Changelog

What's new?

• Added support to process enable and disable real-time events for Dataplex.

Resource Types

• GCP > Dataplex
• GCP > Dataplex > Lake
• GCP > Dataplex > Task
• GCP > Dataplex > Zone

Control Types

• GCP > Dataplex > API Enabled
• GCP > Dataplex > CMDB
• GCP > Dataplex > Discovery
• GCP > Dataplex > Lake > Active
• GCP > Dataplex > Lake > Approved
• GCP > Dataplex > Lake > CMDB
• GCP > Dataplex > Lake > Discovery
• GCP > Dataplex > Lake > Labels
• GCP > Dataplex > Lake > Usage
• GCP > Dataplex > Task > Active
• GCP > Dataplex > Task > Approved
• GCP > Dataplex > Task > CMDB
• GCP > Dataplex > Task > Discovery
• GCP > Dataplex > Task > Labels
• GCP > Dataplex > Task > Usage
• GCP > Dataplex > Zone > Active
• GCP > Dataplex > Zone > Approved
• GCP > Dataplex > Zone > CMDB
• GCP > Dataplex > Zone > Discovery
• GCP > Dataplex > Zone > Labels
• GCP > Dataplex > Zone > Usage

Policy Types

• GCP > Dataplex > API Enabled
• GCP > Dataplex > Approved Regions [Default]
• GCP > Dataplex > CMDB
• GCP > Dataplex > Enabled
• GCP > Dataplex > Labels Template [Default]
• GCP > Dataplex > Lake > Active
• GCP > Dataplex > Lake > Active > Age
• GCP > Dataplex > Lake > Active > Last Modified
• GCP > Dataplex > Lake > Approved
• GCP > Dataplex > Lake > Approved > Custom
• GCP > Dataplex > Lake > Approved > Regions
• GCP > Dataplex > Lake > Approved > Usage
• GCP > Dataplex > Lake > CMDB
• GCP > Dataplex > Lake > Labels
• GCP > Dataplex > Lake > Labels > Template
• GCP > Dataplex > Lake > Regions
• GCP > Dataplex > Lake > Usage
• GCP > Dataplex > Lake > Usage > Limit
• GCP > Dataplex > Permissions
• GCP > Dataplex > Permissions > Levels
• GCP > Dataplex > Permissions > Levels > Modifiers
• GCP > Dataplex > Regions
• GCP > Dataplex > Task > Active
• GCP > Dataplex > Task > Active > Age
• GCP > Dataplex > Task > Active > Last Modified
• GCP > Dataplex > Task > Approved
• GCP > Dataplex > Task > Approved > Custom
• GCP > Dataplex > Task > Approved > Regions
• GCP > Dataplex > Task > Approved > Usage
• GCP > Dataplex > Task > CMDB
• GCP > Dataplex > Task > Labels
• GCP > Dataplex > Task > Labels > Template
• GCP > Dataplex > Task > Regions
• GCP > Dataplex > Task > Usage
• GCP > Dataplex > Task > Usage > Limit
• GCP > Dataplex > Zone > Active
• GCP > Dataplex > Zone > Active > Age
• GCP > Dataplex > Zone > Active > Last Modified
• GCP > Dataplex > Zone > Approved
• GCP > Dataplex > Zone > Approved > Custom
• GCP > Dataplex > Zone > Approved > Regions
• GCP > Dataplex > Zone > Approved > Usage
• GCP > Dataplex > Zone > CMDB
• GCP > Dataplex > Zone > Labels
• GCP > Dataplex > Zone > Labels > Template
• GCP > Dataplex > Zone > Regions
• GCP > Dataplex > Zone > Usage
• GCP > Dataplex > Zone > Usage > Limit
• GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter > @turbot/gcp-dataplex
• GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-dataplex
• GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-dataplex

Action Types

• GCP > Dataplex > Lake > Delete
• GCP > Dataplex > Lake > Router
• GCP > Dataplex > Lake > Set Labels
• GCP > Dataplex > Set API Enabled
• GCP > Dataplex > Task > Delete
• GCP > Dataplex > Task > Router
• GCP > Dataplex > Task > Set Labels
• GCP > Dataplex > Zone > Delete
• GCP > Dataplex > Zone > Router
• GCP > Dataplex > Zone > Set Labels

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage compute resources in Guardrails. This release includes breaking changes in the CMDB data for virtual machine. We recommend updating your existing policy settings to refer to the updated attributes as mentioned below

Added:

In Azure > Compute > Disk:

• supportedCapabilities.diskControllerTypes
• diskIopsReadWrite
• lastOwnershipUpdateTime

In Azure > Compute > Virtual Machine:

• resources
• timeCreated
• etag

In Azure > Compute > Virtual Machine Scale Set:

• constrainedMaximumCapacity
• etag
• scaleInPolicy
• timeCreated
• upgradePolicy
• storageProfile. diskControllerType

In Azure > Compute > Snapshot:

• dataAccessAuthMode
• incrementalSnapshotFamilyId

Removed:

In Azure > Compute > Virtual Machine:

• statuses.time

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage App Service resources in Guardrails.

Added:

Azure > App Service > App Service Plan

• elasticScaleEnabled
• numberOfWorkers
• zoneRedundant

Azure > App Service > Function App

• configuration.acrUseManagedIdentityCreds
• configuration.acrUserManagedIdentityID
• configuration.elasticWebAppScaleLimit
• configuration.ipSecurityRestrictionsDefaultAction
• configuration.metadata
• configuration.minTlsCipherSuite
• configuration.scmIpSecurityRestrictionsDefaultAction
• dnsConfiguration
• publicNetworkAccess
• vnetBackupRestoreEnabled
• vnetContentShareEnabled
• vnetImagePullEnabled
• vnetRouteAllEnabled

Azure > App Service > Web App

• configuration.acrUseManagedIdentityCreds
• configuration.acrUserManagedIdentityID
• configuration.elasticWebAppScaleLimit
• configuration.ipSecurityRestrictionsDefaultAction
• configuration.metadata
• configuration.minTlsCipherSuite
• configuration.scmIpSecurityRestrictionsDefaultAction
• dnsConfiguration
• publicNetworkAccess
• vnetBackupRestoreEnabled
• vnetContentShareEnabled
• vnetImagePullEnabled
• vnetRouteAllEnabled

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage API Management resources in Guardrails.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Security Center resources in Guardrails. This release includes breaking changes in the CMDB data for security center. We recommend updating your existing policy settings to refer to the updated attributes as mentioned below

Renamed:

• JitNetworkAccessPolicies to jitNetworkAccessPolicies
• Pricing to pricing
• Locations to locations

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage MySQL resources in Guardrails.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Front Door Service resources in Guardrails. This release includes breaking changes in the CMDB data for Front Door Service. We recommend updating your existing policy settings to refer to the updated attributes as mentioned below.

Added:

• frontdoorId
• rulesEngines
• extendedProperties
• backendPoolsSettings
• backendPool.privateLinkAlias
• backendPool.privateLinkLocation
• backendPool.privateEndpointStatus
• backendPool.privateLinkResourceId
• backendPool.privateLinkApprovalMessage
• routingRule.rulesEngine
• routingRule.routeConfiguration.odataType
• routingRule.routeConfiguration.cacheConfiguration.cacheDuration
• routingRule.routeConfiguration.cacheConfiguration.queryParameters
• routingRule.webApplicationFirewallPolicyLink

Modified:

• routingRule.backendPool to routingRule.routeConfiguration.backendPool
• routingRule.forwardingProtocol to routingRule.routeConfiguration.forwardingProtocol
• routingRule.customForwardingPath to routingRule.routeConfiguration.customForwardingPath
• routingRule.cacheConfiguration.dynamicCompression to routingRule.routeConfiguration.cacheConfiguration. dynamicCompression
• routingRule.cacheConfiguration.queryParameterStripDirective to routingRule.routeConfiguration.cacheConfiguration. queryParameterStripDirective

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Data Factory resources in Guardrails.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage AKS resources in Guardrails.

Added:

• networkProfile.podCidrs
• networkProfile.ipFamilies
• networkProfile.outboundType
• networkProfile.serviceCidrs
• networkProfile.networkPolicy
• networkProfile.loadBalancerProfile.backendPoolType
• networkProfile.loadBalancerProfile.countIPv6
• networkProfile.loadBalancerProfile.idleTimeoutInMinutes
• networkProfile.loadBalancerProfile.allocatedOutboundPorts
• agentPoolProfiles.mode
• agentPoolProfiles.osSKU
• agentPoolProfiles.enableFips
• agentPoolProfiles.osDiskType
• agentPoolProfiles.spotMaxPrice
• agentPoolProfiles.scaleDownMode
• agentPoolProfiles.enableUltraSSD
• agentPoolProfiles.kubeletDiskType
• agentPoolProfiles.upgradeSettings.maxSurge
• agentPoolProfiles.nodeImageVersion
• agentPoolProfiles.enableEncryptionAtHost
• agentPoolProfiles.currentOrchestratorVersion

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage SignalR resources in Guardrails.

Added:

• hostNamePrefix
• serverless. connectionTimeoutInSeconds

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Service Bus resources in Guardrails.

Added:

Azure > Service Bus > Namespace

• disableLocalAuth
• status
• zoneRedundant

Azure > Service Bus > Queue

• maxMessageSizeInKilobytes

Azure > Service Bus > Topic

• maxMessageSizeInKilobytes

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Relay resources in Guardrails.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Recovery Service resources in Guardrails.

Added: Azure > Recovery Service > Vault

• properties.backupStorageVersion
• properties.bcdrSecurityLevel
• properties.publicNetworkAccess
• properties.restoreSettings
• properties.secureScore
• properties.securitySettings

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The AWS > RoboMaker > Robot Application > CMDB, AWS > RoboMaker > Fleet > CMDB and AWS > RoboMaker > Robot > CMDB policies will now be set to Skip by default because the resource types have been deprecated and will be removed in the next major version. Please check end of support for more information.

What's new?

• Track and manage Fargate FIPS Mode for Gov cloud accounts via Guardrails. To get started, set the AWS > ECS > Account Settings > Fargate FIPS Mode policy.
• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Resource Types

• AWS > ECS > Account Settings

Control Types

• AWS > ECS > Account Settings > CMDB
• AWS > ECS > Account Settings > Discovery
• AWS > ECS > Account Settings > Fargate FIPS Mode

Policy Types

• AWS > ECS > Account Settings > CMDB
• AWS > ECS > Account Settings > Fargate FIPS Mode
• AWS > ECS > Account Settings > Regions

Action Types

• AWS > ECS > Account Settings > Router
• AWS > ECS > Account Settings > Update Fargate FIPS Mode

What's new?

• Server

  • Introduced support for multi-architecture images, now compatible with both ARM64 and x86_64.
  • Added a default resource query to the context of calculated policies.
  • Updated several node packages to newer versions for improved functionality and security.
  • Updated Lambda to support recursive loops.

• UI

  • Now you can use the + sign to grant permissions in the context of both the identity and resource.
  • Updated several node packages to newer versions for improved functionality and security.

Bug fixes

• Server

  • Azure Credential Resolver now respects proxy settings, adding full proxy support.

• UI

  • Updated policy pack Terraform to correctly reference turbot_policy_pack.
  • Adjusted the Admin page layout for improved usability.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• resource/turbot_policy_pack_attachment: terraform apply failed to detect existing Policy Pack attachments. (#181)

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Application Insights resources in Guardrails. This release includes changes in the CMDB data as below.

Added:

• flowType
• requestSource

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Application Gateway resources in Guardrails.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Resource Types

• AWS > Support

Policy Types

• AWS > Support > API Enabled
• AWS > Support > Enabled
• AWS > Support > Permissions
• AWS > Support > Permissions > Levels
• AWS > Support > Permissions > Levels > Modifiers
• AWS > Support > Permissions > Lockdown
• AWS > Support > Permissions > Lockdown > API Boundary
• AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-support
• AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-support
• AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-support

What's new?

• Users can now manage whether AWS/User grant should include support:* permissions. To get started, set the AWS > Account > Permissions > Support Level policy.

Policy Types

• AWS > Account > Permissions > Support Level

Bug fixes

• The AWS > Turbot > IAM stack control did not correctly evaluate user memberships in custom IAM groups when the AWS > Turbot > Permissions > Custom Group Levels [Account] policy was set, and users were granted permissions for those custom IAM groups. This issue has now been fixed.

Bug fixes

• The AWS > EC2 > Volume > CMDB control would sometimes run unnecessarily due to a bad internal GraphQL dependency. This is now fixed.

Bug fixes

• A precheck dependency on the Kubernetes > Cluster > CMDB > Expiration policy was inadvertently added to the Kubernetes > Cluster > CMDB control. This precheck condition has now been removed.

Resource Types

• GCP > Vertex AI
• GCP > Vertex AI > Endpoint
• GCP > Vertex AI > Notebook Runtime Template

Control Types

• GCP > Vertex AI > API Enabled
• GCP > Vertex AI > CMDB
• GCP > Vertex AI > Discovery
• GCP > Vertex AI > Endpoint > Active
• GCP > Vertex AI > Endpoint > Approved
• GCP > Vertex AI > Endpoint > CMDB
• GCP > Vertex AI > Endpoint > Discovery
• GCP > Vertex AI > Endpoint > Labels
• GCP > Vertex AI > Endpoint > Usage
• GCP > Vertex AI > Notebook Runtime Template > Active
• GCP > Vertex AI > Notebook Runtime Template > Approved
• GCP > Vertex AI > Notebook Runtime Template > CMDB
• GCP > Vertex AI > Notebook Runtime Template > Discovery
• GCP > Vertex AI > Notebook Runtime Template > Router
• GCP > Vertex AI > Notebook Runtime Template > Usage

Policy Types

• GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter > @turbot/gcp-vertexai
• GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-vertexai
• GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-vertexai
• GCP > Vertex AI > API Enabled
• GCP > Vertex AI > Approved Regions [Default]
• GCP > Vertex AI > CMDB
• GCP > Vertex AI > Enabled
• GCP > Vertex AI > Endpoint > Active
• GCP > Vertex AI > Endpoint > Active > Age
• GCP > Vertex AI > Endpoint > Active > Last Modified
• GCP > Vertex AI > Endpoint > Approved
• GCP > Vertex AI > Endpoint > Approved > Custom
• GCP > Vertex AI > Endpoint > Approved > Regions
• GCP > Vertex AI > Endpoint > Approved > Usage
• GCP > Vertex AI > Endpoint > CMDB
• GCP > Vertex AI > Endpoint > Labels
• GCP > Vertex AI > Endpoint > Labels > Template
• GCP > Vertex AI > Endpoint > Regions
• GCP > Vertex AI > Endpoint > Usage
• GCP > Vertex AI > Endpoint > Usage > Limit
• GCP > Vertex AI > Labels Template [Default]
• GCP > Vertex AI > Notebook Runtime Template > Active
• GCP > Vertex AI > Notebook Runtime Template > Active > Age
• GCP > Vertex AI > Notebook Runtime Template > Active > Last Modified
• GCP > Vertex AI > Notebook Runtime Template > Approved
• GCP > Vertex AI > Notebook Runtime Template > Approved > Custom
• GCP > Vertex AI > Notebook Runtime Template > Approved > Regions
• GCP > Vertex AI > Notebook Runtime Template > Approved > Usage
• GCP > Vertex AI > Notebook Runtime Template > CMDB
• GCP > Vertex AI > Notebook Runtime Template > Regions
• GCP > Vertex AI > Notebook Runtime Template > Usage
• GCP > Vertex AI > Notebook Runtime Template > Usage > Limit
• GCP > Vertex AI > Permissions
• GCP > Vertex AI > Permissions > Levels
• GCP > Vertex AI > Permissions > Levels > Modifiers
• GCP > Vertex AI > Regions

Action Types

• GCP > Vertex AI > Endpoint > Delete
• GCP > Vertex AI > Endpoint > Router
• GCP > Vertex AI > Endpoint > Set Labels
• GCP > Vertex AI > Notebook Runtime Template > Delete
• GCP > Vertex AI > Set API Enabled

What's new?

