions. (#480)

Enhancements

• Added the GetConfig in the github_repository_content table. (#445)

Bug fixes

• Fixed the caching issue in the standalone plugin FDW extensions. (#480)

Enhancements

• Added Reader and Data Access role assignment information to the docs/index.md file. (#811)

Bug fixes

• Fixed the azure_compute_virtual_machine table to correctly populate the guest_configuration_assignments column across all Azure environments. (#816)
• Fixed the azure_role_assignment table to correctly return the result while using any mode of plugin authentication. (#809)
• Fixed the paging issue in the azure_monitor_activity_log_event table. (#810)
• Fixed the caching issue in the standalone plugin FDW extensions. (#480)

Enhancements

• Added location_type column as an optional qual to the aws_ec2_instance_availability table and 6 new columns to the aws_ec2_instance_type table. (#2078)
• Updated docs for aws_appautoscaling_policy and aws_appautoscaling_target tables to add information on required quals. (#2247)
• Added the type column as an optional qual to the aws_auditmanager_control table. (#2254)

Bug fixes

• Fixed the GetConfig definition of the aws_auditmanager_control table to correctly return data instead of an error. (#2254)
• Fixed the aws_kms_key_rotation table to correctly return nil whenever an AccessDeniedException error is returned by the API. (#2253)
• Fixed the caching issue in the standalone plugin FDW extensions. (#480)

What's new?

• Users can now configure flow logging for subnetworks. To get started, set the GCP > Network > Subnetwork > Flow Log policy.

Control Types

• GCP > Network > Subnetwork > Flow Log

Policy Types

• GCP > Network > Subnetwork > Flow Log

Action Types

• GCP > Network > Subnetwork > Set Flow Log

What's new?

• We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

• Resource's metadata will now also include createdBy details in Turbot CMDB.

Resource Types

• Azure > Provider > Elastic
• Azure > Provider > Managed Identity

Control Types

• Azure > Provider > Elastic > CMDB
• Azure > Provider > Elastic > Discovery
• Azure > Provider > Elastic > Registered
• Azure > Provider > Managed Identity > CMDB
• Azure > Provider > Managed Identity > Discovery
• Azure > Provider > Managed Identity > Registered

Policy Types

• Azure > Provider > Elastic > CMDB
• Azure > Provider > Elastic > Registered
• Azure > Provider > Managed Identity > CMDB
• Azure > Provider > Managed Identity > Registered

Action Types

• Azure > Provider > Elastic > Set Registered
• Azure > Provider > Managed Identity > Set Registered

Bug fixes

• The variable command no longer fails if the .flowpipe directory in the user's home directory is not created yet. (#872).

What's new?

• We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

• Resource's metadata will now also include createdBy details in Turbot CMDB.

What's new?

• You can now disable inactive or unapproved service accounts via Guardrails. To get started, set the GCP > IAM > Service Account > Active or GCP > IAM > Service Account > Approved policy to Enforce: Disable inactive with <x> days warning or Enforce: Disable unapproved respectively.

Action Types

• GCP > IAM > Service Account > Disable

What's new?

• We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

• Resource's metadata will now also include createdBy details in Turbot CMDB.

What's new?

• We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

• Resource's metadata will now also include createdBy details in Turbot CMDB.

What's new?

• We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

• Resource's metadata will now also include createdBy details in Turbot CMDB.

What's new?

• We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

• Resource's metadata will now also include createdBy details in Turbot CMDB.

Bug fixes

• The AWS > ECR > Repository > CMDB control went into an error state for shared repositories upserted incorrectly in Guardrails CMDB. Shared repositories will now not be upserted under shared accounts or regions, but will only be upserted under their owner accounts and regions.

Bug fixes

• Guardrails failed to process the real-time event ec2:CreateReplaceRootVolumeTask for instances. This is now fixed.

Enhancements

• Added the following controls to the All Controls benchmark: (#176)
  • alloydb_instance_log_error_verbosity_database_flag_default_or_stricter
  • alloydb_instance_log_min_error_statement_database_flag_configured
  • alloydb_instance_log_min_messages_database_flag_error

Enhancements

• Added the following controls to the All Controls benchmark: (#274)
  • application_gateway_waf_uses_specified_mode
  • application_insights_block_log_ingestion_and_querying_from_public
  • log_analytics_workspace_block_log_ingestion_and_querying_from_public
  • log_analytics_workspace_block_non_azure_ingestion

Bug fixes

• Fixed the storage_account_block_public_access query to correctly check if the public_network_access column of the azure_storage_account table is correctly set to disabled or not as per the CIS documentation. (#277)

What's new?

• Added NIST 800-172 benchmark (powerpipe benchmark run aws_compliance.benchmark.nist_800_172). (#807)

Bug fixes

• Fixed sqs_queue_encrypted_at_rest query to ensure queues using SQS-SSE encryption at rest remain in an ok state instead of alarm. (#805) (Thanks @duncward for the contribution!)

v0.14.0 of the Terraform Provider for Pipes is now available.

Breaking Changes

• Functionality for resource resources/pipes_workspace_connection moved to manage connections at the workspace level. Previously, the resource used to manage attachment of connections to the workspace defined at the respective identity level. Please follow the migration guide for migrating your existing configuration into the new model.
• Resource resources/pipes_connection does not support management of user level connections in line with changes in Pipes.

What's new?

• Resource pipes_organization_connection
• Resource pipes_organization_connection_folder
• Resource pipes_organization_connection_folder_permission
• Resource pipes_organization_connection_permission
• Resource pipes_organization_integration
• Resource pipes_tenant_connection
• Resource pipes_tenant_connection_folder
• Resource pipes_tenant_connection_folder_permission
• Resource pipes_tenant_connection_permission
• Resource pipes_tenant_integration
• Resource pipes_user_integration
• Resource pipes_workspace_connection_folder
• Resource pipes_workspace_schema

Enhancements

• Resource resources/pipes_workspace_mod add support for storing attribute state_reason

v0.10.0 of the Pipes SDK Go is now available.

What's new?

• Intregation Management APIs for Tenants, Users, Organizations, UserWorkspaces and OrgWorkspaces.
• Tenant Connection Management APIs.
• Tenant Connection Folder Management APIs.
• User Connection Folder Management APIs.
• Organization Connection Management APIs.
• Organization Connection Folder Management APIs.
• Workspace Connection Management APIs.
• Workspace Connection Folder Management APIs.
• Permission Management APIs for Connections and ConnectionFolders.

Enhancements

• Add support for installing mods that are associated to integrations.
• Add support for setting search path prefix for a workspace.

What's new?

• Server

  • Made notifications faster by improving the query, which enhances the performance of the resource activity tab.

• UI

  • Fixed a bug where policy pack creation would fail if the AKA was not provided from the user interface.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• The Azure > Resource Group > ServiceNow > Configuration Item control would fail to fetch instance credentials internally and did not process the data correctly in ServiceNow. This issue has now been fixed.

