What's new?
- Added support to process enable and disable real-time events for Dataplex.
Subscribe to all changelog posts via RSS or follow #changelog on our Slack community to stay updated on everything we ship.
What's new?
Resource Types
Control Types
Policy Types
Action Types
What's new?
Added:
In Azure > Compute > Disk:
supportedCapabilities.diskControllerTypes
diskIopsReadWrite
lastOwnershipUpdateTime
In Azure > Compute > Virtual Machine:
resources
timeCreated
etag
In Azure > Compute > Virtual Machine Scale Set:
constrainedMaximumCapacity
etag
scaleInPolicy
timeCreated
upgradePolicy
storageProfile. diskControllerType
In Azure > Compute > Snapshot:
dataAccessAuthMode
incrementalSnapshotFamilyId
Removed:
In Azure > Compute > Virtual Machine:
statuses.time
Bug fixes
What's new?
Added:
Azure > App Service > App Service Plan
elasticScaleEnabled
numberOfWorkers
zoneRedundant
Azure > App Service > Function App
configuration.acrUseManagedIdentityCreds
configuration.acrUserManagedIdentityID
configuration.elasticWebAppScaleLimit
configuration.ipSecurityRestrictionsDefaultAction
configuration.metadata
configuration.minTlsCipherSuite
configuration.scmIpSecurityRestrictionsDefaultAction
dnsConfiguration
publicNetworkAccess
vnetBackupRestoreEnabled
vnetContentShareEnabled
vnetImagePullEnabled
vnetRouteAllEnabled
Azure > App Service > Web App
configuration.acrUseManagedIdentityCreds
configuration.acrUserManagedIdentityID
configuration.elasticWebAppScaleLimit
configuration.ipSecurityRestrictionsDefaultAction
configuration.metadata
configuration.minTlsCipherSuite
configuration.scmIpSecurityRestrictionsDefaultAction
dnsConfiguration
publicNetworkAccess
vnetBackupRestoreEnabled
vnetContentShareEnabled
vnetImagePullEnabled
vnetRouteAllEnabled
Bug fixes
What's new?
What's new?
Renamed:
JitNetworkAccessPolicies
to jitNetworkAccessPolicies
Pricing
to pricing
Locations
to locations
Bug fixes
What's new?
Bug fixes
What's new?
Added:
frontdoorId
rulesEngines
extendedProperties
backendPoolsSettings
backendPool.privateLinkAlias
backendPool.privateLinkLocation
backendPool.privateEndpointStatus
backendPool.privateLinkResourceId
backendPool.privateLinkApprovalMessage
routingRule.rulesEngine
routingRule.routeConfiguration.odataType
routingRule.routeConfiguration.cacheConfiguration.cacheDuration
routingRule.routeConfiguration.cacheConfiguration.queryParameters
routingRule.webApplicationFirewallPolicyLink
Modified:
routingRule.backendPool
to routingRule.routeConfiguration.backendPool
routingRule.forwardingProtocol
to routingRule.routeConfiguration.forwardingProtocol
routingRule.customForwardingPath
to routingRule.routeConfiguration.customForwardingPath
routingRule.cacheConfiguration.dynamicCompression
to routingRule.routeConfiguration.cacheConfiguration. dynamicCompression
routingRule.cacheConfiguration.queryParameterStripDirective
to routingRule.routeConfiguration.cacheConfiguration. queryParameterStripDirective
Bug fixes
What's new?
Bug fixes
What's new?
Added:
networkProfile.podCidrs
networkProfile.ipFamilies
networkProfile.outboundType
networkProfile.serviceCidrs
networkProfile.networkPolicy
networkProfile.loadBalancerProfile.backendPoolType
networkProfile.loadBalancerProfile.countIPv6
networkProfile.loadBalancerProfile.idleTimeoutInMinutes
networkProfile.loadBalancerProfile.allocatedOutboundPorts
agentPoolProfiles.mode
agentPoolProfiles.osSKU
agentPoolProfiles.enableFips
agentPoolProfiles.osDiskType
agentPoolProfiles.spotMaxPrice
agentPoolProfiles.scaleDownMode
agentPoolProfiles.enableUltraSSD
agentPoolProfiles.kubeletDiskType
agentPoolProfiles.upgradeSettings.maxSurge
agentPoolProfiles.nodeImageVersion
agentPoolProfiles.enableEncryptionAtHost
agentPoolProfiles.currentOrchestratorVersion
Bug fixes
What's new?
Added:
hostNamePrefix
serverless. connectionTimeoutInSeconds
Bug fixes
What's new?
Added:
Azure > Service Bus > Namespace
disableLocalAuth
status
zoneRedundant
Azure > Service Bus > Queue
maxMessageSizeInKilobytes
Azure > Service Bus > Topic
maxMessageSizeInKilobytes
Bug fixes
What's new?
Bug fixes
What's new?
Added: Azure > Recovery Service > Vault
properties.backupStorageVersion
properties.bcdrSecurityLevel
properties.publicNetworkAccess
properties.restoreSettings
properties.secureScore
properties.securitySettings
Bug fixes
Bug fixes
AWS > RoboMaker > Robot Application > CMDB
, AWS > RoboMaker > Fleet > CMDB
and AWS > RoboMaker > Robot > CMDB
policies will now be set to Skip
by default because the resource types have been deprecated and will be removed in the next major version. Please check end of support for more information.What's new?