• Added support to process real-time enable and disable events for Vertex AI API via Service Usage APIs.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Search Management resources in Guardrails.

Added:

• authOptions
• disableLocalAuth
• encryptionWithCmk
• networkRuleSet
• privateEndpointConnections
• publicNetworkAccess
• semanticSearch
• sharedPrivateLinkResources

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

Action Types

• GCP > Storage > Bucket > Set Fine-grained Access Control
• GCP > Storage > Bucket > Set Uniform Access Control

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Synapse Analytics resources in Guardrails.

Added: Azure > Synapse Analytics > Workspace

• azureADOnlyAuthentication
• createManagedPrivateEndpoint
• encryption
• extraProperties
• publicNetworkAccess
• settings
• trustedServiceBypassEnabled
• workspaceUID

Azure > Synapse Analytics > SQL Pool

• storageAccountType

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

Action Types

• Azure > Storage > Storage Account > Set Minimum TLS Version

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage PostgreSQL resources in Guardrails. This release includes breaking changes in the CMDB data for server and flexible server. We recommend updating your existing policy settings to refer to the updated attributes as mentioned below

Added:

• authConfig

• dataEncryption

• standbyAvailabilityZone

• network. delegatedSubnetResourceId

• network. privateDnsZoneArmResourceId

• replicaCapacity

• replicationRole

• systemData

• configurations.documentationLink

• configurations.isConfigPendingRestart

• configurations.isDynamicConfig

• configurations.isReadOnly

• configurations.unit

Modified:

• The data type of the attribute firewallRules has been changed from array ([]) to object ({}).

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Network Watcher resources in Guardrails.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The serviceProperties.table.clientRequestId and serviceProperties.table.requestId properties for storage accounts have now been made dynamic to avoid unnecessary notifications in the activity tab.

Bug fixes

• Fixed incorrect references to various Quick Actions.

What's new?

Policy Types

• Kubernetes > Cluster > ServiceNow > Import Set > Insert Mode
• Kubernetes > ConfigMap > ServiceNow > Import Set > Insert Mode
• Kubernetes > Deployment > ServiceNow > Import Set > Insert Mode
• Kubernetes > Namespace > ServiceNow > Import Set > Insert Mode
• Kubernetes > Node > ServiceNow > Import Set > Insert Mode
• Kubernetes > Pod > ServiceNow > Import Set > Insert Mode
• Kubernetes > ReplicaSet > ServiceNow > Import Set > Insert Mode
• Kubernetes > Service > ServiceNow > Import Set > Insert Mode

Bug fixes

• Improved error handling for osquery error events.

Bug fixes

• Query controls for various resource types will now go into an invalid state if we receive an error from the osquery agent.

What's new?

Policy Types

• GCP > Storage > Bucket > ServiceNow > Import Set > Insert Mode
• GCP > Storage > Object > ServiceNow > Import Set > Insert Mode

Control Types

• GCP > Kubernetes Engine > Region Cluster > ServiceNow > Import Set
• GCP > Kubernetes Engine > Region Node Pool > ServiceNow > Import Set
• GCP > Kubernetes Engine > Zone Cluster > ServiceNow > Import Set
• GCP > Kubernetes Engine > Zone Node Pool > ServiceNow > Import Set

Policy Types

• GCP > Kubernetes Engine > Region Cluster > ServiceNow > Import Set
• GCP > Kubernetes Engine > Region Cluster > ServiceNow > Import Set > Archive Columns
• GCP > Kubernetes Engine > Region Cluster > ServiceNow > Import Set > Insert Mode
• GCP > Kubernetes Engine > Region Cluster > ServiceNow > Import Set > Record
• GCP > Kubernetes Engine > Region Cluster > ServiceNow > Import Set > Table Name
• GCP > Kubernetes Engine > Region Node Pool > ServiceNow > Import Set
• GCP > Kubernetes Engine > Region Node Pool > ServiceNow > Import Set > Archive Columns
• GCP > Kubernetes Engine > Region Node Pool > ServiceNow > Import Set > Insert Mode
• GCP > Kubernetes Engine > Region Node Pool > ServiceNow > Import Set > Record
• GCP > Kubernetes Engine > Region Node Pool > ServiceNow > Import Set > Table Name
• GCP > Kubernetes Engine > Zone Cluster > ServiceNow > Import Set
• GCP > Kubernetes Engine > Zone Cluster > ServiceNow > Import Set > Archive Columns
• GCP > Kubernetes Engine > Zone Cluster > ServiceNow > Import Set > Insert Mode
• GCP > Kubernetes Engine > Zone Cluster > ServiceNow > Import Set > Record
• GCP > Kubernetes Engine > Zone Cluster > ServiceNow > Import Set > Table Name
• GCP > Kubernetes Engine > Zone Node Pool > ServiceNow > Import Set
• GCP > Kubernetes Engine > Zone Node Pool > ServiceNow > Import Set > Archive Columns
• GCP > Kubernetes Engine > Zone Node Pool > ServiceNow > Import Set > Insert Mode
• GCP > Kubernetes Engine > Zone Node Pool > ServiceNow > Import Set > Record
• GCP > Kubernetes Engine > Zone Node Pool > ServiceNow > Import Set > Table Name

What's new?

Policy Types

• GCP > Global Region > ServiceNow > Import Set > Insert Mode
• GCP > Multi-Region > ServiceNow > Import Set > Insert Mode
• GCP > Project > ServiceNow > Import Set > Insert Mode
• GCP > Region > ServiceNow > Import Set > Insert Mode
• GCP > Zone > ServiceNow > Import Set > Insert Mode

Control Types

• Azure > AKS > Managed Cluster > ServiceNow > Import Set

Policy Types

• Azure > AKS > Managed Cluster > ServiceNow > Import Set
• Azure > AKS > Managed Cluster > ServiceNow > Import Set > Archive Columns
• Azure > AKS > Managed Cluster > ServiceNow > Import Set > Insert Mode
• Azure > AKS > Managed Cluster > ServiceNow > Import Set > Record
• Azure > AKS > Managed Cluster > ServiceNow > Import Set > Table Name

What's new?

Policy Types

• Azure > Subscription > ServiceNow > Import Set > Insert Mode

What's new?

Policy Types

• ServiceNow > Import Set > Insert Mode [Default]

Bug fixes

• Guardrails did not correctly raise the real-time modifyVolume event for EBS Volume Notifications. This issue is now fixed.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

Action Types

• AWS > SWF > Domain > Delete from AWS

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

Bug fixes

• Fixed incorrect references to various Quick Actions.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

What's new?

• Volume's metadata will now also include createdBy details in Guardrails CMDB.
• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• The AWS > EC2 > Volume > Performance Configuration control would sometimes fail to set the expected configuration per AWS > EC2 > Volume > Performance Configuration > * policies and move to an Invalid state if the required data was not available for new volumes in the CMDB. The control will now move to TBD instead and retry after 5 minutes to fetch the required data correctly and set the performance configuration as expected.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed incorrect references to various Quick Actions.

What's new?

• Support for Node.js 20 in the Lambda runtime.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• The Azure > Storage> Storage Account > CMDB control will now also fetch diagnostic settings details and store them in CMDB.
• Track and manage storage account access keys in Guardrails CMDB.

Resource Types

• Azure > Storage > Access Key

Control Types

• Azure > Storage > Access Key > CMDB
• Azure > Storage > Access Key > Discovery

Policy Types

• Azure > Storage > Access Key > CMDB

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.
• Fixed the AKA format for rule group v2 global and regional resource types.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Control Types

• GCP > Global Region > ServiceNow
• GCP > Global Region > ServiceNow > Configuration Item
• GCP > Global Region > ServiceNow > Import Set
• GCP > Global Region > ServiceNow > Table
• GCP > Multi-Region > ServiceNow
• GCP > Multi-Region > ServiceNow > Configuration Item
• GCP > Multi-Region > ServiceNow > Import Set
• GCP > Multi-Region > ServiceNow > Table
• GCP > Region > ServiceNow
• GCP > Region > ServiceNow > Configuration Item
• GCP > Region > ServiceNow > Import Set
• GCP > Region > ServiceNow > Table
• GCP > Zone > ServiceNow
• GCP > Zone > ServiceNow > Configuration Item
• GCP > Zone > ServiceNow > Import Set
• GCP > Zone > ServiceNow > Table

Policy Types

• GCP > Global Region > ServiceNow
• GCP > Global Region > ServiceNow > Configuration Item
• GCP > Global Region > ServiceNow > Configuration Item > Record
• GCP > Global Region > ServiceNow > Configuration Item > Table Definition
• GCP > Global Region > ServiceNow > Import Set
• GCP > Global Region > ServiceNow > Import Set > Archive Columns
• GCP > Global Region > ServiceNow > Import Set > Record
• GCP > Global Region > ServiceNow > Import Set > Table Name
• GCP > Global Region > ServiceNow > Table
• GCP > Global Region > ServiceNow > Table > Definition
• GCP > Multi-Region > ServiceNow
• GCP > Multi-Region > ServiceNow > Configuration Item
• GCP > Multi-Region > ServiceNow > Configuration Item > Record
• GCP > Multi-Region > ServiceNow > Configuration Item > Table Definition
• GCP > Multi-Region > ServiceNow > Import Set
• GCP > Multi-Region > ServiceNow > Import Set > Archive Columns
• GCP > Multi-Region > ServiceNow > Import Set > Record
• GCP > Multi-Region > ServiceNow > Import Set > Table Name
• GCP > Multi-Region > ServiceNow > Table
• GCP > Multi-Region > ServiceNow > Table > Definition
• GCP > Region > ServiceNow
• GCP > Region > ServiceNow > Configuration Item
• GCP > Region > ServiceNow > Configuration Item > Record
• GCP > Region > ServiceNow > Configuration Item > Table Definition
• GCP > Region > ServiceNow > Import Set
• GCP > Region > ServiceNow > Import Set > Archive Columns
• GCP > Region > ServiceNow > Import Set > Record
• GCP > Region > ServiceNow > Import Set > Table Name
• GCP > Region > ServiceNow > Table
• GCP > Region > ServiceNow > Table > Definition
• GCP > Zone > ServiceNow
• GCP > Zone > ServiceNow > Configuration Item
• GCP > Zone > ServiceNow > Configuration Item > Record
• GCP > Zone > ServiceNow > Configuration Item > Table Definition
• GCP > Zone > ServiceNow > Import Set
• GCP > Zone > ServiceNow > Import Set > Archive Columns
• GCP > Zone > ServiceNow > Import Set > Record
• GCP > Zone > ServiceNow > Import Set > Table Name
• GCP > Zone > ServiceNow > Table
• GCP > Zone > ServiceNow > Table > Definition

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

Bug fixes

• The Import Set controls will not require permissions to read the sys_db_object & sys_dictionary tables in ServiceNow.

What's new?

• You can now configure parameter groups for DB clusters. To get started, set the AWS > RDS > DB Cluster > Parameter Group > * policies.

Control Types

• AWS > RDS > DB Cluster > Parameter Group

Policy Types

• AWS > RDS > DB Cluster > Parameter Group
• AWS > RDS > DB Cluster > Parameter Group > Name

Action Types

• AWS > RDS > DB Cluster > Update Parameter Group

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• Server

  • Resolved an issue where policy values were not being terminated due to a race condition.
  • The ServiceNow credentials resolver will now display a clear message when the instance is hibernate or unavailable state.

• UI

  • Fixed an issue where filters on the Resource Explorer page were not functioning correctly.
  • The Import button on the Connect page has been updated to Connect.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

What's new?

• We have updated various policies set during project imports to allow for a smoother import experience. We recommend upgrading your TE to v5.42.21 or higher to enable these changes to take effect.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• You can now configure Master Authorized Networks for region and zone clusters via Guardrails. To get started, set the GCP > Kubernetes Engine > Region Cluster > Master Authorized Networks Config and GCP > Kubernetes Engine > Zone Cluster > Master Authorized Networks Config policies respectively.

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Control Types

• GCP > Kubernetes Engine > Zone Cluster > Master Authorized Networks Config

Policy Types

• GCP > Kubernetes Engine > Zone Cluster > Master Authorized Networks Config

Action Types

• GCP > Kubernetes Engine > Region Cluster > Set Desired Master Authorized Network Config
• GCP > Kubernetes Engine > Zone Cluster > Set Desired Master Authorized Network Config

What's new?

• We have updated various policies set during subscription imports to allow for a smoother import experience. We recommend upgrading your TE to v5.42.21 or higher to enable these changes to take effect.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Resource Types

• Azure > Network > Private Link Service

Control Types

• Azure > Network > Private Link Service > Active
• Azure > Network > Private Link Service > Approved
• Azure > Network > Private Link Service > CMDB
• Azure > Network > Private Link Service > Discovery
• Azure > Network > Private Link Service > Tags

Policy Types

• Azure > Network > Private Link Service > Active
• Azure > Network > Private Link Service > Active > Age
• Azure > Network > Private Link Service > Active > Last Modified
• Azure > Network > Private Link Service > Approved
• Azure > Network > Private Link Service > Approved > Custom
• Azure > Network > Private Link Service > Approved > Regions
• Azure > Network > Private Link Service > Approved > Usage
• Azure > Network > Private Link Service > CMDB
• Azure > Network > Private Link Service > Regions
• Azure > Network > Private Link Service > Tags
• Azure > Network > Private Link Service > Tags > Template

Action Types

• Azure > Network > Private Link Service > Delete
• Azure > Network > Private Link Service > Router
• Azure > Network > Private Link Service > Set Tags

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.

Bug fixes

• In version 5.25.0, we added support to ignore permission errors on a bucket via the CMDB policy Enforce: Enabled but ignore permission errors. However, the CMDB control previously ignored permission errors only on the HeadBucket operation and still entered an error state for permission errors on sub-API calls. The CMDB control will now ignore all sub-API calls if the HeadBucket operation is denied access. If the HeadBucket operation is successful, the control will attempt to make all sub-API calls and ignore access denied errors if encountered.

What's new?

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Resource Types

• Azure > Provider > Container Registry

Control Types

• Azure > Provider > Container Registry > CMDB
• Azure > Provider > Container Registry > Discovery
• Azure > Provider > Container Registry > Registered

Policy Types

• Azure > Provider > Container Registry > CMDB
• Azure > Provider > Container Registry > Registered

Action Types

• Azure > Provider > Container Registry > Set Registered

Resource Types

• Azure > Container Registry
• Azure > Container Registry > Registry

Control Types

• Azure > Container Registry > Registry > Active
• Azure > Container Registry > Registry > Approved
• Azure > Container Registry > Registry > CMDB
• Azure > Container Registry > Registry > Discovery
• Azure > Container Registry > Registry > Tags

Policy Types

• Azure > Container Registry > Approved Regions [Default]
• Azure > Container Registry > Enabled
• Azure > Container Registry > Permissions
• Azure > Container Registry > Permissions > Levels
• Azure > Container Registry > Permissions > Levels > Modifiers
• Azure > Container Registry > Regions
• Azure > Container Registry > Registry > Active
• Azure > Container Registry > Registry > Active > Age
• Azure > Container Registry > Registry > Active > Last Modified
• Azure > Container Registry > Registry > Approved
• Azure > Container Registry > Registry > Approved > Custom
• Azure > Container Registry > Registry > Approved > Regions
• Azure > Container Registry > Registry > Approved > Usage
• Azure > Container Registry > Registry > CMDB
• Azure > Container Registry > Registry > Regions
• Azure > Container Registry > Registry > Tags
• Azure > Container Registry > Registry > Tags > Template
• Azure > Container Registry > Tags Template [Default]
• Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-containerregistry
• Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-containerregistry

Action Types

• Azure > Container Registry > Registry > Delete
• Azure > Container Registry > Registry > Router
• Azure > Container Registry > Registry > Set Tags

What's new?