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

Control Types

• GCP > Project > ServiceNow > Import Set

Policy Types

• GCP > Project > ServiceNow > Import Set
• GCP > Project > ServiceNow > Import Set > Archive Columns
• GCP > Project > ServiceNow > Import Set > Record
• GCP > Project > ServiceNow > Import Set > Table Name

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

What's new?

• Added support for Postgres versions 15.6 and 15.7.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to poll events from Azure Monitor and process them in Guardrails. You won't notice any difference, and things will continue to work smoothly as before.

What's new?

• AWS/DynamoDB/Admin, AWS/DynamoDB/Metadata and AWS/DynamoDB/Operator now include permissions for Resource Policy, Imports, Time to Live and Global Table Version.

Breaking changes

• Removed the following columns in gcp_cloudfunctions_function table to align with the new API response structure: (#612)
  • environment_variables
  • source_upload_url
  • version_id

What's new?

• Added the impersonate_access_token config argument to support plugin authentication by using a pre-generated temporary access token. (#621)

Enhancements

• Added 17 new columns to the gcp_cloudfunctions_function table. (#612)

Bug fixes

• Fixed the cache key issue in the SecretManager service client creation. (#624)

What's new?

Control Types

• Azure > Network > Network Security Group > ServiceNow > Import Set

Policy Types

• Azure > Network > Network Security Group > ServiceNow > Import Set
• Azure > Network > Network Security Group > ServiceNow > Import Set > Archive Columns
• Azure > Network > Network Security Group > ServiceNow > Import Set > Record
• Azure > Network > Network Security Group > ServiceNow > Import Set > Table Name

What's new?

Control Types

• Azure > Subscription > ServiceNow > Import Set

Policy Types

• Azure > Subscription > ServiceNow > Import Set
• Azure > Subscription > ServiceNow > Import Set > Archive Columns
• Azure > Subscription > ServiceNow > Import Set > Record
• Azure > Subscription > ServiceNow > Import Set > Table Name

What's new?

• Users can now enable/disable Table logging for Storage Accounts via Azure > Storage > Storage Account > Table > Logging control. To get started, set the Azure > Storage > Storage Account > Table > Logging policy.

Control Types

• Azure > Storage > Storage Account > Encryption at Rest
• Azure > Storage > Storage Account > Table
• Azure > Storage > Storage Account > Table > Logging

Policy Types

• Azure > Storage > Storage Account > Encryption at Rest
• Azure > Storage > Storage Account > Encryption at Rest > Customer Managed Key
• Azure > Storage > Storage Account > Table
• Azure > Storage > Storage Account > Table > Logging
• Azure > Storage > Storage Account > Table > Logging > Properties
• Azure > Storage > Storage Account > Table > Logging > Retention Days

Action Types

• Azure > Storage > Storage Account > Update Encryption at Rest

• Azure > Storage > Storage Account > Update Storage Account Table Logging

• The Storage Account CMDB data will now also include information about the account's table service properties.

• We've removed the dependency on listKeys permission for Azure > Storage Account > Container > Discovery to run its course to completion. This release includes breaking changes in the CMDB data for containers. We recommend updating your existing policy settings to refer to the updated attributes as mentioned below.

Renamed: isImmutableStorageWithVersioningEnabled to isImmutableStorageWithVersioning.enabled

Removed: preventEncryptionScopeOverride

Bug fixes

• The Azure > Storage > Storage Account > CMDB control would go into an error state while trying to fetch default Queue and Blob properties if Guardrails did not have permission to list the storage account keys. The control will now not attempt to fetch default Queue and Blob properties if Guardrails does not have the required access for listKeys, and will run its course to completion without going into an error state.

Bug fixes

• Improved error message for the AWS > S3 > Bucket > CMDB control if it would go into an error state due to insufficient permissions for the headBucket operation.

What's new?

• Server
  • Migrated from Node.js 18 to Node.js 20 for improved performance and security.
  • Updated the Mod Lambda architecture to ARM64 for better efficiency.
  • Added support for Node.js 20 in the Lambda runtime.

Bug fixes

• Server
  • Resolved an issue where the next tick timestamp was not being set for large commands

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• UI
  • Resolved deletion issue from UI for Policy Packs with latest Turbot Mod(5.45.0) and TE 5.45.0.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• Server
  • Minor internal improvements.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• Fixed the issue where the --arg flag was not working for control and query runs. (#439)
• Fixed data inconsistency issue in snapshot output when the same control was included in multiple benchmarks. (#436)

Import a tree of folders and projects as Pipes connections, control permissions for workspaces, and auto-create aggregators.

For more information, see the launch post or check out the docs.

You can now create connections at the custom tenant, organization or workspace level in Pipes, along with grouping of these within folders to allow easier sharing of related connections.

This is coupled with a fine-grained permissions model, allowing you to share connections & folders broadly across a custom tenant, or restrict access to specific organizations and/or their workspaces.

For more information, check out the docs:

• Tenant connections
• Org connections
• Workspace connections

Import a tree of management groups and subscriptions as Pipes connections, control permissions for workspaces, and auto-create aggregators.

For more information, see the launch post or check out the docs.

Import a tree of OUs and accounts as Pipes connections, control permissions for workspaces, and auto-create aggregators.

For more information, see the launch post or check out the docs.

What's new?

Control Types

• Kubernetes > CronJob > ServiceNow
• Kubernetes > CronJob > ServiceNow > Configuration Item
• Kubernetes > CronJob > ServiceNow > Table
• Kubernetes > DaemonSet > ServiceNow
• Kubernetes > DaemonSet > ServiceNow > Configuration Item
• Kubernetes > DaemonSet > ServiceNow > Table
• Kubernetes > Ingress > ServiceNow
• Kubernetes > Ingress > ServiceNow > Configuration Item
• Kubernetes > Ingress > ServiceNow > Table
• Kubernetes > Job > ServiceNow
• Kubernetes > Job > ServiceNow > Configuration Item
• Kubernetes > Job > ServiceNow > Table
• Kubernetes > Persistent Volume > ServiceNow
• Kubernetes > Persistent Volume > ServiceNow > Configuration Item
• Kubernetes > Persistent Volume > ServiceNow > Table
• Kubernetes > ReplicationController > ServiceNow
• Kubernetes > ReplicationController > ServiceNow > Configuration Item
• Kubernetes > ReplicationController > ServiceNow > Table
• Kubernetes > StatefulSet > ServiceNow
• Kubernetes > StatefulSet > ServiceNow > Configuration Item
• Kubernetes > StatefulSet > ServiceNow > Table

Policy Types

• Kubernetes > CronJob > ServiceNow
• Kubernetes > CronJob > ServiceNow > Configuration Item
• Kubernetes > CronJob > ServiceNow > Configuration Item > Record
• Kubernetes > CronJob > ServiceNow > Configuration Item > Table Definition
• Kubernetes > CronJob > ServiceNow > Table
• Kubernetes > CronJob > ServiceNow > Table > Definition
• Kubernetes > DaemonSet > ServiceNow
• Kubernetes > DaemonSet > ServiceNow > Configuration Item
• Kubernetes > DaemonSet > ServiceNow > Configuration Item > Record
• Kubernetes > DaemonSet > ServiceNow > Configuration Item > Table Definition
• Kubernetes > DaemonSet > ServiceNow > Table
• Kubernetes > DaemonSet > ServiceNow > Table > Definition
• Kubernetes > Ingress > ServiceNow
• Kubernetes > Ingress > ServiceNow > Configuration Item
• Kubernetes > Ingress > ServiceNow > Configuration Item > Record
• Kubernetes > Ingress > ServiceNow > Configuration Item > Table Definition
• Kubernetes > Ingress > ServiceNow > Table
• Kubernetes > Ingress > ServiceNow > Table > Definition
• Kubernetes > Job > ServiceNow
• Kubernetes > Job > ServiceNow > Configuration Item
• Kubernetes > Job > ServiceNow > Configuration Item > Record
• Kubernetes > Job > ServiceNow > Configuration Item > Table Definition
• Kubernetes > Job > ServiceNow > Table
• Kubernetes > Job > ServiceNow > Table > Definition
• Kubernetes > Persistent Volume > ServiceNow
• Kubernetes > Persistent Volume > ServiceNow > Configuration Item
• Kubernetes > Persistent Volume > ServiceNow > Configuration Item > Record
• Kubernetes > Persistent Volume > ServiceNow > Configuration Item > Table Definition
• Kubernetes > Persistent Volume > ServiceNow > Table
• Kubernetes > Persistent Volume > ServiceNow > Table > Definition
• Kubernetes > ReplicationController > ServiceNow
• Kubernetes > ReplicationController > ServiceNow > Configuration Item
• Kubernetes > ReplicationController > ServiceNow > Configuration Item > Record
• Kubernetes > ReplicationController > ServiceNow > Configuration Item > Table Definition
• Kubernetes > ReplicationController > ServiceNow > Table
• Kubernetes > ReplicationController > ServiceNow > Table > Definition
• Kubernetes > StatefulSet > ServiceNow
• Kubernetes > StatefulSet > ServiceNow > Configuration Item
• Kubernetes > StatefulSet > ServiceNow > Configuration Item > Record
• Kubernetes > StatefulSet > ServiceNow > Configuration Item > Table Definition
• Kubernetes > StatefulSet > ServiceNow > Table
• Kubernetes > StatefulSet > ServiceNow > Table > Definition

What's new?

Resource Types

• Kubernetes > CronJob
• Kubernetes > DaemonSet
• Kubernetes > Ingress
• Kubernetes > Job
• Kubernetes > Persistent Volume
• Kubernetes > ReplicationController
• Kubernetes > StatefulSet

Control Types

• Kubernetes > ConfigMap > Active
• Kubernetes > CronJob > Active
• Kubernetes > CronJob > Annotations
• Kubernetes > CronJob > Approved
• Kubernetes > CronJob > CMDB
• Kubernetes > CronJob > Labels
• Kubernetes > CronJob > Query
• Kubernetes > DaemonSet > Active
• Kubernetes > DaemonSet > Annotations
• Kubernetes > DaemonSet > Approved
• Kubernetes > DaemonSet > CMDB
• Kubernetes > DaemonSet > Labels
• Kubernetes > DaemonSet > Query
• Kubernetes > Deployment > Active
• Kubernetes > Ingress > Active
• Kubernetes > Ingress > Annotations
• Kubernetes > Ingress > Approved
• Kubernetes > Ingress > CMDB
• Kubernetes > Ingress > Labels
• Kubernetes > Ingress > Query
• Kubernetes > Job > Active
• Kubernetes > Job > Annotations
• Kubernetes > Job > Approved
• Kubernetes > Job > CMDB
• Kubernetes > Job > Labels
• Kubernetes > Job > Query
• Kubernetes > Namespace > Active
• Kubernetes > Node > Active
• Kubernetes > Persistent Volume > Active
• Kubernetes > Persistent Volume > Annotations
• Kubernetes > Persistent Volume > Approved
• Kubernetes > Persistent Volume > CMDB
• Kubernetes > Persistent Volume > Labels
• Kubernetes > Persistent Volume > Query
• Kubernetes > Pod > Active
• Kubernetes > ReplicaSet > Active
• Kubernetes > ReplicationController > Active
• Kubernetes > ReplicationController > Annotations
• Kubernetes > ReplicationController > Approved
• Kubernetes > ReplicationController > CMDB
• Kubernetes > ReplicationController > Labels
• Kubernetes > ReplicationController > Query
• Kubernetes > Service > Active
• Kubernetes > StatefulSet > Active
• Kubernetes > StatefulSet > Annotations
• Kubernetes > StatefulSet > Approved
• Kubernetes > StatefulSet > CMDB
• Kubernetes > StatefulSet > Labels
• Kubernetes > StatefulSet > Query