• The Approved > Usage policy for resource types will now default to Approved instead of Approved if AWS > {service} > Enabled.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• The AWS > VPC > VPC > Stack control would sometimes go into an error state while upserting newly created flow logs in Guardrails due to incorrect mapping of its parent resource. This issue has now been fixed, and the control will upsert flow logs more consistently and reliably than before.

Bug fixes

• The CMDB control for the service resource type will no longer depend on the API Enabled policy being set to Enforce: Enabled for the service.

What's new?

• Added support for Postgres versions 13.14, 13.15, 13.16, 14.11, 14.12, 14.13 and 15.8.
• Updated Default value for the RDS certificate to rds-ca-rsa4096-g1.

5.0.0 (2024-08-13)

Resource Types

• Azure > Managed Identity
• Azure > Managed Identity > User Assigned Identity

Control Types

• Azure > Managed Identity > User Assigned Identity > Active
• Azure > Managed Identity > User Assigned Identity > Approved
• Azure > Managed Identity > User Assigned Identity > CMDB
• Azure > Managed Identity > User Assigned Identity > Discovery
• Azure > Managed Identity > User Assigned Identity > Tags

Policy Types

• Azure > Managed Identity > Approved Regions [Default]
• Azure > Managed Identity > Enabled
• Azure > Managed Identity > Permissions
• Azure > Managed Identity > Permissions > Levels
• Azure > Managed Identity > Permissions > Levels > Modifiers
• Azure > Managed Identity > Regions
• Azure > Managed Identity > Tags Template [Default]
• Azure > Managed Identity > User Assigned Identity > Active
• Azure > Managed Identity > User Assigned Identity > Active > Age
• Azure > Managed Identity > User Assigned Identity > Active > Last Modified
• Azure > Managed Identity > User Assigned Identity > Approved
• Azure > Managed Identity > User Assigned Identity > Approved > Custom
• Azure > Managed Identity > User Assigned Identity > Approved > Regions
• Azure > Managed Identity > User Assigned Identity > Approved > Usage
• Azure > Managed Identity > User Assigned Identity > CMDB
• Azure > Managed Identity > User Assigned Identity > Regions
• Azure > Managed Identity > User Assigned Identity > Tags
• Azure > Managed Identity > User Assigned Identity > Tags > Template
• Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-managedidentity
• Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-managedidentity

Action Types

• Azure > Managed Identity > User Assigned Identity > Delete
• Azure > Managed Identity > User Assigned Identity > Router
• Azure > Managed Identity > User Assigned Identity > Set Tags

What's new?

• The AWS > Turbot > Logging > Bucket > Default Encryption policy is now deprecated because all buckets are now encrypted by default in AWS. As a result, all buckets created and managed via the AWS > Turbot > Logging > Bucket stack control will now be encrypted by AWS SSE by default. We've also removed ACL settings for buckets and now apply bucket ownership controls instead via the stack control to align with the latest AWS recommendations. Please upgrade the @turbot/aws-s3 mod to v5.26.0 for the stack control to work reliably as before.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Policy Types

Renamed

• AWS > Turbot > Logging > Bucket > Default Encryption to AWS > Turbot > Logging > Bucket > Default Encryption [Deprecated]

What's new?

• Added support for aws_s3_bucket_ownership_controls Terraform resource for buckets.
• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

• Resource's metadata will now also include createdBy details in Turbot CMDB.

What's new?

• Users can now configure the Terraform version for the AWS > Config > Configuration Recording stack control. To get started, set the AWS > Config > Configuration Recording > Terraform Version policy. We recommend using versions 0.11, 0.12, or 0.15 for this control to create and manage resources effectively and reliably.

Policy Types

• AWS > Config > Configuration Recording > Terraform Version

What's new?

• Users can now create and manage labels on Pub/Sub topics created via the GCP > Turbot > Event Handlers > Pub/Sub control. To get started, set the GCP > Turbot > Event Handlers > Pub/Sub > Topic > Labels policy.

Policy Types

• GCP > Turbot > Event Handlers > Pub/Sub > Subscription > Labels > Ignore Changes
• GCP > Turbot > Event Handlers > Pub/Sub > Topic > Labels
• GCP > Turbot > Event Handlers > Pub/Sub > Topic > Labels > Ignore Changes

Bug fixes

• Guardrails failed to cleanup deleted security group rules via the real-time ec2:RevokeSecurityGroupEgress and ec2:RevokeSecurityGroupIngress events. This issue is now fixed.

Bug fixes

• The AWS > Turbot > Event Handlers control did not correctly raise the real-time CreateTags and DeleteTags events for VPC security group rules. This issue is now fixed.

What's new?

• Users can now configure flow logging for subnetworks. To get started, set the GCP > Network > Subnetwork > Flow Log policy.

Control Types

• GCP > Network > Subnetwork > Flow Log

Policy Types

• GCP > Network > Subnetwork > Flow Log

Action Types

• GCP > Network > Subnetwork > Set Flow Log

What's new?

• We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

• Resource's metadata will now also include createdBy details in Turbot CMDB.

Resource Types

• Azure > Provider > Elastic
• Azure > Provider > Managed Identity

Control Types

• Azure > Provider > Elastic > CMDB
• Azure > Provider > Elastic > Discovery
• Azure > Provider > Elastic > Registered
• Azure > Provider > Managed Identity > CMDB
• Azure > Provider > Managed Identity > Discovery
• Azure > Provider > Managed Identity > Registered

Policy Types

• Azure > Provider > Elastic > CMDB
• Azure > Provider > Elastic > Registered
• Azure > Provider > Managed Identity > CMDB
• Azure > Provider > Managed Identity > Registered

Action Types

• Azure > Provider > Elastic > Set Registered
• Azure > Provider > Managed Identity > Set Registered

What's new?

• We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

• Resource's metadata will now also include createdBy details in Turbot CMDB.

What's new?

• You can now disable inactive or unapproved service accounts via Guardrails. To get started, set the GCP > IAM > Service Account > Active or GCP > IAM > Service Account > Approved policy to Enforce: Disable inactive with <x> days warning or Enforce: Disable unapproved respectively.

Action Types

• GCP > IAM > Service Account > Disable

What's new?

• We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

• Resource's metadata will now also include createdBy details in Turbot CMDB.

What's new?

• We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

• Resource's metadata will now also include createdBy details in Turbot CMDB.

What's new?

• We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

• Resource's metadata will now also include createdBy details in Turbot CMDB.

What's new?

• We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

• Resource's metadata will now also include createdBy details in Turbot CMDB.

Bug fixes

• The AWS > ECR > Repository > CMDB control went into an error state for shared repositories upserted incorrectly in Guardrails CMDB. Shared repositories will now not be upserted under shared accounts or regions, but will only be upserted under their owner accounts and regions.

Bug fixes

• Guardrails failed to process the real-time event ec2:CreateReplaceRootVolumeTask for instances. This is now fixed.

What's new?

• Server

  • Made notifications faster by improving the query, which enhances the performance of the resource activity tab.

• UI

  • Fixed a bug where policy pack creation would fail if the AKA was not provided from the user interface.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• The Azure > Resource Group > ServiceNow > Configuration Item control would fail to fetch instance credentials internally and did not process the data correctly in ServiceNow. This issue has now been fixed.

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

Control Types

• GCP > Project > ServiceNow > Import Set

Policy Types

• GCP > Project > ServiceNow > Import Set
• GCP > Project > ServiceNow > Import Set > Archive Columns
• GCP > Project > ServiceNow > Import Set > Record
• GCP > Project > ServiceNow > Import Set > Table Name

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

Bug fixes

• The Import Set control for various resources would push JSON objects to ServiceNow without converting them to strings. This would result in ServiceNow reading those JSON objects in an incorrect format. The Import Set control will now convert such JSON objects to strings so that they are stored reliably and consistently in ServiceNow.

What's new?

• Added support for Postgres versions 15.6 and 15.7.

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to poll events from Azure Monitor and process them in Guardrails. You won't notice any difference, and things will continue to work smoothly as before.

What's new?

• AWS/DynamoDB/Admin, AWS/DynamoDB/Metadata and AWS/DynamoDB/Operator now include permissions for Resource Policy, Imports, Time to Live and Global Table Version.

What's new?

Control Types

• Azure > Network > Network Security Group > ServiceNow > Import Set

Policy Types

• Azure > Network > Network Security Group > ServiceNow > Import Set
• Azure > Network > Network Security Group > ServiceNow > Import Set > Archive Columns
• Azure > Network > Network Security Group > ServiceNow > Import Set > Record
• Azure > Network > Network Security Group > ServiceNow > Import Set > Table Name

What's new?

Control Types

• Azure > Subscription > ServiceNow > Import Set

Policy Types

• Azure > Subscription > ServiceNow > Import Set
• Azure > Subscription > ServiceNow > Import Set > Archive Columns
• Azure > Subscription > ServiceNow > Import Set > Record
• Azure > Subscription > ServiceNow > Import Set > Table Name

What's new?

• Users can now enable/disable Table logging for Storage Accounts via Azure > Storage > Storage Account > Table > Logging control. To get started, set the Azure > Storage > Storage Account > Table > Logging policy.

Control Types

• Azure > Storage > Storage Account > Encryption at Rest
• Azure > Storage > Storage Account > Table
• Azure > Storage > Storage Account > Table > Logging

Policy Types

• Azure > Storage > Storage Account > Encryption at Rest
• Azure > Storage > Storage Account > Encryption at Rest > Customer Managed Key
• Azure > Storage > Storage Account > Table
• Azure > Storage > Storage Account > Table > Logging
• Azure > Storage > Storage Account > Table > Logging > Properties
• Azure > Storage > Storage Account > Table > Logging > Retention Days

Action Types

• Azure > Storage > Storage Account > Update Encryption at Rest

• Azure > Storage > Storage Account > Update Storage Account Table Logging

• The Storage Account CMDB data will now also include information about the account's table service properties.

• We've removed the dependency on listKeys permission for Azure > Storage Account > Container > Discovery to run its course to completion. This release includes breaking changes in the CMDB data for containers. We recommend updating your existing policy settings to refer to the updated attributes as mentioned below.

Renamed: isImmutableStorageWithVersioningEnabled to isImmutableStorageWithVersioning.enabled

Removed: preventEncryptionScopeOverride

Bug fixes

• The Azure > Storage > Storage Account > CMDB control would go into an error state while trying to fetch default Queue and Blob properties if Guardrails did not have permission to list the storage account keys. The control will now not attempt to fetch default Queue and Blob properties if Guardrails does not have the required access for listKeys, and will run its course to completion without going into an error state.

Bug fixes

• Improved error message for the AWS > S3 > Bucket > CMDB control if it would go into an error state due to insufficient permissions for the headBucket operation.

What's new?

• Server
  • Migrated from Node.js 18 to Node.js 20 for improved performance and security.
  • Updated the Mod Lambda architecture to ARM64 for better efficiency.
  • Added support for Node.js 20 in the Lambda runtime.

Bug fixes

• Server
  • Resolved an issue where the next tick timestamp was not being set for large commands

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• UI
  • Resolved deletion issue from UI for Policy Packs with latest Turbot Mod(5.45.0) and TE 5.45.0.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• Server
  • Minor internal improvements.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

What's new?

Control Types

• Kubernetes > CronJob > ServiceNow
• Kubernetes > CronJob > ServiceNow > Configuration Item
• Kubernetes > CronJob > ServiceNow > Table
• Kubernetes > DaemonSet > ServiceNow
• Kubernetes > DaemonSet > ServiceNow > Configuration Item
• Kubernetes > DaemonSet > ServiceNow > Table
• Kubernetes > Ingress > ServiceNow
• Kubernetes > Ingress > ServiceNow > Configuration Item
• Kubernetes > Ingress > ServiceNow > Table
• Kubernetes > Job > ServiceNow
• Kubernetes > Job > ServiceNow > Configuration Item
• Kubernetes > Job > ServiceNow > Table
• Kubernetes > Persistent Volume > ServiceNow
• Kubernetes > Persistent Volume > ServiceNow > Configuration Item
• Kubernetes > Persistent Volume > ServiceNow > Table
• Kubernetes > ReplicationController > ServiceNow
• Kubernetes > ReplicationController > ServiceNow > Configuration Item
• Kubernetes > ReplicationController > ServiceNow > Table
• Kubernetes > StatefulSet > ServiceNow
• Kubernetes > StatefulSet > ServiceNow > Configuration Item
• Kubernetes > StatefulSet > ServiceNow > Table

Policy Types

• Kubernetes > CronJob > ServiceNow
• Kubernetes > CronJob > ServiceNow > Configuration Item
• Kubernetes > CronJob > ServiceNow > Configuration Item > Record
• Kubernetes > CronJob > ServiceNow > Configuration Item > Table Definition
• Kubernetes > CronJob > ServiceNow > Table
• Kubernetes > CronJob > ServiceNow > Table > Definition
• Kubernetes > DaemonSet > ServiceNow
• Kubernetes > DaemonSet > ServiceNow > Configuration Item
• Kubernetes > DaemonSet > ServiceNow > Configuration Item > Record
• Kubernetes > DaemonSet > ServiceNow > Configuration Item > Table Definition
• Kubernetes > DaemonSet > ServiceNow > Table
• Kubernetes > DaemonSet > ServiceNow > Table > Definition
• Kubernetes > Ingress > ServiceNow
• Kubernetes > Ingress > ServiceNow > Configuration Item
• Kubernetes > Ingress > ServiceNow > Configuration Item > Record
• Kubernetes > Ingress > ServiceNow > Configuration Item > Table Definition
• Kubernetes > Ingress > ServiceNow > Table
• Kubernetes > Ingress > ServiceNow > Table > Definition
• Kubernetes > Job > ServiceNow
• Kubernetes > Job > ServiceNow > Configuration Item
• Kubernetes > Job > ServiceNow > Configuration Item > Record
• Kubernetes > Job > ServiceNow > Configuration Item > Table Definition
• Kubernetes > Job > ServiceNow > Table
• Kubernetes > Job > ServiceNow > Table > Definition
• Kubernetes > Persistent Volume > ServiceNow
• Kubernetes > Persistent Volume > ServiceNow > Configuration Item
• Kubernetes > Persistent Volume > ServiceNow > Configuration Item > Record
• Kubernetes > Persistent Volume > ServiceNow > Configuration Item > Table Definition
• Kubernetes > Persistent Volume > ServiceNow > Table
• Kubernetes > Persistent Volume > ServiceNow > Table > Definition
• Kubernetes > ReplicationController > ServiceNow
• Kubernetes > ReplicationController > ServiceNow > Configuration Item
• Kubernetes > ReplicationController > ServiceNow > Configuration Item > Record
• Kubernetes > ReplicationController > ServiceNow > Configuration Item > Table Definition
• Kubernetes > ReplicationController > ServiceNow > Table
• Kubernetes > ReplicationController > ServiceNow > Table > Definition
• Kubernetes > StatefulSet > ServiceNow
• Kubernetes > StatefulSet > ServiceNow > Configuration Item
• Kubernetes > StatefulSet > ServiceNow > Configuration Item > Record
• Kubernetes > StatefulSet > ServiceNow > Configuration Item > Table Definition
• Kubernetes > StatefulSet > ServiceNow > Table
• Kubernetes > StatefulSet > ServiceNow > Table > Definition

What's new?