Policy Types

• Kubernetes > Cluster > CMDB > Expiration
• Kubernetes > Cluster > CMDB > Expiration > Expiration Days
• Kubernetes > Cluster > osquery
• Kubernetes > Cluster > osquery > Configuration
• Kubernetes > ConfigMap > Active
• Kubernetes > ConfigMap > Active > Age
• Kubernetes > ConfigMap > Active > Last Modified
• Kubernetes > CronJob > Active
• Kubernetes > CronJob > Active > Age
• Kubernetes > CronJob > Active > Last Modified
• Kubernetes > CronJob > Annotations
• Kubernetes > CronJob > Annotations > Template
• Kubernetes > CronJob > Approved
• Kubernetes > CronJob > Approved > Custom
• Kubernetes > CronJob > CMDB
• Kubernetes > CronJob > Labels
• Kubernetes > CronJob > Labels > Template
• Kubernetes > CronJob > osquery
• Kubernetes > CronJob > osquery > Configuration
• Kubernetes > CronJob > osquery > Configuration > Columns
• Kubernetes > CronJob > osquery > Configuration > Interval
• Kubernetes > CronJob > osquery > Configuration > Name
• Kubernetes > DaemonSet > Active
• Kubernetes > DaemonSet > Active > Age
• Kubernetes > DaemonSet > Active > Last Modified
• Kubernetes > DaemonSet > Annotations
• Kubernetes > DaemonSet > Annotations > Template
• Kubernetes > DaemonSet > Approved
• Kubernetes > DaemonSet > Approved > Custom
• Kubernetes > DaemonSet > CMDB
• Kubernetes > DaemonSet > Labels
• Kubernetes > DaemonSet > Labels > Template
• Kubernetes > DaemonSet > osquery
• Kubernetes > DaemonSet > osquery > Configuration
• Kubernetes > DaemonSet > osquery > Configuration > Columns
• Kubernetes > DaemonSet > osquery > Configuration > Interval
• Kubernetes > DaemonSet > osquery > Configuration > Name
• Kubernetes > Deployment > Active
• Kubernetes > Deployment > Active > Age
• Kubernetes > Deployment > Active > Last Modified
• Kubernetes > Ingress > Active
• Kubernetes > Ingress > Active > Age
• Kubernetes > Ingress > Active > Last Modified
• Kubernetes > Ingress > Annotations
• Kubernetes > Ingress > Annotations > Template
• Kubernetes > Ingress > Approved
• Kubernetes > Ingress > Approved > Custom
• Kubernetes > Ingress > CMDB
• Kubernetes > Ingress > Labels
• Kubernetes > Ingress > Labels > Template
• Kubernetes > Ingress > osquery
• Kubernetes > Ingress > osquery > Configuration
• Kubernetes > Ingress > osquery > Configuration > Columns
• Kubernetes > Ingress > osquery > Configuration > Interval
• Kubernetes > Ingress > osquery > Configuration > Name
• Kubernetes > Job > Active
• Kubernetes > Job > Active > Age
• Kubernetes > Job > Active > Last Modified
• Kubernetes > Job > Annotations
• Kubernetes > Job > Annotations > Template
• Kubernetes > Job > Approved
• Kubernetes > Job > Approved > Custom
• Kubernetes > Job > CMDB
• Kubernetes > Job > Labels
• Kubernetes > Job > Labels > Template
• Kubernetes > Job > osquery
• Kubernetes > Job > osquery > Configuration
• Kubernetes > Job > osquery > Configuration > Columns
• Kubernetes > Job > osquery > Configuration > Interval
• Kubernetes > Job > osquery > Configuration > Name
• Kubernetes > Namespace > Active
• Kubernetes > Namespace > Active > Age
• Kubernetes > Namespace > Active > Last Modified
• Kubernetes > Node > Active
• Kubernetes > Node > Active > Age
• Kubernetes > Node > Active > Last Modified
• Kubernetes > Persistent Volume > Active
• Kubernetes > Persistent Volume > Active > Age
• Kubernetes > Persistent Volume > Active > Last Modified
• Kubernetes > Persistent Volume > Annotations
• Kubernetes > Persistent Volume > Annotations > Template
• Kubernetes > Persistent Volume > Approved
• Kubernetes > Persistent Volume > Approved > Custom
• Kubernetes > Persistent Volume > CMDB
• Kubernetes > Persistent Volume > Labels
• Kubernetes > Persistent Volume > Labels > Template
• Kubernetes > Persistent Volume > osquery
• Kubernetes > Persistent Volume > osquery > Configuration
• Kubernetes > Persistent Volume > osquery > Configuration > Columns
• Kubernetes > Persistent Volume > osquery > Configuration > Interval
• Kubernetes > Persistent Volume > osquery > Configuration > Name
• Kubernetes > Pod > Active
• Kubernetes > Pod > Active > Age
• Kubernetes > Pod > Active > Last Modified
• Kubernetes > ReplicaSet > Active
• Kubernetes > ReplicaSet > Active > Age
• Kubernetes > ReplicaSet > Active > Last Modified
• Kubernetes > ReplicationController > Active
• Kubernetes > ReplicationController > Active > Age
• Kubernetes > ReplicationController > Active > Last Modified
• Kubernetes > ReplicationController > Annotations
• Kubernetes > ReplicationController > Annotations > Template
• Kubernetes > ReplicationController > Approved
• Kubernetes > ReplicationController > Approved > Custom
• Kubernetes > ReplicationController > CMDB
• Kubernetes > ReplicationController > Labels
• Kubernetes > ReplicationController > Labels > Template
• Kubernetes > ReplicationController > osquery
• Kubernetes > ReplicationController > osquery > Configuration
• Kubernetes > ReplicationController > osquery > Configuration > Columns
• Kubernetes > ReplicationController > osquery > Configuration > Interval
• Kubernetes > ReplicationController > osquery > Configuration > Name
• Kubernetes > Service > Active
• Kubernetes > Service > Active > Age
• Kubernetes > Service > Active > Last Modified
• Kubernetes > StatefulSet > Active
• Kubernetes > StatefulSet > Active > Age
• Kubernetes > StatefulSet > Active > Last Modified
• Kubernetes > StatefulSet > Annotations
• Kubernetes > StatefulSet > Annotations > Template
• Kubernetes > StatefulSet > Approved
• Kubernetes > StatefulSet > Approved > Custom
• Kubernetes > StatefulSet > CMDB
• Kubernetes > StatefulSet > Labels
• Kubernetes > StatefulSet > Labels > Template
• Kubernetes > StatefulSet > osquery
• Kubernetes > StatefulSet > osquery > Configuration
• Kubernetes > StatefulSet > osquery > Configuration > Columns
• Kubernetes > StatefulSet > osquery > Configuration > Interval
• Kubernetes > StatefulSet > osquery > Configuration > Name

Action Types

• Kubernetes > Cluster > Router
• Kubernetes > CronJob > Router
• Kubernetes > DaemonSet > Router
• Kubernetes > Ingress > Router
• Kubernetes > Job > Router
• Kubernetes > Persistent Volume > Router
• Kubernetes > ReplicationController > Router
• Kubernetes > StatefulSet > Router

Bug fixes

• CMDB controls for various resources sometimes failed to process a large number of updates that occurred in quick succession via Cluster events. We’ve improved our GraphQL queries to handle such a load, and the controls will now be able to process such events more smoothly and reliably than before.

What's new?

• The AWS > S3 > Bucket > CMDB control would go into an error state if Guardrails did not have permissions to call the headBucket operation on a bucket. Users can now ignore such permission errors and allow the CMDB control to run its course to completion. To get started, set the AWS > S3 > Bucket > CMDB policy to Enforce: Enabled but ignore permission errors.

Bug fixes

• Server
  • Minor internal improvements.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• In the previous version, we fixed an issue with the Azure > App Service > Web App > Client Certificate Mode control, ensuring that the Client Certificate Mode is set to Require correctly. However, we missed an edge case where the control wouldn’t enforce any mode other than the default setting of Ignore. We have now addressed all cases, and the control will work more reliably and consistently than before.

What's new?

• Interactive workflows in the terminal via console integration. Blog.
• Simplified progress output for flowpipe pipeline run command when running in Client mode and not using the --verbose arg.
• --data-dir parameter to specify the location of the event store database. (#852).
• --execution-id parameter to specify custom execution id for pipeline run. (#856).
• Update Go version to v1.22.4.

Bug fixes

• Return a non-zero exit code if there's a failure. (#855).
• loop block now respect the if step attribute. (#858).

What's new?

• Added 22 detect and correct pipelines to identify unused and underutilized GCP resources, as well as deprecated resource configurations. These pipelines also suggest potential remediation actions to optimize costs. For usage information and a full list of pipelines, please see GCP Thrifty Mod.

What's new?

• Detect and correct misconfigured labels across 8 GCP resource types.
• Automatically add mandatory labels (e.g. env, owner).
• Clean up prohibited labels (e.g. secret, key).
• Reconcile shorthand or misspelled label keys to standardized keys (e.g. cc to cost_center).
• Update label values to conform to expected standards, ensuring consistency (e.g. Prod to prod).

For detailed usage information and a full list of pipelines, please see GCP Labels Mod.

What's new?

• Added 24 detect and correct pipelines to identify unused and underutilized Azure resources, as well as deprecated resource configurations. These pipelines also suggest potential remediation actions to optimize costs. For usage information and a full list of pipelines, please see Azure Thrifty Mod.

What's new?

• Detect and correct misconfigured tags across 55+ Azure resource types.
• Automatically add mandatory tags (e.g. env, owner).
• Clean up prohibited tags (e.g. secret, key).
• Reconcile shorthand or misspelled tag keys to standardized keys (e.g. cc to cost_center).
• Update tag values to conform to expected standards, ensuring consistency (e.g. Prod to prod).

For detailed usage information and a full list of pipelines, please see Azure Tags Mod.

What's new?

• The mod has been updated to run in the Wizard mode by default.

What's new?

• Detect and correct misconfigured tags across 65+ AWS resource types.
• Automatically add mandatory tags (e.g. env, owner).
• Clean up prohibited tags (e.g. secret, key).
• Reconcile shorthand or misspelled tag keys to standardized keys (e.g. cc to cost_center).
• Update tag values to conform to expected standards, ensuring consistency (e.g. Prod to prod).

For detailed usage information and a full list of pipelines, please see AWS Tags Mod.

What's new?

• Updated AWS Lambda function architecture to ARM64 for improved performance and cost efficiency.

What's new?

• Server

  • Improved memory optimization for Redis.
  • Updated all AWS Lambda functions in the TE environment to use ARM64 architecture for improved performance and cost efficiency.
  • Allow notifications rules to accept nunjucks for Email address.
  • Updated several node packages to newer versions for improved functionality and security.

• UI

  • Smart Folders are now called Policy Packs.
  • Now you can add AKA while creating Policy Packs from UI.

Bug fixes

• Server

  • Fixed an issue where controls remained in TBD state for accounts imported without an External ID.

• UI

  • Removed the unsupported feature for rearranging Policy Packs from the UI.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• The Import Set policies for various Kubernetes resources will no longer include the Enforce: Sync policy value for integrating Import Sets in ServiceNow.

Control Types

• GCP > Storage > Object > ServiceNow > Import Set

Policy Types

• GCP > Storage > Object > ServiceNow > Import Set
• GCP > Storage > Object > ServiceNow > Import Set > Archive Columns
• GCP > Storage > Object > ServiceNow > Import Set > Record
• GCP > Storage > Object > ServiceNow > Import Set > Table Name

Control Types

• GCP > Compute Engine > Disk > ServiceNow > Import Set
• GCP > Compute Engine > HTTP Health Check > ServiceNow > Import Set
• GCP > Compute Engine > HTTPS Health Check > ServiceNow > Import Set
• GCP > Compute Engine > Health Check > ServiceNow > Import Set
• GCP > Compute Engine > Image > ServiceNow > Import Set
• GCP > Compute Engine > Instance > ServiceNow > Import Set
• GCP > Compute Engine > Instance Template > ServiceNow > Import Set
• GCP > Compute Engine > Node Group > ServiceNow > Import Set
• GCP > Compute Engine > Node template > ServiceNow > Import Set
• GCP > Compute Engine > Project > ServiceNow > Import Set
• GCP > Compute Engine > Region Disk > ServiceNow > Import Set
• GCP > Compute Engine > Region Health Check > ServiceNow > Import Set
• GCP > Compute Engine > Snapshot > ServiceNow > Import Set

Policy Types

• GCP > Compute Engine > Disk > ServiceNow > Import Set
• GCP > Compute Engine > Disk > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Disk > ServiceNow > Import Set > Record
• GCP > Compute Engine > Disk > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > HTTP Health Check > ServiceNow > Import Set
• GCP > Compute Engine > HTTP Health Check > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > HTTP Health Check > ServiceNow > Import Set > Record
• GCP > Compute Engine > HTTP Health Check > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > HTTPS Health Check > ServiceNow > Import Set
• GCP > Compute Engine > HTTPS Health Check > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > HTTPS Health Check > ServiceNow > Import Set > Record
• GCP > Compute Engine > HTTPS Health Check > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Health Check > ServiceNow > Import Set
• GCP > Compute Engine > Health Check > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Health Check > ServiceNow > Import Set > Record
• GCP > Compute Engine > Health Check > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Image > ServiceNow > Import Set
• GCP > Compute Engine > Image > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Image > ServiceNow > Import Set > Record
• GCP > Compute Engine > Image > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Instance > ServiceNow > Import Set
• GCP > Compute Engine > Instance > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Instance > ServiceNow > Import Set > Record
• GCP > Compute Engine > Instance > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Instance Template > ServiceNow > Import Set
• GCP > Compute Engine > Instance Template > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Instance Template > ServiceNow > Import Set > Record
• GCP > Compute Engine > Instance Template > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Node Group > ServiceNow > Import Set
• GCP > Compute Engine > Node Group > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Node Group > ServiceNow > Import Set > Record
• GCP > Compute Engine > Node Group > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Node template > ServiceNow > Import Set
• GCP > Compute Engine > Node template > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Node template > ServiceNow > Import Set > Record
• GCP > Compute Engine > Node template > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Project > ServiceNow > Import Set
• GCP > Compute Engine > Project > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Project > ServiceNow > Import Set > Record
• GCP > Compute Engine > Project > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Region Disk > ServiceNow > Import Set
• GCP > Compute Engine > Region Disk > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Region Disk > ServiceNow > Import Set > Record
• GCP > Compute Engine > Region Disk > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Region Health Check > ServiceNow > Import Set
• GCP > Compute Engine > Region Health Check > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Region Health Check > ServiceNow > Import Set > Record
• GCP > Compute Engine > Region Health Check > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Snapshot > ServiceNow > Import Set
• GCP > Compute Engine > Snapshot > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Snapshot > ServiceNow > Import Set > Record
• GCP > Compute Engine > Snapshot > ServiceNow > Import Set > Table Name

Control Types

• Azure > Storage > Container > ServiceNow > Import Set
• Azure > Storage > FileShare > ServiceNow > Import Set
• Azure > Storage > Queue > ServiceNow > Import Set

Policy Types

• Azure > Storage > Container > ServiceNow > Import Set
• Azure > Storage > Container > ServiceNow > Import Set > Archive Columns
• Azure > Storage > Container > ServiceNow > Import Set > Record
• Azure > Storage > Container > ServiceNow > Import Set > Table Name
• Azure > Storage > FileShare > ServiceNow > Import Set
• Azure > Storage > FileShare > ServiceNow > Import Set > Archive Columns
• Azure > Storage > FileShare > ServiceNow > Import Set > Record
• Azure > Storage > FileShare > ServiceNow > Import Set > Table Name
• Azure > Storage > Queue > ServiceNow > Import Set
• Azure > Storage > Queue > ServiceNow > Import Set > Archive Columns
• Azure > Storage > Queue > ServiceNow > Import Set > Record
• Azure > Storage > Queue > ServiceNow > Import Set > Table Name

Control Types

• Azure > Compute > Availability Set > ServiceNow > Import Set
• Azure > Compute > Disk > ServiceNow > Import Set
• Azure > Compute > Disk Encryption Set > ServiceNow > Import Set
• Azure > Compute > Image > ServiceNow > Import Set
• Azure > Compute > Snapshot > ServiceNow > Import Set
• Azure > Compute > Ssh Public Key > ServiceNow > Import Set
• Azure > Compute > Virtual Machine > ServiceNow > Import Set
• Azure > Compute > Virtual Machine Scale Set > ServiceNow > Import Set