Resource Types

• Kubernetes > CronJob
• Kubernetes > DaemonSet
• Kubernetes > Ingress
• Kubernetes > Job
• Kubernetes > Persistent Volume
• Kubernetes > ReplicationController
• Kubernetes > StatefulSet

Control Types

• Kubernetes > ConfigMap > Active
• Kubernetes > CronJob > Active
• Kubernetes > CronJob > Annotations
• Kubernetes > CronJob > Approved
• Kubernetes > CronJob > CMDB
• Kubernetes > CronJob > Labels
• Kubernetes > CronJob > Query
• Kubernetes > DaemonSet > Active
• Kubernetes > DaemonSet > Annotations
• Kubernetes > DaemonSet > Approved
• Kubernetes > DaemonSet > CMDB
• Kubernetes > DaemonSet > Labels
• Kubernetes > DaemonSet > Query
• Kubernetes > Deployment > Active
• Kubernetes > Ingress > Active
• Kubernetes > Ingress > Annotations
• Kubernetes > Ingress > Approved
• Kubernetes > Ingress > CMDB
• Kubernetes > Ingress > Labels
• Kubernetes > Ingress > Query
• Kubernetes > Job > Active
• Kubernetes > Job > Annotations
• Kubernetes > Job > Approved
• Kubernetes > Job > CMDB
• Kubernetes > Job > Labels
• Kubernetes > Job > Query
• Kubernetes > Namespace > Active
• Kubernetes > Node > Active
• Kubernetes > Persistent Volume > Active
• Kubernetes > Persistent Volume > Annotations
• Kubernetes > Persistent Volume > Approved
• Kubernetes > Persistent Volume > CMDB
• Kubernetes > Persistent Volume > Labels
• Kubernetes > Persistent Volume > Query
• Kubernetes > Pod > Active
• Kubernetes > ReplicaSet > Active
• Kubernetes > ReplicationController > Active
• Kubernetes > ReplicationController > Annotations
• Kubernetes > ReplicationController > Approved
• Kubernetes > ReplicationController > CMDB
• Kubernetes > ReplicationController > Labels
• Kubernetes > ReplicationController > Query
• Kubernetes > Service > Active
• Kubernetes > StatefulSet > Active
• Kubernetes > StatefulSet > Annotations
• Kubernetes > StatefulSet > Approved
• Kubernetes > StatefulSet > CMDB
• Kubernetes > StatefulSet > Labels
• Kubernetes > StatefulSet > Query

Policy Types

• Kubernetes > Cluster > CMDB > Expiration
• Kubernetes > Cluster > CMDB > Expiration > Expiration Days
• Kubernetes > Cluster > osquery
• Kubernetes > Cluster > osquery > Configuration
• Kubernetes > ConfigMap > Active
• Kubernetes > ConfigMap > Active > Age
• Kubernetes > ConfigMap > Active > Last Modified
• Kubernetes > CronJob > Active
• Kubernetes > CronJob > Active > Age
• Kubernetes > CronJob > Active > Last Modified
• Kubernetes > CronJob > Annotations
• Kubernetes > CronJob > Annotations > Template
• Kubernetes > CronJob > Approved
• Kubernetes > CronJob > Approved > Custom
• Kubernetes > CronJob > CMDB
• Kubernetes > CronJob > Labels
• Kubernetes > CronJob > Labels > Template
• Kubernetes > CronJob > osquery
• Kubernetes > CronJob > osquery > Configuration
• Kubernetes > CronJob > osquery > Configuration > Columns
• Kubernetes > CronJob > osquery > Configuration > Interval
• Kubernetes > CronJob > osquery > Configuration > Name
• Kubernetes > DaemonSet > Active
• Kubernetes > DaemonSet > Active > Age
• Kubernetes > DaemonSet > Active > Last Modified
• Kubernetes > DaemonSet > Annotations
• Kubernetes > DaemonSet > Annotations > Template
• Kubernetes > DaemonSet > Approved
• Kubernetes > DaemonSet > Approved > Custom
• Kubernetes > DaemonSet > CMDB
• Kubernetes > DaemonSet > Labels
• Kubernetes > DaemonSet > Labels > Template
• Kubernetes > DaemonSet > osquery
• Kubernetes > DaemonSet > osquery > Configuration
• Kubernetes > DaemonSet > osquery > Configuration > Columns
• Kubernetes > DaemonSet > osquery > Configuration > Interval
• Kubernetes > DaemonSet > osquery > Configuration > Name
• Kubernetes > Deployment > Active
• Kubernetes > Deployment > Active > Age
• Kubernetes > Deployment > Active > Last Modified
• Kubernetes > Ingress > Active
• Kubernetes > Ingress > Active > Age
• Kubernetes > Ingress > Active > Last Modified
• Kubernetes > Ingress > Annotations
• Kubernetes > Ingress > Annotations > Template
• Kubernetes > Ingress > Approved
• Kubernetes > Ingress > Approved > Custom
• Kubernetes > Ingress > CMDB
• Kubernetes > Ingress > Labels
• Kubernetes > Ingress > Labels > Template
• Kubernetes > Ingress > osquery
• Kubernetes > Ingress > osquery > Configuration
• Kubernetes > Ingress > osquery > Configuration > Columns
• Kubernetes > Ingress > osquery > Configuration > Interval
• Kubernetes > Ingress > osquery > Configuration > Name
• Kubernetes > Job > Active
• Kubernetes > Job > Active > Age
• Kubernetes > Job > Active > Last Modified
• Kubernetes > Job > Annotations
• Kubernetes > Job > Annotations > Template
• Kubernetes > Job > Approved
• Kubernetes > Job > Approved > Custom
• Kubernetes > Job > CMDB
• Kubernetes > Job > Labels
• Kubernetes > Job > Labels > Template
• Kubernetes > Job > osquery
• Kubernetes > Job > osquery > Configuration
• Kubernetes > Job > osquery > Configuration > Columns
• Kubernetes > Job > osquery > Configuration > Interval
• Kubernetes > Job > osquery > Configuration > Name
• Kubernetes > Namespace > Active
• Kubernetes > Namespace > Active > Age
• Kubernetes > Namespace > Active > Last Modified
• Kubernetes > Node > Active
• Kubernetes > Node > Active > Age
• Kubernetes > Node > Active > Last Modified
• Kubernetes > Persistent Volume > Active
• Kubernetes > Persistent Volume > Active > Age
• Kubernetes > Persistent Volume > Active > Last Modified
• Kubernetes > Persistent Volume > Annotations
• Kubernetes > Persistent Volume > Annotations > Template
• Kubernetes > Persistent Volume > Approved
• Kubernetes > Persistent Volume > Approved > Custom
• Kubernetes > Persistent Volume > CMDB
• Kubernetes > Persistent Volume > Labels
• Kubernetes > Persistent Volume > Labels > Template
• Kubernetes > Persistent Volume > osquery
• Kubernetes > Persistent Volume > osquery > Configuration
• Kubernetes > Persistent Volume > osquery > Configuration > Columns
• Kubernetes > Persistent Volume > osquery > Configuration > Interval
• Kubernetes > Persistent Volume > osquery > Configuration > Name
• Kubernetes > Pod > Active
• Kubernetes > Pod > Active > Age
• Kubernetes > Pod > Active > Last Modified
• Kubernetes > ReplicaSet > Active
• Kubernetes > ReplicaSet > Active > Age
• Kubernetes > ReplicaSet > Active > Last Modified
• Kubernetes > ReplicationController > Active
• Kubernetes > ReplicationController > Active > Age
• Kubernetes > ReplicationController > Active > Last Modified
• Kubernetes > ReplicationController > Annotations
• Kubernetes > ReplicationController > Annotations > Template
• Kubernetes > ReplicationController > Approved
• Kubernetes > ReplicationController > Approved > Custom
• Kubernetes > ReplicationController > CMDB
• Kubernetes > ReplicationController > Labels
• Kubernetes > ReplicationController > Labels > Template
• Kubernetes > ReplicationController > osquery
• Kubernetes > ReplicationController > osquery > Configuration
• Kubernetes > ReplicationController > osquery > Configuration > Columns
• Kubernetes > ReplicationController > osquery > Configuration > Interval
• Kubernetes > ReplicationController > osquery > Configuration > Name
• Kubernetes > Service > Active
• Kubernetes > Service > Active > Age
• Kubernetes > Service > Active > Last Modified
• Kubernetes > StatefulSet > Active
• Kubernetes > StatefulSet > Active > Age
• Kubernetes > StatefulSet > Active > Last Modified
• Kubernetes > StatefulSet > Annotations
• Kubernetes > StatefulSet > Annotations > Template
• Kubernetes > StatefulSet > Approved
• Kubernetes > StatefulSet > Approved > Custom
• Kubernetes > StatefulSet > CMDB
• Kubernetes > StatefulSet > Labels
• Kubernetes > StatefulSet > Labels > Template
• Kubernetes > StatefulSet > osquery
• Kubernetes > StatefulSet > osquery > Configuration
• Kubernetes > StatefulSet > osquery > Configuration > Columns
• Kubernetes > StatefulSet > osquery > Configuration > Interval
• Kubernetes > StatefulSet > osquery > Configuration > Name

Action Types

• Kubernetes > Cluster > Router
• Kubernetes > CronJob > Router
• Kubernetes > DaemonSet > Router
• Kubernetes > Ingress > Router
• Kubernetes > Job > Router
• Kubernetes > Persistent Volume > Router
• Kubernetes > ReplicationController > Router
• Kubernetes > StatefulSet > Router

Bug fixes

• CMDB controls for various resources sometimes failed to process a large number of updates that occurred in quick succession via Cluster events. We’ve improved our GraphQL queries to handle such a load, and the controls will now be able to process such events more smoothly and reliably than before.

What's new?

• The AWS > S3 > Bucket > CMDB control would go into an error state if Guardrails did not have permissions to call the headBucket operation on a bucket. Users can now ignore such permission errors and allow the CMDB control to run its course to completion. To get started, set the AWS > S3 > Bucket > CMDB policy to Enforce: Enabled but ignore permission errors.

Bug fixes

• Server
  • Minor internal improvements.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• In the previous version, we fixed an issue with the Azure > App Service > Web App > Client Certificate Mode control, ensuring that the Client Certificate Mode is set to Require correctly. However, we missed an edge case where the control wouldn’t enforce any mode other than the default setting of Ignore. We have now addressed all cases, and the control will work more reliably and consistently than before.

What's new?

• Updated AWS Lambda function architecture to ARM64 for improved performance and cost efficiency.

What's new?

• Server

  • Improved memory optimization for Redis.
  • Updated all AWS Lambda functions in the TE environment to use ARM64 architecture for improved performance and cost efficiency.
  • Allow notifications rules to accept nunjucks for Email address.
  • Updated several node packages to newer versions for improved functionality and security.

• UI

  • Smart Folders are now called Policy Packs.
  • Now you can add AKA while creating Policy Packs from UI.

Bug fixes

• Server

  • Fixed an issue where controls remained in TBD state for accounts imported without an External ID.

• UI

  • Removed the unsupported feature for rearranging Policy Packs from the UI.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• The Import Set policies for various Kubernetes resources will no longer include the Enforce: Sync policy value for integrating Import Sets in ServiceNow.

Control Types

• GCP > Storage > Object > ServiceNow > Import Set

Policy Types

• GCP > Storage > Object > ServiceNow > Import Set
• GCP > Storage > Object > ServiceNow > Import Set > Archive Columns
• GCP > Storage > Object > ServiceNow > Import Set > Record
• GCP > Storage > Object > ServiceNow > Import Set > Table Name

Control Types

• GCP > Compute Engine > Disk > ServiceNow > Import Set
• GCP > Compute Engine > HTTP Health Check > ServiceNow > Import Set
• GCP > Compute Engine > HTTPS Health Check > ServiceNow > Import Set
• GCP > Compute Engine > Health Check > ServiceNow > Import Set
• GCP > Compute Engine > Image > ServiceNow > Import Set
• GCP > Compute Engine > Instance > ServiceNow > Import Set
• GCP > Compute Engine > Instance Template > ServiceNow > Import Set
• GCP > Compute Engine > Node Group > ServiceNow > Import Set
• GCP > Compute Engine > Node template > ServiceNow > Import Set
• GCP > Compute Engine > Project > ServiceNow > Import Set
• GCP > Compute Engine > Region Disk > ServiceNow > Import Set
• GCP > Compute Engine > Region Health Check > ServiceNow > Import Set
• GCP > Compute Engine > Snapshot > ServiceNow > Import Set

Policy Types

• GCP > Compute Engine > Disk > ServiceNow > Import Set
• GCP > Compute Engine > Disk > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Disk > ServiceNow > Import Set > Record
• GCP > Compute Engine > Disk > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > HTTP Health Check > ServiceNow > Import Set
• GCP > Compute Engine > HTTP Health Check > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > HTTP Health Check > ServiceNow > Import Set > Record
• GCP > Compute Engine > HTTP Health Check > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > HTTPS Health Check > ServiceNow > Import Set
• GCP > Compute Engine > HTTPS Health Check > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > HTTPS Health Check > ServiceNow > Import Set > Record
• GCP > Compute Engine > HTTPS Health Check > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Health Check > ServiceNow > Import Set
• GCP > Compute Engine > Health Check > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Health Check > ServiceNow > Import Set > Record
• GCP > Compute Engine > Health Check > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Image > ServiceNow > Import Set
• GCP > Compute Engine > Image > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Image > ServiceNow > Import Set > Record
• GCP > Compute Engine > Image > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Instance > ServiceNow > Import Set
• GCP > Compute Engine > Instance > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Instance > ServiceNow > Import Set > Record
• GCP > Compute Engine > Instance > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Instance Template > ServiceNow > Import Set
• GCP > Compute Engine > Instance Template > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Instance Template > ServiceNow > Import Set > Record
• GCP > Compute Engine > Instance Template > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Node Group > ServiceNow > Import Set
• GCP > Compute Engine > Node Group > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Node Group > ServiceNow > Import Set > Record
• GCP > Compute Engine > Node Group > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Node template > ServiceNow > Import Set
• GCP > Compute Engine > Node template > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Node template > ServiceNow > Import Set > Record
• GCP > Compute Engine > Node template > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Project > ServiceNow > Import Set
• GCP > Compute Engine > Project > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Project > ServiceNow > Import Set > Record
• GCP > Compute Engine > Project > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Region Disk > ServiceNow > Import Set
• GCP > Compute Engine > Region Disk > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Region Disk > ServiceNow > Import Set > Record
• GCP > Compute Engine > Region Disk > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Region Health Check > ServiceNow > Import Set
• GCP > Compute Engine > Region Health Check > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Region Health Check > ServiceNow > Import Set > Record
• GCP > Compute Engine > Region Health Check > ServiceNow > Import Set > Table Name
• GCP > Compute Engine > Snapshot > ServiceNow > Import Set
• GCP > Compute Engine > Snapshot > ServiceNow > Import Set > Archive Columns
• GCP > Compute Engine > Snapshot > ServiceNow > Import Set > Record
• GCP > Compute Engine > Snapshot > ServiceNow > Import Set > Table Name

Control Types

• Azure > Storage > Container > ServiceNow > Import Set
• Azure > Storage > FileShare > ServiceNow > Import Set
• Azure > Storage > Queue > ServiceNow > Import Set

Policy Types

• Azure > Storage > Container > ServiceNow > Import Set
• Azure > Storage > Container > ServiceNow > Import Set > Archive Columns
• Azure > Storage > Container > ServiceNow > Import Set > Record
• Azure > Storage > Container > ServiceNow > Import Set > Table Name
• Azure > Storage > FileShare > ServiceNow > Import Set
• Azure > Storage > FileShare > ServiceNow > Import Set > Archive Columns
• Azure > Storage > FileShare > ServiceNow > Import Set > Record
• Azure > Storage > FileShare > ServiceNow > Import Set > Table Name
• Azure > Storage > Queue > ServiceNow > Import Set
• Azure > Storage > Queue > ServiceNow > Import Set > Archive Columns
• Azure > Storage > Queue > ServiceNow > Import Set > Record
• Azure > Storage > Queue > ServiceNow > Import Set > Table Name