Policy Types

• Azure > Compute > Availability Set > ServiceNow > Import Set
• Azure > Compute > Availability Set > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Availability Set > ServiceNow > Import Set > Record
• Azure > Compute > Availability Set > ServiceNow > Import Set > Table Name
• Azure > Compute > Disk > ServiceNow > Import Set
• Azure > Compute > Disk > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Disk > ServiceNow > Import Set > Record
• Azure > Compute > Disk > ServiceNow > Import Set > Table Name
• Azure > Compute > Disk Encryption Set > ServiceNow > Import Set
• Azure > Compute > Disk Encryption Set > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Disk Encryption Set > ServiceNow > Import Set > Record
• Azure > Compute > Disk Encryption Set > ServiceNow > Import Set > Table Name
• Azure > Compute > Image > ServiceNow > Import Set
• Azure > Compute > Image > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Image > ServiceNow > Import Set > Record
• Azure > Compute > Image > ServiceNow > Import Set > Table Name
• Azure > Compute > Snapshot > ServiceNow > Import Set
• Azure > Compute > Snapshot > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Snapshot > ServiceNow > Import Set > Record
• Azure > Compute > Snapshot > ServiceNow > Import Set > Table Name
• Azure > Compute > Ssh Public Key > ServiceNow > Import Set
• Azure > Compute > Ssh Public Key > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Ssh Public Key > ServiceNow > Import Set > Record
• Azure > Compute > Ssh Public Key > ServiceNow > Import Set > Table Name
• Azure > Compute > Virtual Machine > ServiceNow > Import Set
• Azure > Compute > Virtual Machine > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Virtual Machine > ServiceNow > Import Set > Record
• Azure > Compute > Virtual Machine > ServiceNow > Import Set > Table Name
• Azure > Compute > Virtual Machine Scale Set > ServiceNow > Import Set
• Azure > Compute > Virtual Machine Scale Set > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Virtual Machine Scale Set > ServiceNow > Import Set > Record
• Azure > Compute > Virtual Machine Scale Set > ServiceNow > Import Set > Table Name

Control Types

• AWS > S3 > Bucket > ServiceNow > Import Set

Policy Types

• AWS > S3 > Bucket > ServiceNow > Import Set
• AWS > S3 > Bucket > ServiceNow > Import Set > Archive Columns
• AWS > S3 > Bucket > ServiceNow > Import Set > Record
• AWS > S3 > Bucket > ServiceNow > Import Set > Table Name

What's new?

• Added support to archive Import Sets in ServiceNow.

Enhancements

• Added column create_time to gcp_sql_database_instance table. (#615)

Bug fixes

• Fixed the gcp_alloydb_cluster and gcp_alloydb_instance tables to correctly return values for project column instead of null. (#617)

What's new?

• New tables added
  • azure_resource (#803)

Bug fixes

• Fixed the power_state column of the azure_compute_virtual_machine table to correctly return data instead of a nil pointer dereference error. (#804)

Bug fixes

• The Azure > App Service > Web App > Client Certificate Mode control did not apply Enforce: Require settings correctly. This is now fixed.

What's new?

• Added support for google_monitoring_alert_policy and google_monitoring_notification_channel Terraform resources.

Control Types

• GCP > Monitoring > Alert Policy > Configured
• GCP > Monitoring > Notification Channel > Configured

Policy Types

• GCP > Monitoring > Alert Policy > Configured
• GCP > Monitoring > Alert Policy > Configured > Claim Precedence
• GCP > Monitoring > Alert Policy > Configured > Source
• GCP > Monitoring > Notification Channel > Configured
• GCP > Monitoring > Notification Channel > Configured > Claim Precedence
• GCP > Monitoring > Notification Channel > Configured > Source

What's new?

• Added support for google_logging_metric Terraform resource.

Control Types

• GCP > Logging > Metric > Configured

Policy Types

• GCP > Logging > Metric > Configured
• GCP > Logging > Metric > Configured > Claim Precedence
• GCP > Logging > Metric > Configured > Source

Bug fixes

• The Azure > Storage > Storage Account > Queue > Logging control failed to set queue logging properties correctly. This issue has been fixed, and the control will now function correctly as intended.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• Fixed plugin loading issues by eliminating the need for manual caching, ensuring smoother and more reliable plugin installations. (#50)

What's new?

• Added the insecure_skip_verify connection config argument to support bypassing the SSL/TLS certificate verification while querying the tables. (#48)

Enhancements

• The Plugin and the Steampipe Anywhere binaries are now built with the netgo package.

Dependencies

• Recompiled plugin with steampipe-plugin-sdk v5.10.1 that adds support for connection key columns. (#49)

Bug fixes

• Fixed issue where local Docker config for the credential store was used when installing plugins from GHCR, enabling installation from GHCR to work even if docker-credential-desktop is not in PATH. (#4323)
• Fixed issue where Steampipe returned a 0 exit code even if it failed to export a snapshot. (#4276)
• Fixed issue where the query command did not support the legacy 'true' and 'false' values for the --timing flag. (#4282)
• Fixed issue where SPS output was not working. (#4297)
• Fixed issue where loading connection plugins did not return successfully created connections if some connections failed due to the configuration not being available. (#474)
• Fixed issue where scan info in query JSON output was shown even when the timing configuration was not set to verbose. (#4292)

What's new?

• Users can now configure Shielded Instance Configuration for instances. To get started, set GCP > Compute > Instance > Shielded Instance Configuration > * policies.

Control Types

• GCP > Compute Engine > Instance > Shielded Instance Configuration

Policy Types

• GCP > Compute Engine > Instance > Shielded Instance Configuration
• GCP > Compute Engine > Instance > Shielded Instance Configuration > Integrity Monitoring
• GCP > Compute Engine > Instance > Shielded Instance Configuration > Secure Boot
• GCP > Compute Engine > Instance > Shielded Instance Configuration > vTPM

Action Types

• GCP > Compute Engine > Instance > Set Shielded Instance Configuration

What's new?

• The Azure > CIS v2.0 > 5.05 - Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads) control will also evaluate SQL databases for SKU Basic/Consumption.

Control Types

• Azure > CIS v2.0 > 05 - Logging and Monitoring > 5.01 - Configuring Diagnostic Settings > 5.01.06 - Ensure that Network Security Group Flow logs are captured and sent to Log Analytics

Policy Types

• Azure > CIS v2.0 > 05 - Logging and Monitoring > 5.01 - Configuring Diagnostic Settings > 5.01.06 - Ensure that Network Security Group flow logs are captured and sent to Log Analytics

Bug fixes

• The Azure > CIS v2.0 > 4 - Database Services > 01.03 - Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key control did not evaluate the result correctly, as expected. This is now fixed.

The CrowdStrike plugin is now available in all Pipes workspaces.

To get started, create a connection and add it to your workspace.

What's new?

DOCUMENTATION:

• resource/turbot_policy_pack: Added documentation for akas attribute for the resource. (#179)

What's new?