Control Types

• Azure > Compute > Availability Set > ServiceNow > Import Set
• Azure > Compute > Disk > ServiceNow > Import Set
• Azure > Compute > Disk Encryption Set > ServiceNow > Import Set
• Azure > Compute > Image > ServiceNow > Import Set
• Azure > Compute > Snapshot > ServiceNow > Import Set
• Azure > Compute > Ssh Public Key > ServiceNow > Import Set
• Azure > Compute > Virtual Machine > ServiceNow > Import Set
• Azure > Compute > Virtual Machine Scale Set > ServiceNow > Import Set

Policy Types

• Azure > Compute > Availability Set > ServiceNow > Import Set
• Azure > Compute > Availability Set > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Availability Set > ServiceNow > Import Set > Record
• Azure > Compute > Availability Set > ServiceNow > Import Set > Table Name
• Azure > Compute > Disk > ServiceNow > Import Set
• Azure > Compute > Disk > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Disk > ServiceNow > Import Set > Record
• Azure > Compute > Disk > ServiceNow > Import Set > Table Name
• Azure > Compute > Disk Encryption Set > ServiceNow > Import Set
• Azure > Compute > Disk Encryption Set > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Disk Encryption Set > ServiceNow > Import Set > Record
• Azure > Compute > Disk Encryption Set > ServiceNow > Import Set > Table Name
• Azure > Compute > Image > ServiceNow > Import Set
• Azure > Compute > Image > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Image > ServiceNow > Import Set > Record
• Azure > Compute > Image > ServiceNow > Import Set > Table Name
• Azure > Compute > Snapshot > ServiceNow > Import Set
• Azure > Compute > Snapshot > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Snapshot > ServiceNow > Import Set > Record
• Azure > Compute > Snapshot > ServiceNow > Import Set > Table Name
• Azure > Compute > Ssh Public Key > ServiceNow > Import Set
• Azure > Compute > Ssh Public Key > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Ssh Public Key > ServiceNow > Import Set > Record
• Azure > Compute > Ssh Public Key > ServiceNow > Import Set > Table Name
• Azure > Compute > Virtual Machine > ServiceNow > Import Set
• Azure > Compute > Virtual Machine > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Virtual Machine > ServiceNow > Import Set > Record
• Azure > Compute > Virtual Machine > ServiceNow > Import Set > Table Name
• Azure > Compute > Virtual Machine Scale Set > ServiceNow > Import Set
• Azure > Compute > Virtual Machine Scale Set > ServiceNow > Import Set > Archive Columns
• Azure > Compute > Virtual Machine Scale Set > ServiceNow > Import Set > Record
• Azure > Compute > Virtual Machine Scale Set > ServiceNow > Import Set > Table Name

Control Types

• AWS > S3 > Bucket > ServiceNow > Import Set

Policy Types

• AWS > S3 > Bucket > ServiceNow > Import Set
• AWS > S3 > Bucket > ServiceNow > Import Set > Archive Columns
• AWS > S3 > Bucket > ServiceNow > Import Set > Record
• AWS > S3 > Bucket > ServiceNow > Import Set > Table Name

What's new?

• Added support to archive Import Sets in ServiceNow.

Bug fixes

• The Azure > App Service > Web App > Client Certificate Mode control did not apply Enforce: Require settings correctly. This is now fixed.

What's new?

• Added support for google_monitoring_alert_policy and google_monitoring_notification_channel Terraform resources.

Control Types

• GCP > Monitoring > Alert Policy > Configured
• GCP > Monitoring > Notification Channel > Configured

Policy Types

• GCP > Monitoring > Alert Policy > Configured
• GCP > Monitoring > Alert Policy > Configured > Claim Precedence
• GCP > Monitoring > Alert Policy > Configured > Source
• GCP > Monitoring > Notification Channel > Configured
• GCP > Monitoring > Notification Channel > Configured > Claim Precedence
• GCP > Monitoring > Notification Channel > Configured > Source

What's new?

• Added support for google_logging_metric Terraform resource.

Control Types

• GCP > Logging > Metric > Configured

Policy Types

• GCP > Logging > Metric > Configured
• GCP > Logging > Metric > Configured > Claim Precedence
• GCP > Logging > Metric > Configured > Source

Bug fixes

• The Azure > Storage > Storage Account > Queue > Logging control failed to set queue logging properties correctly. This issue has been fixed, and the control will now function correctly as intended.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

Bug fixes

• Improved descriptions for various resource types to ensure they are clearer and more helpful.

What's new?

• Users can now configure Shielded Instance Configuration for instances. To get started, set GCP > Compute > Instance > Shielded Instance Configuration > * policies.

Control Types

• GCP > Compute Engine > Instance > Shielded Instance Configuration

Policy Types

• GCP > Compute Engine > Instance > Shielded Instance Configuration
• GCP > Compute Engine > Instance > Shielded Instance Configuration > Integrity Monitoring
• GCP > Compute Engine > Instance > Shielded Instance Configuration > Secure Boot
• GCP > Compute Engine > Instance > Shielded Instance Configuration > vTPM

Action Types

• GCP > Compute Engine > Instance > Set Shielded Instance Configuration

What's new?

• The Azure > CIS v2.0 > 5.05 - Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads) control will also evaluate SQL databases for SKU Basic/Consumption.

Control Types

• Azure > CIS v2.0 > 05 - Logging and Monitoring > 5.01 - Configuring Diagnostic Settings > 5.01.06 - Ensure that Network Security Group Flow logs are captured and sent to Log Analytics

Policy Types

• Azure > CIS v2.0 > 05 - Logging and Monitoring > 5.01 - Configuring Diagnostic Settings > 5.01.06 - Ensure that Network Security Group flow logs are captured and sent to Log Analytics

Bug fixes

• The Azure > CIS v2.0 > 4 - Database Services > 01.03 - Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key control did not evaluate the result correctly, as expected. This is now fixed.

What's new?

DOCUMENTATION:

• resource/turbot_policy_pack: Added documentation for akas attribute for the resource. (#179)

What's new?

• Users can now configure Encryption In Transit for instances. To get started, set the GCP > SQL > Instance > Encryption In Transit policy.

Control Types

• GCP > SQL > Instance > Encryption In Transit

Policy Types

• GCP > SQL > Instance > Encryption In Transit

Action Types

• GCP > SQL > Instance > Update Encryption in Transit

What's new?

Control Types

• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.12 - Ensure API Keys Only Exist for Active Services
• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.13 - Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps
• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.14 - Ensure API Keys Are Restricted to Only APIs That Application Needs Access
• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.15 - Ensure API Keys Are Rotated Every 90 Days

Policy Types

• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.12 - Ensure API Keys Only Exist for Active Services
• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.13 - Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps
• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.14 - Ensure API Keys Are Restricted to Only APIs That Application Needs Access
• GCP > CIS v2.0 > 1 - Identity and Access Management > 1.15 - Ensure API Keys Are Rotated Every 90 Days

What's new?

• Users can now upgrade the SKU from Basic to Standard for Public IP Addresss via Azure > Network > Public IP Address > Standard SKU control. To get started, set the Azure > Network > Public IP Address > Standard SKU policy.

Control Types

• Azure > Network > Public IP Address > Standard SKU

Policy Types

• Azure > Network > Public IP Address > Standard SKU
• Azure > Network > Public IP Address > Standard SKU > SKU Tier

Action Types

• Azure > Network > Public IP Address > Update SKU to Standard

What's new?

• We've added guardrails to help secure access to your database accounts' public endpoints. All database accounts have public endpoints that are accessible through the internet by default. This access can be limited to specific IP ranges, virtual network subnets, and trusted Microsoft services by defining firewall and virtual network rules.

To get started configuring these rules through Guardrails, the following policies should set according to your desired firewall rules configuration:

Azure > Cosmos DB > Database Account > Firewall - Configure default access rules for the public endpoint Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Approved - Remove unapproved IP ranges Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required - Grant access to specific IP ranges Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Approved - Remove unapproved virtual network subnets Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required - Grant access to specific virtual network subnets Please note that if the Azure > Cosmos DB > Database Account > Firewall policy is set to Enforce: Allow only approved virtual networks and IP ranges, only applications in the configured IP ranges, virtual network subnets, and trusted Microsoft services will be allowed to access the database accounts. If these boundaries are not properly configured beforehand or an application is outside of these boundaries, it will lose access to the database accounts.

Control Types

• Azure > Cosmos DB > Database Account > Firewall
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Approved
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Approved
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required

Policy Types

• Azure > Cosmos DB > Database Account > Firewall
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Approved
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Approved > CIDR Ranges
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Approved > Compiled Rules
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Approved > Rules
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required > Compiled Items
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required > Exceptions
• Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required > Items
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Approved
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Approved > Compiled Rules
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Approved > Rules
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Approved > Subnets
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required
• Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required > Items

Action Types

• Azure > Cosmos DB > Database Account > Update Firewall Default Access Rule
• Azure > Cosmos DB > Database Account > Update Firewall IP Ranges
• Azure > Cosmos DB > Database Account > Update Firewall Virtual Networks

Bug fixes

• Various Discovery and CMDB controls entered an error state because they used outdated APIs that no longer functioned as expected. We have updated internal package dependencies, and those controls now operate smoothly as intended.

Bug fixes

• Resolved an issue where an empty outbound_cidr_ranges SSM parameter caused a validation error. Now, if the outbound_cidr_ranges parameter is empty, it will be set to None.

What's new?

• Added M7i and M7i-flex instance type.
• Updated the HealthCheckProxy lambda function to use python 3.10.

Bug fixes

• The GCP > Project > CMDB control went into an error state while fetching Access Approval settings for the project if Access Transparency was disabled at the organization level. We have now handled such cases gracefully, and the control will fetch all available details without going into an error state.

What's new?

• Users can now configure authorized networks for instances in Guardrails. To get started, set the GCP > SQL > Instance > Authorized Network > * policies.
• Users can now configure Database Flags for instances in Guardrails. To get started, set the GCP > SQL > Instance > Database Flags policy.
• Users can now clean up and stop tracking SQL resources in Guardrails. To get started, set the GCP > SQL > CMDB policy to Enforce: Disabled.

Control Types

• GCP > SQL > Instance > Authorized Network
• GCP > SQL > Instance > Authorized Network > Approved
• GCP > SQL > Instance > Database Flags

Policy Types

• GCP > SQL > Instance > Authorized Network
• GCP > SQL > Instance > Authorized Network > Approved
• GCP > SQL > Instance > Authorized Network > Approved > CIDR Ranges
• GCP > SQL > Instance > Database Flags
• GCP > SQL > Instance > Database Flags > MySQL
• GCP > SQL > Instance > Database Flags > MySQL > Template
• GCP > SQL > Instance > Database Flags > PostgreSQL
• GCP > SQL > Instance > Database Flags > PostgreSQL > Template
• GCP > SQL > Instance > Database Flags > SQL Server
• GCP > SQL > Instance > Database Flags > SQL Server > Template

Action Types

• GCP > SQL > Instance > Update Authorized Network
• GCP > SQL > Instance > Update Database Flags

What's new?

• We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Storage resources in Guardrails. This release includes breaking changes in the CMDB data for storage accounts. We recommend updating your existing policy settings to refer to the updated attributes as mentioned below.

  Renamed:

  • serviceProperties.blob.DeleteRetentionPolicy to serviceProperties.blob.deleteRetentionPolicy
  • serviceProperties.blob.DeleteRetentionPolicy.Days to serviceProperties.blob.deleteRetentionPolicy.days
  • serviceProperties.blob.DeleteRetentionPolicy.Enabled to serviceProperties.blob.deleteRetentionPolicy.enabled
  • serviceProperties.blob.StaticWebsite to serviceProperties.blob.staticWebsite
  • serviceProperties.blob.StaticWebsite.Enabled to serviceProperties.blob.staticWebsite.enabled
  • serviceProperties.blob.logging to serviceProperties.blob.blobAnalyticsLogging
  • serviceProperties.queue.logging to serviceProperties.queue.queueAnalyticsLogging

  Added:

  • serviceProperties.blob.deleteRetentionPolicy.AllowPermanentDelete

  Modified:

  • The data type of the attribute serviceProperties.blob.cors has been changed from string ("") to array ([]).
  • The data type of the attribute serviceProperties.queue.cors has been changed from string ("") to array ([]).

• Users can now enable/disable Blob logging for storage accounts. To get started, set the Azure > Storage > Storage Account > Blob > Logging > * policies.

• Users can now check if storage accounts are approved for use based on Infrastructure Encryption settings. To get started, set the Azure > Storage > Storage Account > Approved > Infrastructure Encryption policy.

Control Types

• Azure > Storage > Storage Account > Blob
• Azure > Storage > Storage Account > Blob > Logging

Renamed

• Azure > Storage > Storage Account > Public Access to Azure > Storage > Storage Account > Blob Public Access

Policy Types

• Azure > Storage > Storage Account > Approved > Infrastructure Encryption
• Azure > Storage > Storage Account > Blob
• Azure > Storage > Storage Account > Blob > Logging
• Azure > Storage > Storage Account > Blob > Logging > Properties
• Azure > Storage > Storage Account > Blob > Logging > Retention Days

Renamed

• Azure > Storage > Storage Account > Public Access to Azure > Storage > Storage Account > Blob Public Access

Action Types

• Azure > Storage > Storage Account > Update Storage Account Blob Logging

Renamed

• Azure > Storage > Storage Account > Set Public Access to Azure > Storage > Storage Account > Set Blob Public Access

What's new?

• Users can now configure Client Certificate Mode for web apps. To get started, set the Azure > App Service > Web App > Client Certificate Mode policy.

Control Types

• Azure > App Service > Web App > Client Certificate Mode

Policy Types

• Azure > App Service > Web App > Client Certificate Mode

Action Types

• Azure > App Service > Web App > Set Client Certificate Mode

What's new?

FEATURES:

• New Resource: turbot_policy_pack (#171)
• New Resource: turbot_policy_pack_attachment (#173)

ENHANCEMENTS:

• resource/turbot_smart_folder: The parent argument is now optional and defaults to tmod:@turbot/turbot#/. (#177)

What's new?

Resource Types

• GCP > IAM > API Key

Control Types

• GCP > IAM > API Key > Active
• GCP > IAM > API Key > Approved
• GCP > IAM > API Key > CMDB
• GCP > IAM > API Key > Discovery
• GCP > IAM > API Key > Usage

Policy Types

• GCP > IAM > API Key > Active
• GCP > IAM > API Key > Active > Age
• GCP > IAM > API Key > Active > Last Modified
• GCP > IAM > API Key > Approved
• GCP > IAM > API Key > Approved > Custom
• GCP > IAM > API Key > Approved > Usage
• GCP > IAM > API Key > CMDB
• GCP > IAM > API Key > Usage
• GCP > IAM > API Key > Usage > Limit

Action Types

• GCP > IAM > API Key > Delete
• GCP > IAM > API Key > Router

What's new?

• You can now configure Encryption at Rest for datasets. To get started, set the GCP > BigQuery > Dataset > Encryption at Rest > * policies.

Control Types

• GCP > BigQuery > Dataset > Encryption at Rest

Policy Types

• GCP > BigQuery > Dataset > Encryption at Rest
• GCP > BigQuery > Dataset > Encryption at Rest > Customer Managed Key

Action Types

• GCP > BigQuery > Dataset > Update Encryption At Rest

What's new?

Control Types

• Kubernetes > Cluster > ServiceNow > Import Set
• Kubernetes > ConfigMap > ServiceNow > Import Set
• Kubernetes > Deployment > ServiceNow > Import Set
• Kubernetes > Namespace > ServiceNow > Import Set
• Kubernetes > Node > ServiceNow > Import Set
• Kubernetes > Pod > ServiceNow > Import Set
• Kubernetes > ReplicaSet > ServiceNow > Import Set
• Kubernetes > Service > ServiceNow > Import Set

Policy Types

• Kubernetes > Cluster > ServiceNow > Import Set
• Kubernetes > Cluster > ServiceNow > Import Set > Archive Columns
• Kubernetes > Cluster > ServiceNow > Import Set > Record
• Kubernetes > Cluster > ServiceNow > Import Set > Table Name
• Kubernetes > ConfigMap > ServiceNow > Import Set
• Kubernetes > ConfigMap > ServiceNow > Import Set > Archive Columns
• Kubernetes > ConfigMap > ServiceNow > Import Set > Record
• Kubernetes > ConfigMap > ServiceNow > Import Set > Table Name
• Kubernetes > Deployment > ServiceNow > Import Set
• Kubernetes > Deployment > ServiceNow > Import Set > Archive Columns
• Kubernetes > Deployment > ServiceNow > Import Set > Record
• Kubernetes > Deployment > ServiceNow > Import Set > Table Name
• Kubernetes > Namespace > ServiceNow > Import Set
• Kubernetes > Namespace > ServiceNow > Import Set > Archive Columns
• Kubernetes > Namespace > ServiceNow > Import Set > Record
• Kubernetes > Namespace > ServiceNow > Import Set > Table Name
• Kubernetes > Node > ServiceNow > Import Set
• Kubernetes > Node > ServiceNow > Import Set > Archive Columns
• Kubernetes > Node > ServiceNow > Import Set > Record
• Kubernetes > Node > ServiceNow > Import Set > Table Name
• Kubernetes > Pod > ServiceNow > Import Set
• Kubernetes > Pod > ServiceNow > Import Set > Archive Columns
• Kubernetes > Pod > ServiceNow > Import Set > Record
• Kubernetes > Pod > ServiceNow > Import Set > Table Name
• Kubernetes > ReplicaSet > ServiceNow > Import Set
• Kubernetes > ReplicaSet > ServiceNow > Import Set > Archive Columns
• Kubernetes > ReplicaSet > ServiceNow > Import Set > Record
• Kubernetes > ReplicaSet > ServiceNow > Import Set > Table Name
• Kubernetes > Service > ServiceNow > Import Set
• Kubernetes > Service > ServiceNow > Import Set > Archive Columns
• Kubernetes > Service > ServiceNow > Import Set > Record
• Kubernetes > Service > ServiceNow > Import Set > Table Name

Bug fixes

• Guardrails failed to process real-time snapshot events if the AWS > EC2 > Snapshot > CMDB policy was set to Enforce: Enabled for Snapshots not created with AWS Backup. This issue has now been fixed.

What's new?

• Users can now configure DNSSEC for managed zones via Guardrails. To get started, set theGCP > DNS > Managed Zone > DNSSEC Configuration policy.
• Users can now configure logging for DNS policies. To get started, set the GCP > DNS > Policy > Logging policy.

Control Types

• GCP > DNS > Managed Zone > DNSSEC Configuration
• GCP > DNS > Policy > Logging

Policy Types

• GCP > DNS > Managed Zone > DNSSEC Configuration
• GCP > DNS > Policy > Logging

Action Types

• GCP > DNS > Managed Zone > Update DNSSEC Configuration
• GCP > DNS > Policy > Update Logging

Bug fixes

• Discovery controls for various resource types would go into an error state without discovering resources and upserting them in Guardrails CMDB due to a bad internal build. This issue has been fixed, and those controls will now work correctly as expected.

What's new?

• Users can now enable/disable Trusted Launch for all second generation virtual machines. To get started, set the Azure > Compute > Virtual Machine > Trusted launch policy.
• You can now configure Encryption at Rest for Disks. To get started, set the Azure > Compute > Disk > Encryption at Rest > * policies.

Control Types

• Azure > Compute > Disk > Encryption at Rest
• Azure > Compute > Virtual Machine > Trusted Launch

Policy Types

• Azure > Compute > Disk > Encryption at Rest
• Azure > Compute > Disk > Encryption at Rest > Disk Encryption Set
• Azure > Compute > Virtual Machine > Trusted launch

Action Types

• Azure > Compute > Disk > Update Encryption at Rest
• Azure > Compute > Virtual Machine > Update Trusted Luanch

What's new?

• User can now register web apps with Entra ID to connect to other Azure services securely without the need for usernames and passwords. To get started, set the Azure > App Service > Web App > System Assigned Identity policy.
• Diagnostic Settings details will now also be available for Web Apps in Guardrails CMDB.

Control Types

• Azure > App Service > Web App > System Assigned Identity

Policy Types

• Azure > App Service > Web App > System Assigned Identity

Action Types

• Azure > App Service > Web App > Set System Assigned Identity

Bug fixes

• The Azure > App Service > Web App > FTPS State control failed to set the FTPS State correctly for web apps. This issue is now fixed.

What's new?

Policy Types

• GCP > BigQuery > Dataset > Approved > Custom

What's new?

• Users can now configure retention policy for flow logs. To get started, set the Azure > Network Watcher > Flow Log > Retention Policy > * policies.

Control Types

• Azure > Network Watcher > Flow Log > Retention Policy

Policy Types

• Azure > Network Watcher > Flow Log > Retention Policy
• Azure > Network Watcher > Flow Log > Retention Policy > Days

Action Types

• Azure > Network Watcher > Flow Log > Update Retention Policy

What's new?

• The Azure > Active Directory > Directory > CMDB control will now also fetch named locations and authorization policy details and store them in CMDB.

Bug fixes

• Account Password Policy details did not refresh correctly in Guardrails CMDB if those settings were reset to defaults in AWS. This resulted in the AWS > IAM > Account Password Policy > Settings control not applying custom settings correctly. This issue is fixed, and the CMDB details will now refresh correctly, allowing the corresponding Settings control to work as expected.

What's new?

• The Azure > Security Center > Security Center > CMDB control will now also fetch security settings details and store them in CMDB.

Bug fixes

• Discovery controls for various resource types would go into an error state without discovering resources and upserting them in Guardrails CMDB due to a bad internal build. This issue has been fixed, and those controls will now work correctly as expected.

Bug fixes

• Server
  • Resolved an issue that caused control targeting to accounts fail when AWS Gov accounts were imported in commercial environment.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

The default value for GCP > Storage > Bucket > ServiceNow > Import Set now shows the resource_type_uri correctly.

Control Types

Added

• GCP > Storage > Bucket > ServiceNow > Import Set

Policy Types

Added

• GCP > Storage > Bucket > ServiceNow > Import Set
• GCP > Storage > Bucket > ServiceNow > Import Set > Archive Columns
• GCP > Storage > Bucket > ServiceNow > Import Set > Record
• GCP > Storage > Bucket > ServiceNow > Import Set > Table Name

What's new?

• ServiceNow > Turbot > Watches > GCP Archive and Delete Record action now supports archiving Import Set records.

Control Types

Added

• Azure > Storage > Storage Account > ServiceNow > Import Set

Policy Types

Added

• Azure > Storage > Storage Account > ServiceNow > Import Set
• Azure > Storage > Storage Account > ServiceNow > Import Set > Archive Columns
• Azure > Storage > Storage Account > ServiceNow > Import Set > Record
• Azure > Storage > Storage Account > ServiceNow > Import Set > Table Name

What's new?

• ServiceNow > Turbot > Watches > Azure Archive and Delete Record action now supports archiving Import Set records.

Bug fixes

• Default policy values for ServiceNow > Application > CMDB, ServiceNow > Cost Center > CMDB & ServiceNow > User > CMDB have been updated from Enforce: Enabled to Skip.

Policy Types

Added

• ServiceNow > Import Set
• ServiceNow > Import Set > Table Name [Default]

Bug fixes

• Server
  • Minor internal improvements.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• Server
  • The OUTBOUND_SECURITY_GROUP_ID environment variable in Lambda functions now defaults to using the TEF outbound security group when there is no override specified in TEF and TE.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• The Azure > Network > Network Security Group > Ingress Rules > Approved and Azure > Network > Network Security Group > Egress Rules > Approved controls previously deleted an entire rule if at least one of the corresponding port prefixes was rejected, even if the others were approved. These controls will now revoke only the rejected port prefixes instead of deleting the entire rule in such cases.

Bug fixes

• The AWS > RDS > DB Instance > Approved control will now be skipped for instances that belong to a cluster. To check if a cluster is approved for use, please set the AWS > RDS > DB Cluster > Approved > * policies.
• The AWS > RDS > DB Instance > Approved control did not stop an unapproved instance if the corresponding policy was set to Enforce: Stop unapproved or Enforce: Stop unapproved if new, and deletion protection for the instance was enabled. The control will now stop instances correctly in such cases.

What's new?

• Server
  • The creation of the EncryptionInTransit TopicPolicy has shifted from a custom resource to AWS CloudFormation’s AWS::SNS::TopicPolicy.

Bug fixes

• Server
  • Changes to notifications introduced in version 5.44.2 have been rolled back due to issues with specific queries. This action restores previous functionality and ensures stability across the platform.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

What's new?

• Server

  • Made notifications faster by improving the query, which enhances the performance of the activity tab.

• UI

  • The Depends-on tab on the controls page has been renamed to Related. It now includes the information from the Depends-on tab along with additional related controls information.

Bug fixes

• Server
  • Fixed an issue where sometimes an older mod version was used instead of the latest one after a mod upgrade. Now, the cache is properly updated to always use the latest version.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• The Azure > Network > Network Security Group > Ingress Rules > Approved control would sometimes fail to revoke rejected rules when the corresponding policy was set to Enforce: Delete unapproved. This has been fixed, and the control will now work more reliably and consistently than before.

Bug fixes

• Turbot > osquery > Event Handler action was not able to handle events for large payloads. This issue is now fixed.

Bug fixes

• The GCP > Project > CMDB control would incorrectly delete a project from Guardrails CMDB if it was unable to fetch Access Approval settings for the project. This issue has been fixed and the control will now attempt to fetch all available details and will not delete the project from CMDB.

Bug fixes

• Users can now configure Auto Provisioning for Azure Security Center in Guardrails. To get started, set the Azure > Security Center > Security Center > Auto Provisioning policy.

Control Types

• Azure > Security Center > Security Center > Auto Provisioning

Policy Types

• Azure > Security Center > Security Center > Auto Provisioning

Action Types

• Azure > Security Center > Security Center > Update Auto Provisioning

What's new?

• Subscription CMDB data will now also include tagging details for the subscription.

What's new?

• The Azure > Security Center > Security Center > Defender Plan control now also supports services like Cloud Posture, Containers and Cosmos DB.

What's new?

• Server

  • Added support for newer auth mechanism to fetch temporary Azure credentials via the @azure/msal-node package.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

What's new?

• Users can now skip upserting snapshots in Guardrails CMDB if they are created via the AWS Backup service. To get started, set the AWS > EC2 > Snapshot > CMDB policy to Enforce: Enabled for Snapshots not created with AWS Backup.

Bug fixes

• The AWS > Turbot > Service Roles > Source policy went to an invalid state if all but the AWS > Turbot > Service Roles > Event Handlers [Global] policy was enabled. This issue impacted the AWS > Turbot > Service Roles stack control, preventing the role from being created correctly. This has been fixed, and the AWS > Turbot > Service Roles > Source policy will now work as expected.

Bug fixes

• The AWS > CIS v3.0 > 1 - Identity and Access Management > 1.02 - Ensure security contact information is registered control did not evaluate the result correctly, as expected. This is now fixed.

What's new?

• Updated the existing Flags attribute to include new specific flags that control the operation of Mod Lambda functions within a Virtual Private Cloud (VPC). This update allows Lambdas to use static IP addresses, improving network stability and predictability across different cloud environments. New flags Added to Flags Attribute:

  • LAMBDA_IN_VPC_AWS
  • LAMBDA_IN_VPC_AZURE
  • LAMBDA_IN_VPC_GCP
  • LAMBDA_IN_VPC_SERVICENOW

• Introduced a new SSM parameter outbound_cidr_ranges to retrieve the Elastic IPs associated with the NAT gateways.

What's new?

• Server

  • You can now configure Mod Lambda functions to run within a VPC across various providers including AWS, Azure, ServiceNow, and GCP. This update ensures Lambdas operate with static CIDR ranges.
  • Enhanced osquery/logger API to support payloads up to 10MB.

Requirements

• TEF: 1.59.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• Minor fixes and improvements.

Bug fixes

• The AWS > CIS v2.0 > 1 - Identity and Access Management > 1.02 - Ensure security contact information is registered control did not evaluate the result correctly, as expected. This is now fixed.

Bug fixes

• The Azure > Network > Network Security Group > Ingress Rules > Approved and Azure > Network > Network Security Group > Egress Rules > Approved controls previously deleted an entire rule if at least one of the corresponding address prefixes was rejected, even if the others were approved. These controls will now revoke only the rejected address prefix instead of deleting the entire rule in such cases.

Bug fixes

• The GCP > Turbot > Event Handlers > Logging would go into an Invalid state because of incorrect filter patterns defined in the GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter > @turbot/gcp-bigquerydatatransfer policy. This is fixed and the control will now work as expected.

Bug fixes

• Guardrails would sometimes process the real-time event compute.networks.delete for default networks incorrectly, resulting in the inadvertent deletion of those networks from CMDB. This is now fixed.

What's new?

Resource Types

• AWS > AppFabric

Policy Types

• AWS > AppFabric > API Enabled
• AWS > AppFabric > Approved Regions [Default]
• AWS > AppFabric > Enabled
• AWS > AppFabric > Permissions
• AWS > AppFabric > Permissions > Levels
• AWS > AppFabric > Permissions > Levels > Modifiers
• AWS > AppFabric > Permissions > Lockdown
• AWS > AppFabric > Permissions > Lockdown > API Boundary
• AWS > AppFabric > Regions
• AWS > AppFabric > Tags Template [Default]
• AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-appfabric
• AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-appfabric
• AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-appfabric

What's new?

Control Types

• GCP > IAM > Project User > Approved

Policy Types

• GCP > IAM > Project User > Approved
• GCP > IAM > Project User > Approved > Custom
• GCP > IAM > Project User > Approved > Usage

Bug fixes

• Guardrails failed to process the real-time event s3:PutBucketReplication for buckets. This is now fixed.
• The AWS > S3 > Bucket > Access Logging control would sometimes go into an error state if the target bucket name started with a number. This is fixed and the control will now work more smoothly and consistently than before.

Bug fixes

• Guardrails failed to discover system storage containers (e.g. $logs) for storage accounts. This is now fixed.

Bug fixes

• Added support to process enable and disable real-time events for BigQuery Data Transfer API via Service Usage APIs.

5.0.0 (2024-05-15)

What's new?

Resource Types

• GCP > BigQuery Data Transfer
• GCP > BigQuery Data Transfer > Transfer Config

Control Types

• GCP > BigQuery Data Transfer > API Enabled
• GCP > BigQuery Data Transfer > CMDB
• GCP > BigQuery Data Transfer > Discovery
• GCP > BigQuery Data Transfer > Transfer Config > Active
• GCP > BigQuery Data Transfer > Transfer Config > Approved
• GCP > BigQuery Data Transfer > Transfer Config > CMDB
• GCP > BigQuery Data Transfer > Transfer Config > Discovery
• GCP > BigQuery Data Transfer > Transfer Config > Usage

Policy Types

• GCP > BigQuery Data Transfer > API Enabled
• GCP > BigQuery Data Transfer > Approved Regions [Default]
• GCP > BigQuery Data Transfer > CMDB
• GCP > BigQuery Data Transfer > Enabled
• GCP > BigQuery Data Transfer > Permissions
• GCP > BigQuery Data Transfer > Permissions > Levels
• GCP > BigQuery Data Transfer > Permissions > Levels > Modifiers
• GCP > BigQuery Data Transfer > Regions
• GCP > BigQuery Data Transfer > Transfer Config > Active
• GCP > BigQuery Data Transfer > Transfer Config > Active > Age
• GCP > BigQuery Data Transfer > Transfer Config > Active > Last Modified
• GCP > BigQuery Data Transfer > Transfer Config > Approved
• GCP > BigQuery Data Transfer > Transfer Config > Approved > Custom
• GCP > BigQuery Data Transfer > Transfer Config > Approved > Usage
• GCP > BigQuery Data Transfer > Transfer Config > CMDB
• GCP > BigQuery Data Transfer > Transfer Config > Regions
• GCP > BigQuery Data Transfer > Transfer Config > Usage
• GCP > BigQuery Data Transfer > Transfer Config > Usage > Limit
• GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter > @turbot/gcp-bigquerydatatransfer
• GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-bigquerydatatransfer
• GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-bigquerydatatransfer

Action Types

• GCP > BigQuery Data Transfer > Set API Enabled
• GCP > BigQuery Data Transfer > Transfer Config > Delete
• GCP > BigQuery Data Transfer > Transfer Config > Router

Bug fixes

• Fixed control category titles to use osquery instead of Osquery.