• Users can now configure Encryption In Transit for instances. To get started, set the GCP > SQL > Instance > Encryption In Transit policy.

Control Types

• GCP > SQL > Instance > Encryption In Transit

Policy Types

• GCP > SQL > Instance > Encryption In Transit

Action Types

• GCP > SQL > Instance > Update Encryption in Transit

What's new?

Control Types

• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.12 - Ensure API Keys Only Exist for Active Services
• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.13 - Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps
• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.14 - Ensure API Keys Are Restricted to Only APIs That Application Needs Access
• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.15 - Ensure API Keys Are Rotated Every 90 Days

Policy Types

• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.12 - Ensure API Keys Only Exist for Active Services
• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.13 - Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps
• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.14 - Ensure API Keys Are Restricted to Only APIs That Application Needs Access
• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.15 - Ensure API Keys Are Rotated Every 90 Days

What's new?

• Users can now upgrade the SKU from Basic to Standard for Public IP Addresss via Azure > Network > Public IP Address > Standard SKU control. To get started, set the Azure > Network > Public IP Address > Standard SKU policy.

Control Types

• Azure > Network > Public IP Address > Standard SKU

Policy Types

• Azure > Network > Public IP Address > Standard SKU
• Azure > Network > Public IP Address > Standard SKU > SKU Tier

Action Types

• Azure > Network > Public IP Address > Update SKU to Standard

What's new?

• We've added guardrails to help secure access to your database accounts' public endpoints. All database accounts have public endpoints that are accessible through the internet by default. This access can be limited to specific IP ranges, virtual network subnets, and trusted Microsoft services by defining firewall and virtual network rules.

To get started configuring these rules through Guardrails, the following policies should set according to your desired firewall rules configuration:

Azure > Cosmos DB > Database Account > Firewall - Configure default access rules for the public endpoint Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Approved - Remove unapproved IP ranges Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required - Grant access to specific IP ranges Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Approved - Remove unapproved virtual network subnets Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required - Grant access to specific virtual network subnets Please note that if the Azure > Cosmos DB > Database Account > Firewall policy is set to Enforce: Allow only approved virtual networks and IP ranges, only applications in the configured IP ranges, virtual network subnets, and trusted Microsoft services will be allowed to access the database accounts. If these boundaries are not properly configured beforehand or an application is outside of these boundaries, it will lose access to the database accounts.

Control Types

• Azure > Cosmos DB > Database Account > Firewall
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Approved
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Approved
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required

Policy Types

• Azure > Cosmos DB > Database Account > Firewall
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Approved
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Approved > CIDR Ranges
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Approved > Compiled Rules
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Approved > Rules
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required > Compiled Items
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required > Exceptions
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required > Items
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Approved
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Approved > Compiled Rules
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Approved > Rules
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Approved > Subnets
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required > Items

Action Types

• Azure > Cosmos DB > Database Account > Update Firewall Default Access Rule
• Azure > Cosmos DB > Database Account > Update Firewall IP Ranges
• Azure > Cosmos DB > Database Account > Update Firewall Virtual Networks

Bug fixes

• Various Discovery and CMDB controls entered an error state because they used outdated APIs that no longer functioned as expected. We have updated internal package dependencies, and those controls now operate smoothly as intended.

Bug fixes

• Resolved an issue where an empty outbound_cidr_ranges SSM parameter caused a validation error. Now, if the outbound_cidr_ranges parameter is empty, it will be set to None.

What's new?

• Added M7i and M7i-flex instance type.
• Updated the HealthCheckProxy lambda function to use python 3.10.

Bug fixes

• The GCP > Project > CMDB control went into an error state while fetching Access Approval settings for the project if Access Transparency was disabled at the organization level. We have now handled such cases gracefully, and the control will fetch all available details without going into an error state.

What's new?

• Users can now configure authorized networks for instances in Guardrails. To get started, set the GCP > SQL > Instance > Authorized Network > * policies.
• Users can now configure Database Flags for instances in Guardrails. To get started, set the GCP > SQL > Instance > Database Flags policy.
• Users can now clean up and stop tracking SQL resources in Guardrails. To get started, set the GCP > SQL > CMDB policy to Enforce: Disabled.

Control Types

• GCP > SQL > Instance > Authorized Network
• GCP > SQL > Instance > Authorized Network > Approved
• GCP > SQL > Instance > Database Flags

Policy Types

• GCP > SQL > Instance > Authorized Network
• GCP > SQL > Instance > Authorized Network > Approved
• GCP > SQL > Instance > Authorized Network > Approved > CIDR Ranges
• GCP > SQL > Instance > Database Flags
• GCP > SQL > Instance > Database Flags > MySQL
• GCP > SQL > Instance > Database Flags > MySQL > Template
• GCP > SQL > Instance > Database Flags > PostgreSQL
• GCP > SQL > Instance > Database Flags > PostgreSQL > Template
• GCP > SQL > Instance > Database Flags > SQL Server
• GCP > SQL > Instance > Database Flags > SQL Server > Template

Action Types

• GCP > SQL > Instance > Update Authorized Network
• GCP > SQL > Instance > Update Database Flags

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Storage resources in Guardrails. This release includes breaking changes in the CMDB data for storage accounts. We recommend updating your existing policy settings to refer to the updated attributes as mentioned below.

  Renamed:

  • serviceProperties.blob.DeleteRetentionPolicy to serviceProperties.blob.deleteRetentionPolicy
  • serviceProperties.blob.DeleteRetentionPolicy.Days to serviceProperties.blob.deleteRetentionPolicy.days
  • serviceProperties.blob.DeleteRetentionPolicy.Enabled to serviceProperties.blob.deleteRetentionPolicy.enabled
  • serviceProperties.blob.StaticWebsite to serviceProperties.blob.staticWebsite
  • serviceProperties.blob.StaticWebsite.Enabled to serviceProperties.blob.staticWebsite.enabled
  • serviceProperties.blob.logging to serviceProperties.blob.blobAnalyticsLogging
  • serviceProperties.queue.logging to serviceProperties.queue.queueAnalyticsLogging

  Added:

  • serviceProperties.blob.deleteRetentionPolicy.AllowPermanentDelete

  Modified:

  • The data type of the attribute serviceProperties.blob.cors has been changed from string ("") to array ([]).
  • The data type of the attribute serviceProperties.queue.cors has been changed from string ("") to array ([]).

• Users can now enable/disable Blob logging for storage accounts. To get started, set the Azure > Storage > Storage Account > Blob > Logging > * policies.

• Users can now check if storage accounts are approved for use based on Infrastructure Encryption settings. To get started, set the Azure > Storage > Storage Account > Approved > Infrastructure Encryption policy.