Bug fixes

• Kubernetes > Node resources will no longer include the conditions.lastHeartbeatTime or resource_version properties to avoid unnecessary notifications in the activity tab.

What's new?

Resource Types

• AWS > EventBridge Scheduler

Policy Types

• AWS > EventBridge Scheduler > API Enabled
• AWS > EventBridge Scheduler > Approved Regions [Default]
• AWS > EventBridge Scheduler > Enabled
• AWS > EventBridge Scheduler > Permissions
• AWS > EventBridge Scheduler > Permissions > Levels
• AWS > EventBridge Scheduler > Permissions > Levels > Modifiers
• AWS > EventBridge Scheduler > Permissions > Lockdown
• AWS > EventBridge Scheduler > Permissions > Lockdown > API Boundary
• AWS > EventBridge Scheduler > Regions
• AWS > EventBridge Scheduler > Tags Template [Default]
• AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-eventbridgescheduler
• AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-eventbridgescheduler
• AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-eventbridgescheduler

What's new?

Resource Types

• AWS > EventBridge Pipes

Policy Types

• AWS > EventBridge Pipes > API Enabled
• AWS > EventBridge Pipes > Approved Regions [Default]
• AWS > EventBridge Pipes > Enabled
• AWS > EventBridge Pipes > Permissions
• AWS > EventBridge Pipes > Permissions > Levels
• AWS > EventBridge Pipes > Permissions > Levels > Modifiers
• AWS > EventBridge Pipes > Permissions > Lockdown
• AWS > EventBridge Pipes > Permissions > Lockdown > API Boundary
• AWS > EventBridge Pipes > Regions
• AWS > EventBridge Pipes > Tags Template [Default]
• AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-eventbridgepipes
• AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-eventbridgepipes
• AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-eventbridgepipes

What's new?

• Server

  • Added a new GraphQL resolver for osquery to generate an enrollSecret.
  • Added new REST APIs for osquery management, which includes:
    • api/latest/osquery/enroll
    • api/latest/osquery/config
    • api/latest/osquery/logger
  • Introduced a dedicated worker, along with SQS FIFO queue and SNS topic FIFO, to run osquery operations.
  • Implemented a new serviceNowCredential resolver specifically for Kubernetes clusters.
  • Upgraded our SDK (@turbot/sdk) to version 5.15.0 and our fn toolkit (@turbot/fn) to version 5.22.0, to support FIFO queues.

• UI

  • Added support for connecting to Kubernetes, facilitating easier integration and management.
  • Added report for AWS CIS v2.0.
  • Added report for AWS CIS v3.0.
  • Added report for Azure CIS v2.0.
  • Added report for GCP CIS v2.0.

Requirements

• TEF: 1.58.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

What's new?

Control Types

• Kubernetes > Cluster > ServiceNow
• Kubernetes > Cluster > ServiceNow > Configuration Item
• Kubernetes > Cluster > ServiceNow > Table
• Kubernetes > ConfigMap > ServiceNow
• Kubernetes > ConfigMap > ServiceNow > Configuration Item
• Kubernetes > ConfigMap > ServiceNow > Table
• Kubernetes > Deployment > ServiceNow
• Kubernetes > Deployment > ServiceNow > Configuration Item
• Kubernetes > Deployment > ServiceNow > Table
• Kubernetes > Namespace > ServiceNow
• Kubernetes > Namespace > ServiceNow > Configuration Item
• Kubernetes > Namespace > ServiceNow > Table
• Kubernetes > Node > ServiceNow
• Kubernetes > Node > ServiceNow > Configuration Item
• Kubernetes > Node > ServiceNow > Table
• Kubernetes > Pod > ServiceNow
• Kubernetes > Pod > ServiceNow > Configuration Item
• Kubernetes > Pod > ServiceNow > Table
• Kubernetes > ReplicaSet > ServiceNow
• Kubernetes > ReplicaSet > ServiceNow > Configuration Item
• Kubernetes > ReplicaSet > ServiceNow > Table
• Kubernetes > Service > ServiceNow
• Kubernetes > Service > ServiceNow > Configuration Item
• Kubernetes > Service > ServiceNow > Table
• ServiceNow > Turbot > Watches > Kubernetes

Policy Types

• Kubernetes > Cluster > ServiceNow
• Kubernetes > Cluster > ServiceNow > Configuration Item
• Kubernetes > Cluster > ServiceNow > Configuration Item > Record
• Kubernetes > Cluster > ServiceNow > Configuration Item > Table Definition
• Kubernetes > Cluster > ServiceNow > Table
• Kubernetes > Cluster > ServiceNow > Table > Definition
• Kubernetes > ConfigMap > ServiceNow
• Kubernetes > ConfigMap > ServiceNow > Configuration Item
• Kubernetes > ConfigMap > ServiceNow > Configuration Item > Record
• Kubernetes > ConfigMap > ServiceNow > Configuration Item > Table Definition
• Kubernetes > ConfigMap > ServiceNow > Table
• Kubernetes > ConfigMap > ServiceNow > Table > Definition
• Kubernetes > Deployment > ServiceNow
• Kubernetes > Deployment > ServiceNow > Configuration Item
• Kubernetes > Deployment > ServiceNow > Configuration Item > Record
• Kubernetes > Deployment > ServiceNow > Configuration Item > Table Definition
• Kubernetes > Deployment > ServiceNow > Table
• Kubernetes > Deployment > ServiceNow > Table > Definition
• Kubernetes > Namespace > ServiceNow
• Kubernetes > Namespace > ServiceNow > Configuration Item
• Kubernetes > Namespace > ServiceNow > Configuration Item > Record
• Kubernetes > Namespace > ServiceNow > Configuration Item > Table Definition
• Kubernetes > Namespace > ServiceNow > Table
• Kubernetes > Namespace > ServiceNow > Table > Definition
• Kubernetes > Node > ServiceNow
• Kubernetes > Node > ServiceNow > Configuration Item
• Kubernetes > Node > ServiceNow > Configuration Item > Record
• Kubernetes > Node > ServiceNow > Configuration Item > Table Definition
• Kubernetes > Node > ServiceNow > Table
• Kubernetes > Node > ServiceNow > Table > Definition
• Kubernetes > Pod > ServiceNow
• Kubernetes > Pod > ServiceNow > Configuration Item
• Kubernetes > Pod > ServiceNow > Configuration Item > Record
• Kubernetes > Pod > ServiceNow > Configuration Item > Table Definition
• Kubernetes > Pod > ServiceNow > Table
• Kubernetes > Pod > ServiceNow > Table > Definition
• Kubernetes > ReplicaSet > ServiceNow
• Kubernetes > ReplicaSet > ServiceNow > Configuration Item
• Kubernetes > ReplicaSet > ServiceNow > Configuration Item > Record
• Kubernetes > ReplicaSet > ServiceNow > Configuration Item > Table Definition
• Kubernetes > ReplicaSet > ServiceNow > Table
• Kubernetes > ReplicaSet > ServiceNow > Table > Definition
• Kubernetes > Service > ServiceNow
• Kubernetes > Service > ServiceNow > Configuration Item
• Kubernetes > Service > ServiceNow > Configuration Item > Record
• Kubernetes > Service > ServiceNow > Configuration Item > Table Definition
• Kubernetes > Service > ServiceNow > Table
• Kubernetes > Service > ServiceNow > Table > Definition
• ServiceNow > Turbot > Watches > Kubernetes

Action Types

• ServiceNow > Turbot > Watches > Kubernetes Archive And Delete Record

What's new?

Resource Types

• osquery

Control Types

• Turbot > Workspace > osquery
• Turbot > Workspace > osquery > Secret Rotation

Policy Types

• Turbot > Workspace > osquery
• Turbot > Workspace > osquery > Enroll Secret Expiration
• Turbot > Workspace > osquery > Secrets
• Turbot > Workspace > osquery > Secrets > Expiration Period
• Turbot > Workspace > osquery > Secrets > Rotation
• osquery > Configuration

Action Types

• Turbot > Rotate osquery Secret
• osquery > Event Handler

What's new?

Resource Types

• Kubernetes
• Kubernetes > Cluster
• Kubernetes > ConfigMap
• Kubernetes > Deployment
• Kubernetes > Namespace
• Kubernetes > Node
• Kubernetes > Pod
• Kubernetes > ReplicaSet
• Kubernetes > Service

Control Types

• Kubernetes > Cluster > CMDB
• Kubernetes > ConfigMap > Annotations
• Kubernetes > ConfigMap > Approved
• Kubernetes > ConfigMap > CMDB
• Kubernetes > ConfigMap > Labels
• Kubernetes > ConfigMap > Query
• Kubernetes > Deployment > Annotations
• Kubernetes > Deployment > Approved
• Kubernetes > Deployment > CMDB
• Kubernetes > Deployment > Labels
• Kubernetes > Deployment > Query
• Kubernetes > Namespace > Annotations
• Kubernetes > Namespace > Approved
• Kubernetes > Namespace > CMDB
• Kubernetes > Namespace > Labels
• Kubernetes > Namespace > Query
• Kubernetes > Node > Annotations
• Kubernetes > Node > Approved
• Kubernetes > Node > CMDB
• Kubernetes > Node > Labels
• Kubernetes > Node > Query
• Kubernetes > Pod > Annotations
• Kubernetes > Pod > Approved
• Kubernetes > Pod > CMDB
• Kubernetes > Pod > Labels
• Kubernetes > Pod > Query
• Kubernetes > ReplicaSet > Annotations
• Kubernetes > ReplicaSet > Approved
• Kubernetes > ReplicaSet > CMDB
• Kubernetes > ReplicaSet > Labels
• Kubernetes > ReplicaSet > Query
• Kubernetes > Service > Annotations
• Kubernetes > Service > Approved
• Kubernetes > Service > CMDB
• Kubernetes > Service > Labels
• Kubernetes > Service > Query

Policy Types

• Kubernetes > Cluster > CMDB
• Kubernetes > ConfigMap > Annotations
• Kubernetes > ConfigMap > Annotations > Template
• Kubernetes > ConfigMap > Approved
• Kubernetes > ConfigMap > Approved > Custom
• Kubernetes > ConfigMap > CMDB
• Kubernetes > ConfigMap > Labels
• Kubernetes > ConfigMap > Labels > Template
• Kubernetes > ConfigMap > osquery
• Kubernetes > ConfigMap > osquery > Configuration
• Kubernetes > ConfigMap > osquery > Configuration > Columns
• Kubernetes > ConfigMap > osquery > Configuration > Interval
• Kubernetes > ConfigMap > osquery > Configuration > Name
• Kubernetes > Deployment > Annotations
• Kubernetes > Deployment > Annotations > Template
• Kubernetes > Deployment > Approved
• Kubernetes > Deployment > Approved > Custom
• Kubernetes > Deployment > CMDB
• Kubernetes > Deployment > Labels
• Kubernetes > Deployment > Labels > Template
• Kubernetes > Deployment > osquery
• Kubernetes > Deployment > osquery > Configuration
• Kubernetes > Deployment > osquery > Configuration > Columns
• Kubernetes > Deployment > osquery > Configuration > Interval
• Kubernetes > Deployment > osquery > Configuration > Name
• Kubernetes > Namespace > Annotations
• Kubernetes > Namespace > Annotations > Template
• Kubernetes > Namespace > Approved
• Kubernetes > Namespace > Approved > Custom
• Kubernetes > Namespace > CMDB
• Kubernetes > Namespace > Labels
• Kubernetes > Namespace > Labels > Template
• Kubernetes > Namespace > osquery
• Kubernetes > Namespace > osquery > Configuration
• Kubernetes > Namespace > osquery > Configuration > Columns
• Kubernetes > Namespace > osquery > Configuration > Interval
• Kubernetes > Namespace > osquery > Configuration > Name
• Kubernetes > Node > Annotations
• Kubernetes > Node > Annotations > Template
• Kubernetes > Node > Approved
• Kubernetes > Node > Approved > Custom
• Kubernetes > Node > CMDB
• Kubernetes > Node > Labels
• Kubernetes > Node > Labels > Template
• Kubernetes > Node > osquery
• Kubernetes > Node > osquery > Configuration
• Kubernetes > Node > osquery > Configuration > Columns
• Kubernetes > Node > osquery > Configuration > Interval
• Kubernetes > Node > osquery > Configuration > Name
• Kubernetes > Pod > Annotations
• Kubernetes > Pod > Annotations > Template
• Kubernetes > Pod > Approved
• Kubernetes > Pod > Approved > Custom
• Kubernetes > Pod > CMDB
• Kubernetes > Pod > Labels
• Kubernetes > Pod > Labels > Template
• Kubernetes > Pod > osquery
• Kubernetes > Pod > osquery > Configuration
• Kubernetes > Pod > osquery > Configuration > Columns
• Kubernetes > Pod > osquery > Configuration > Interval
• Kubernetes > Pod > osquery > Configuration > Name
• Kubernetes > ReplicaSet > Annotations
• Kubernetes > ReplicaSet > Annotations > Template
• Kubernetes > ReplicaSet > Approved
• Kubernetes > ReplicaSet > Approved > Custom
• Kubernetes > ReplicaSet > CMDB
• Kubernetes > ReplicaSet > Labels
• Kubernetes > ReplicaSet > Labels > Template
• Kubernetes > ReplicaSet > osquery
• Kubernetes > ReplicaSet > osquery > Configuration
• Kubernetes > ReplicaSet > osquery > Configuration > Columns
• Kubernetes > ReplicaSet > osquery > Configuration > Interval
• Kubernetes > ReplicaSet > osquery > Configuration > Name
• Kubernetes > Service > Annotations
• Kubernetes > Service > Annotations > Template
• Kubernetes > Service > Approved
• Kubernetes > Service > Approved > Custom
• Kubernetes > Service > CMDB
• Kubernetes > Service > Labels
• Kubernetes > Service > Labels > Template
• Kubernetes > Service > osquery
• Kubernetes > Service > osquery > Configuration
• Kubernetes > Service > osquery > Configuration > Columns
• Kubernetes > Service > osquery > Configuration > Interval
• Kubernetes > Service > osquery > Configuration > Name
• Kubernetes > osquery
• Kubernetes > osquery > Decorators

Action Types

• Kubernetes > ConfigMap > Router
• Kubernetes > Deployment > Router
• Kubernetes > Namespace > Router
• Kubernetes > Node > Router
• Kubernetes > Pod > Router
• Kubernetes > ReplicaSet > Router
• Kubernetes > Service > Router

Bug fixes

• The GCP > IAM > Service Account Key > Active control will no longer attempt to delete a system-managed service account key deemed inactive by the control.

What's new?

• You can now determine if an IAM access key for a user is latest and deactivate or delete any keys that are not, using Guardrails. To get started, set the AWS > IAM > Access Key > Active > Latest policy.
• You can now determine if an IAM server certificate is active based on its expiration. To get started, set the AWS > IAM > Server Certificate > Active > Expired policy.

Policy Types

• AWS > IAM > Access Key > Active > Latest
• AWS > IAM > Server Certificate > Active > Expired

Bug fixes

• The GCP > Project > CMDB control would go into an error state if Access Approval API was disabled in GCP. This is now fixed.

What's new?

• Implemented SNS topic to handle critical alarms notifications.
• Added Product, Vendor Tags to the IAM Role resources created by the TEF stack.
• Introduced a new SSM parameter to manage the reserved concurrency settings for the osquery worker lambda function.
• Updated Log Bucket Lifecycle Policies:
  • Increased Retention Period: Extended the retention period of the lifecycle policy for logs in the log bucket with the /processes prefix from 1 day to 2 days.
  • New Policy Addition: Implemented a new lifecycle policy for managing log retention in the log bucket for logs with the /osquery prefix.

What's new?

• Implemented critical alarms for RDS DB CPU utilization, DB Max Connections and Redis ElastiCache Memory utilization.
• Added Product, Vendor Tags to the IAM Role resources created by the TED stack.

Bug fixes

• The Azure > Compute > Virtual Machine Scale Set > Tags control would sometimes fail to update tags correctly for Scale Sets launched via Azure marketplace. This is fixed and the control will now update tags correctly, as expected.

What's new?

• Revoke ingress rules that are unapproved for use in Network ACLs. To get started, set the AWS > VPC > Network ACL > Ingress Rules > Approved > * policies.

Bug fixes

• Minor fixes and improvements.

What's new?

• You can now delete existing Mount Targets which are unapproved for use in the account. To get started, set the AWS > EFS > Mount Target > Approved policy to Enforce: Delete unapproved.

What's new?

• Create and manage aws_cloudwatch_metric_alarm resources via Guardrails stacks.

Control Types

• AWS > CloudWatch > Alarm > Configured

Policy Types

• AWS > CloudWatch > Alarm > Configured
• AWS > CloudWatch > Alarm > Configured > Claim Precedence
• AWS > CloudWatch > Alarm > Configured > Source

Bug fixes

• Added support for aws_securityhub_account Terraform resource.

What's new?

• Resource's metadata will now also include createdBy details in Turbot CMDB.

What's new?

Control Types

• AWS > CIS v3.0
• AWS > CIS v3.0 > 1 - Identity and Access Management
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.01 - Maintain current contact details
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.02 - Ensure security contact information is registered
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.03 - Ensure security questions are registered in the AWS account
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.04 - Ensure no 'root' user account access key exists
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.05 - Ensure MFA is enabled for the 'root' user account
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.06 - Ensure hardware MFA is enabled for the 'root' user account
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.07 - Eliminate use of the 'root' user for administrative and daily tasks
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.08 - Ensure IAM password policy requires minimum length of 14 or greater
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.09 - Ensure IAM password policy prevents password reuse
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.10 - Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.11 - Do not setup access keys during initial user setup for all IAM users that have a console password
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.12 - Ensure credentials unused for 45 days or greater are disabled
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.13 - Ensure there is only one active access key available for any single IAM user
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.14 - Ensure access keys are rotated every 90 days or less
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.15 - Ensure IAM Users Receive Permissions Only Through Groups
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.16 - Ensure IAM policies that allow full ":" administrative privileges are not attached
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.17 - Ensure a support role has been created to manage incidents with AWS Support
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.18 - Ensure IAM instance roles are used for AWS resource access from instances
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.19 - Ensure that all the expired SSL/TLS certificates stored in AWS IAM are removed
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.20 - Ensure that IAM Access analyzer is enabled for all regions
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.21 - Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.22 - Ensure access to AWSCloudShellFullAccess is restricted
• AWS > CIS v3.0 > 2 - Storage
• AWS > CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3)
• AWS > CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.01 - Ensure S3 Bucket Policy is set to deny HTTP requests
• AWS > CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.02 - Ensure MFA Delete is enabled on S3 buckets
• AWS > CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.03 - Ensure all data in Amazon S3 has been discovered, classified and secured when required
• AWS > CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.04 - Ensure that S3 Buckets are configured with 'Block public access (bucket settings)'
• AWS > CIS v3.0 > 2 - Storage > 2.02 - Elastic Compute Cloud (EC2)
• AWS > CIS v3.0 > 2 - Storage > 2.02 - Elastic Compute Cloud (EC2) > 2.02.01 - Ensure EBS Volume Encryption is Enabled in all Regions
• AWS > CIS v3.0 > 2 - Storage > 2.03 - Relational Database Service (RDS)
• AWS > CIS v3.0 > 2 - Storage > 2.03 - Relational Database Service (RDS) > 2.03.01 - Ensure that encryption-at-rest is enabled for RDS Instances
• AWS > CIS v3.0 > 2 - Storage > 2.03 - Relational Database Service (RDS) > 2.03.02 - Ensure Auto Minor Version Upgrade feature is Enabled for RDS Instances
• AWS > CIS v3.0 > 2 - Storage > 2.03 - Relational Database Service (RDS) > 2.03.03 - Ensure that public access is not given to RDS Instance
• AWS > CIS v3.0 > 2 - Storage > 2.04 - Elastic File System (EFS)
• AWS > CIS v3.0 > 2 - Storage > 2.04 - Elastic File System (EFS) > 2.04.01 - Ensure that encryption is enabled for EFS file systems
• AWS > CIS v3.0 > 3 - Logging
• AWS > CIS v3.0 > 3 - Logging > 3.01 - Ensure CloudTrail is enabled in all regions
• AWS > CIS v3.0 > 3 - Logging > 3.02 - Ensure CloudTrail log file validation is enabled
• AWS > CIS v3.0 > 3 - Logging > 3.03 - Ensure AWS Config is enabled in all regions
• AWS > CIS v3.0 > 3 - Logging > 3.04 - Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket
• AWS > CIS v3.0 > 3 - Logging > 3.05 - Ensure CloudTrail logs are encrypted at rest using KMS CMKs
• AWS > CIS v3.0 > 3 - Logging > 3.06 - Ensure rotation for customer created symmetric CMKs is enabled
• AWS > CIS v3.0 > 3 - Logging > 3.07 - Ensure VPC flow logging is enabled in all VPCs
• AWS > CIS v3.0 > 3 - Logging > 3.08 - Ensure that Object-level logging for write events is enabled for S3 bucket
• AWS > CIS v3.0 > 3 - Logging > 3.09 - Ensure that Object-level logging for read events is enabled for S3 bucket
• AWS > CIS v3.0 > 4 - Monitoring
• AWS > CIS v3.0 > 4 - Monitoring > 4.01 - Ensure unauthorized API calls are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.02 - Ensure management console sign-in without MFA is monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.03 - Ensure usage of 'root' account is monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.04 - Ensure IAM policy changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.05 - Ensure CloudTrail configuration changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.06 - Ensure AWS Management Console authentication failures are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.07 - Ensure disabling or scheduled deletion of customer created CMKs is monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.08 - Ensure S3 bucket policy changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.09 - Ensure AWS Config configuration changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.10 - Ensure security group changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.11 - Ensure Network Access Control Lists (NACL) changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.12 - Ensure changes to network gateways are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.13 - Ensure route table changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.14 - Ensure VPC changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.15 - Ensure AWS Organizations changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.16 - Ensure AWS Security Hub is enabled
• AWS > CIS v3.0 > 5 - Networking
• AWS > CIS v3.0 > 5 - Networking > 5.01 - Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports
• AWS > CIS v3.0 > 5 - Networking > 5.02 - Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports
• AWS > CIS v3.0 > 5 - Networking > 5.03 - Ensure no security groups allow ingress from ::/0 to remote server administration ports
• AWS > CIS v3.0 > 5 - Networking > 5.04 - Ensure the default security group of every VPC restricts all traffic
• AWS > CIS v3.0 > 5 - Networking > 5.05 - Ensure routing tables for VPC peering are 'least access'
• AWS > CIS v3.0 > 5 - Networking > 5.06 - Ensure that EC2 Metadata Service only allows IMDSv2

Policy Types

• AWS > CIS v3.0
• AWS > CIS v3.0 > 1 - Identity and Access Management
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.01 - Maintain current contact details
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.01 - Maintain current contact details > Attestation
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.02 - Ensure security contact information is registered
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.03 - Ensure security questions are registered in the AWS account
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.03 - Ensure security questions are registered in the AWS account > Attestation
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.04 - Ensure no 'root' user account access key exists
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.05 - Ensure MFA is enabled for the 'root' user account
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.06 - Ensure hardware MFA is enabled for the 'root' user account
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.07 - Eliminate use of the 'root' user for administrative and daily tasks
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.08 - Ensure IAM password policy requires minimum length of 14 or greater
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.09 - Ensure IAM password policy prevents password reuse
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.10 - Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.11 - Do not setup access keys during initial user setup for all IAM users that have a console password
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.12 - Ensure credentials unused for 45 days or greater are disabled
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.13 - Ensure there is only one active access key available for any single IAM user
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.14 - Ensure access keys are rotated every 90 days or less
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.15 - Ensure IAM Users Receive Permissions Only Through Groups
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.16 - Ensure IAM policies that allow full ":" administrative privileges are not attached
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.17 - Ensure a support role has been created to manage incidents with AWS Support
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.18 - Ensure IAM instance roles are used for AWS resource access from instances
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.19 - Ensure that all the expired SSL/TLS certificates stored in AWS IAM are removed
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.20 - Ensure that IAM Access analyzer is enabled for all regions
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.21 - Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.21 - Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments > Attestation
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.22 - Ensure access to AWSCloudShellFullAccess is restricted
• AWS > CIS v3.0 > 1 - Identity and Access Management > 1.22 - Ensure access to AWSCloudShellFullAccess is restricted > Attestation
• AWS > CIS v3.0 > 1 - Identity and Access Management > Maximum Attestation Duration
• AWS > CIS v3.0 > 2 - Storage
• AWS > CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3)
• AWS > CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.01 - Ensure S3 Bucket Policy is set to deny HTTP requests
• AWS > CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.02 - Ensure MFA Delete is enable on S3 buckets
• AWS > CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.03 - Ensure all data in Amazon S3 has been discovered, classified and secured when required
• AWS > CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.03 - Ensure all data in Amazon S3 has been discovered, classified and secured when required > Attestation
• AWS > CIS v3.0 > 2 - Storage > 2.01 - Simple Storage Service (S3) > 2.01.04 - Ensure that S3 Buckets are configured with 'Block public access (bucket settings)'
• AWS > CIS v3.0 > 2 - Storage > 2.02 - Elastic Compute Cloud (EC2)
• AWS > CIS v3.0 > 2 - Storage > 2.02 - Elastic Compute Cloud (EC2) > 2.02.01 - Ensure EBS Volume Encryption is Enabled in all Regions
• AWS > CIS v3.0 > 2 - Storage > 2.03 - Relational Database Service (RDS)
• AWS > CIS v3.0 > 2 - Storage > 2.03 - Relational Database Service (RDS) > 2.03.01 - Ensure that encryption-at-rest is enabled for RDS Instances
• AWS > CIS v3.0 > 2 - Storage > 2.03 - Relational Database Service (RDS) > 2.03.02 - Ensure Auto Minor Version Upgrade feature is Enabled for RDS Instances
• AWS > CIS v3.0 > 2 - Storage > 2.03 - Relational Database Service (RDS) > 2.03.03 - Ensure that public access is not given to RDS Instance
• AWS > CIS v3.0 > 2 - Storage > 2.04 - Elastic File System (EFS)
• AWS > CIS v3.0 > 2 - Storage > 2.04 - Elastic File System (EFS) > 2.04.01 - Ensure that encryption is enabled for EFS file systems
• AWS > CIS v3.0 > 2 - Storage > Maximum Attestation Duration
• AWS > CIS v3.0 > 3 - Logging
• AWS > CIS v3.0 > 3 - Logging > 3.01 - Ensure CloudTrail is enabled in all regions
• AWS > CIS v3.0 > 3 - Logging > 3.02 - Ensure CloudTrail log file validation is enabled
• AWS > CIS v3.0 > 3 - Logging > 3.03 - Ensure AWS Config is enabled in all regions
• AWS > CIS v3.0 > 3 - Logging > 3.04 - Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket
• AWS > CIS v3.0 > 3 - Logging > 3.05 - Ensure CloudTrail logs are encrypted at rest using KMS CMKs
• AWS > CIS v3.0 > 3 - Logging > 3.06 - Ensure rotation for customer created symmetric CMKs is enabled
• AWS > CIS v3.0 > 3 - Logging > 3.07 - Ensure VPC flow logging is enabled in all VPCs
• AWS > CIS v3.0 > 3 - Logging > 3.08 - Ensure that Object-level logging for write events is enabled for S3 bucket
• AWS > CIS v3.0 > 3 - Logging > 3.09 - Ensure that Object-level logging for read events is enabled for S3 bucket
• AWS > CIS v3.0 > 3 - Logging > Maximum Attestation Duration
• AWS > CIS v3.0 > 4 - Monitoring
• AWS > CIS v3.0 > 4 - Monitoring > 4.01 - Ensure unauthorized API calls are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.02 - Ensure management console sign-in without MFA is monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.03 - Ensure usage of 'root' account is monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.04 - Ensure IAM policy changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.05 - Ensure CloudTrail configuration changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.06 - Ensure AWS Management Console authentication failures are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.07 - Ensure disabling or scheduled deletion of customer created CMKs is monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.08 - Ensure S3 bucket policy changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.09 - Ensure AWS Config configuration changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.10 - Ensure security group changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.11 - Ensure Network Access Control Lists (NACL) changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.12 - Ensure changes to network gateways are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.13 - Ensure route table changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.14 - Ensure VPC changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.15 - Ensure AWS Organizations changes are monitored
• AWS > CIS v3.0 > 4 - Monitoring > 4.16 - Ensure AWS Security Hub is enabled
• AWS > CIS v3.0 > 4 - Monitoring > Maximum Attestation Duration
• AWS > CIS v3.0 > 5 - Networking
• AWS > CIS v3.0 > 5 - Networking > 5.01 - Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports
• AWS > CIS v3.0 > 5 - Networking > 5.02 - Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports
• AWS > CIS v3.0 > 5 - Networking > 5.03 - Ensure no security groups allow ingress from ::/0 to remote server administration ports
• AWS > CIS v3.0 > 5 - Networking > 5.04 - Ensure the default security group of every VPC restricts all traffic
• AWS > CIS v3.0 > 5 - Networking > 5.05 - Ensure routing tables for VPC peering are 'least access'
• AWS > CIS v3.0 > 5 - Networking > 5.05 - Ensure routing tables for VPC peering are 'least access' > Attestation
• AWS > CIS v3.0 > 5 - Networking > 5.06 - Ensure that EC2 Metadata Service only allows IMDSv2
• AWS > CIS v3.0 > 5 - Networking > Maximum Attestation Duration
• AWS > CIS v3.0 > Maximum Attestation Duration

Bug fixes

• Server
  • Minor internal improvements.

Requirements

• TEF: 1.57.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

What's new?

• Resource Types:

  • GCP > DNS > Policy

• Control Types:

  • GCP > DNS > Policy > Active
  • GCP > DNS > Policy > Approved
  • GCP > DNS > Policy > CMDB
  • GCP > DNS > Policy > Discovery
  • GCP > DNS > Policy > Usage

• Policy Types:

  • GCP > DNS > Policy > Active
  • GCP > DNS > Policy > Active > Age
  • GCP > DNS > Policy > Active > Last Modified
  • GCP > DNS > Policy > Approved
  • GCP > DNS > Policy > Approved > Custom
  • GCP > DNS > Policy > Approved > Usage
  • GCP > DNS > Policy > CMDB
  • GCP > DNS > Policy > Usage
  • GCP > DNS > Policy > Usage > Limit

• Action Types:

  • GCP > DNS > Policy > Delete
  • GCP > DNS > Policy > Router