Control Types

• Azure > Storage > Storage Account > Blob
• Azure > Storage > Storage Account > Blob > Logging

Renamed

• Azure > Storage > Storage Account > Public Access to Azure > Storage > Storage Account > Blob Public Access

Policy Types

• Azure > Storage > Storage Account > Approved > Infrastructure Encryption
• Azure > Storage > Storage Account > Blob
• Azure > Storage > Storage Account > Blob > Logging
• Azure > Storage > Storage Account > Blob > Logging > Properties
• Azure > Storage > Storage Account > Blob > Logging > Retention Days

Renamed

• Azure > Storage > Storage Account > Public Access to Azure > Storage > Storage Account > Blob Public Access

Action Types

• Azure > Storage > Storage Account > Update Storage Account Blob Logging

Renamed

• Azure > Storage > Storage Account > Set Public Access to Azure > Storage > Storage Account > Set Blob Public Access

What's new?

• Users can now configure Client Certificate Mode for web apps. To get started, set the Azure > App Service > Web App > Client Certificate Mode policy.

Control Types

• Azure > App Service > Web App > Client Certificate Mode

Policy Types

• Azure > App Service > Web App > Client Certificate Mode

Action Types

• Azure > App Service > Web App > Set Client Certificate Mode

What's new?

• New tables added
  • okta_device (#50)

Enhancements

• The domain column has now been assigned as a connection key column across all the tables which facilitates more precise and efficient querying across multiple Okta organizations. (#120)
• Added support to specify the time period in .spc file for max retries, request timeout, and max backoff time as required. (#112)
• Added profile column to the okta_factor table. (#130)

Dependencies

• Recompiled plugin with steampipe-plugin-sdk v5.10.1 which ensures that QueryData passed to ConnectionKeyColumns value callback is populated with ConnectionManager. (#120)

Enhancements

• The organization_id column has now been assigned as a connection key column across all the tables which facilitates more precise and efficient querying across multiple Linear accounts. (#34)

Bug fixes

• Fixed the plugin to correctly check for a valid Personal Access token. (#33)

Dependencies

• Recompiled plugin with steampipe-plugin-sdk v5.10.1 which ensures that QueryData passed to ConnectionKeyColumns value callback is populated with ConnectionManager. (#34)

Enhancements

• Added column power_state to the azure_compute_virtual_machine_scale_set_vm table. (#800) (Thanks @pdepdecatcat for the contribution!)

Bug fixes

• Fixed the azure_log_alert table to correctly return values for actions, condition, description, enabled, and scopes columns instead of null. (#796)

What's new?

FEATURES:

• New Resource: turbot_policy_pack (#171)
• New Resource: turbot_policy_pack_attachment (#173)

ENHANCEMENTS:

• resource/turbot_smart_folder: The parent argument is now optional and defaults to tmod:@turbot/turbot#/. (#177)

What's new?

Resource Types

• GCP > IAM > API Key

Control Types

• GCP > IAM > API Key > Active
• GCP > IAM > API Key > Approved
• GCP > IAM > API Key > CMDB
• GCP > IAM > API Key > Discovery
• GCP > IAM > API Key > Usage

Policy Types

• GCP > IAM > API Key > Active
• GCP > IAM > API Key > Active > Age
• GCP > IAM > API Key > Active > Last Modified
• GCP > IAM > API Key > Approved
• GCP > IAM > API Key > Approved > Custom
• GCP > IAM > API Key > Approved > Usage
• GCP > IAM > API Key > CMDB
• GCP > IAM > API Key > Usage
• GCP > IAM > API Key > Usage > Limit

Action Types

• GCP > IAM > API Key > Delete
• GCP > IAM > API Key > Router

What's new?

• You can now configure Encryption at Rest for datasets. To get started, set the GCP > BigQuery > Dataset > Encryption at Rest > * policies.

Control Types

• GCP > BigQuery > Dataset > Encryption at Rest

Policy Types

• GCP > BigQuery > Dataset > Encryption at Rest
• GCP > BigQuery > Dataset > Encryption at Rest > Customer Managed Key

Action Types

• GCP > BigQuery > Dataset > Update Encryption At Rest

What's new?

Control Types

• Kubernetes > Cluster > ServiceNow > Import Set
• Kubernetes > ConfigMap > ServiceNow > Import Set
• Kubernetes > Deployment > ServiceNow > Import Set
• Kubernetes > Namespace > ServiceNow > Import Set
• Kubernetes > Node > ServiceNow > Import Set
• Kubernetes > Pod > ServiceNow > Import Set
• Kubernetes > ReplicaSet > ServiceNow > Import Set
• Kubernetes > Service > ServiceNow > Import Set

Policy Types

• Kubernetes > Cluster > ServiceNow > Import Set
• Kubernetes > Cluster > ServiceNow > Import Set > Archive Columns
• Kubernetes > Cluster > ServiceNow > Import Set > Record
• Kubernetes > Cluster > ServiceNow > Import Set > Table Name
• Kubernetes > ConfigMap > ServiceNow > Import Set
• Kubernetes > ConfigMap > ServiceNow > Import Set > Archive Columns
• Kubernetes > ConfigMap > ServiceNow > Import Set > Record
• Kubernetes > ConfigMap > ServiceNow > Import Set > Table Name
• Kubernetes > Deployment > ServiceNow > Import Set
• Kubernetes > Deployment > ServiceNow > Import Set > Archive Columns
• Kubernetes > Deployment > ServiceNow > Import Set > Record
• Kubernetes > Deployment > ServiceNow > Import Set > Table Name
• Kubernetes > Namespace > ServiceNow > Import Set
• Kubernetes > Namespace > ServiceNow > Import Set > Archive Columns
• Kubernetes > Namespace > ServiceNow > Import Set > Record
• Kubernetes > Namespace > ServiceNow > Import Set > Table Name
• Kubernetes > Node > ServiceNow > Import Set
• Kubernetes > Node > ServiceNow > Import Set > Archive Columns
• Kubernetes > Node > ServiceNow > Import Set > Record
• Kubernetes > Node > ServiceNow > Import Set > Table Name
• Kubernetes > Pod > ServiceNow > Import Set
• Kubernetes > Pod > ServiceNow > Import Set > Archive Columns
• Kubernetes > Pod > ServiceNow > Import Set > Record
• Kubernetes > Pod > ServiceNow > Import Set > Table Name
• Kubernetes > ReplicaSet > ServiceNow > Import Set
• Kubernetes > ReplicaSet > ServiceNow > Import Set > Archive Columns
• Kubernetes > ReplicaSet > ServiceNow > Import Set > Record
• Kubernetes > ReplicaSet > ServiceNow > Import Set > Table Name
• Kubernetes > Service > ServiceNow > Import Set
• Kubernetes > Service > ServiceNow > Import Set > Archive Columns
• Kubernetes > Service > ServiceNow > Import Set > Record
• Kubernetes > Service > ServiceNow > Import Set > Table Name

Bug fixes

• Guardrails failed to process real-time snapshot events if the AWS > EC2 > Snapshot > CMDB policy was set to Enforce: Enabled for Snapshots not created with AWS Backup. This issue has now been fixed.

What's new?

• Users can now configure DNSSEC for managed zones via Guardrails. To get started, set theGCP > DNS > Managed Zone > DNSSEC Configuration policy.
• Users can now configure logging for DNS policies. To get started, set the GCP > DNS > Policy > Logging policy.

Control Types

• GCP > DNS > Managed Zone > DNSSEC Configuration
• GCP > DNS > Policy > Logging