AWS > ECS > Account Settings > Fargate FIPS Mode
policy.Approved > Usage
policy for resource types will now default to Approved
instead of Approved if AWS > {service} > Enabled
.Resource Types
Control Types
Policy Types
Action Types
What's new?
Server
UI
+
sign to grant permissions in the context of both the identity and resource.Bug fixes
Server
UI
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
resource/turbot_policy_pack_attachment
: terraform apply
failed to detect existing Policy Pack attachments. (#181)What's new?
Added:
flowType
requestSource
Bug fixes
What's new?
Bug fixes
Resource Types
Policy Types
What's new?
AWS/User
grant should include support:*
permissions. To get started, set the AWS > Account > Permissions > Support Level
policy.Policy Types
Bug fixes
AWS > Turbot > IAM
stack control did not correctly evaluate user memberships in custom IAM groups when the AWS > Turbot > Permissions > Custom Group Levels [Account]
policy was set, and users were granted permissions for those custom IAM groups. This issue has now been fixed.Bug fixes
AWS > EC2 > Volume > CMDB
control would sometimes run unnecessarily due to a bad internal GraphQL dependency. This is now fixed.Bug fixes
Kubernetes > Cluster > CMDB > Expiration
policy was inadvertently added to the Kubernetes > Cluster > CMDB
control. This precheck condition has now been removed.Resource Types
Control Types
Policy Types
Action Types
What's new?
Bug fixes
Enforce: Enabled
for the service.What's new?
Added:
authOptions
disableLocalAuth
encryptionWithCmk
networkRuleSet
privateEndpointConnections
publicNetworkAccess
semanticSearch
sharedPrivateLinkResources
Bug fixes
What's new?
Action Types
Bug fixes
Enforce: Enabled
for the service.Bug fixes
Enforce: Enabled
for the service.Bug fixes
Enforce: Enabled
for the service.Bug fixes
Enforce: Enabled
for the service.Bug fixes
Enforce: Enabled
for the service.Bug fixes
Enforce: Enabled
for the service.Bug fixes
Enforce: Enabled
for the service.Bug fixes
Enforce: Enabled
for the service.Bug fixes
Enforce: Enabled
for the service.Bug fixes
Enforce: Enabled
for the service.Bug fixes
Enforce: Enabled
for the service.What's new?
Added: Azure > Synapse Analytics > Workspace
azureADOnlyAuthentication
createManagedPrivateEndpoint
encryption
extraProperties
publicNetworkAccess
settings
trustedServiceBypassEnabled
workspaceUID
Azure > Synapse Analytics > SQL Pool
storageAccountType
Bug fixes
What's new?
Action Types
What's new?
Added:
authConfig
dataEncryption
standbyAvailabilityZone
network. delegatedSubnetResourceId
network. privateDnsZoneArmResourceId
replicaCapacity
replicationRole
systemData
configurations.documentationLink
configurations.isConfigPendingRestart
configurations.isDynamicConfig
configurations.isReadOnly
configurations.unit
Modified:
firewallRules
has been changed from array ([]
) to object ({}
).Bug fixes
What's new?
Bug fixes
Bug fixes
serviceProperties.table.clientRequestId
and serviceProperties.table.requestId
properties for storage accounts have now been made dynamic
to avoid unnecessary notifications in the activity tab.Bug fixes
What's new?
Policy Types
Bug fixes
osquery
error events.Bug fixes
osquery
agent.What's new?
Policy Types
Control Types
Policy Types
What's new?
Policy Types
Control Types
Policy Types
What's new?
Policy Types
What's new?
Policy Types
Bug fixes
modifyVolume
event for EBS Volume Notifications. This issue is now fixed.What's new?
Approved > Usage
policy for resource types will now default to Approved
instead of Approved if AWS > {service} > Enabled
.Bug fixes
Action Types
What's new?
Approved > Usage
policy for resource types will now default to Approved
instead of Approved if AWS > {service} > Enabled
.Bug fixes
What's new?
Approved > Usage
policy for resource types will now default to Approved
instead of Approved if AWS > {service} > Enabled
.Bug fixes
What's new?
Approved > Usage
policy for resource types will now default to Approved
instead of Approved if AWS > {service} > Enabled
.Bug fixes
Bug fixes
What's new?
Approved > Usage
policy for resource types will now default to Approved
instead of Approved if AWS > {service} > Enabled
.Bug fixes
What's new?
Approved > Usage
policy for resource types will now default to Approved
instead of Approved if AWS > {service} > Enabled
.Bug fixes
What's new?
createdBy
details in Guardrails CMDB.Approved > Usage
policy for resource types will now default to Approved
instead of Approved if AWS > {service} > Enabled
.Bug fixes
AWS > EC2 > Volume > Performance Configuration
control would sometimes fail to set the expected configuration per AWS > EC2 > Volume > Performance Configuration > *
policies and move to an Invalid state if the required data was not available for new volumes in the CMDB. The control will now move to TBD instead and retry after 5 minutes to fetch the required data correctly and set the performance configuration as expected.What's new?
Approved > Usage
policy for resource types will now default to Approved
instead of Approved if AWS > {service} > Enabled
.Bug fixes
What's new?
Approved > Usage
policy for resource types will now default to Approved
instead of Approved if AWS > {service} > Enabled
.Bug fixes
What's new?
Bug fixes
Enforce: Enabled
for the service.Bug fixes
Enforce: Enabled
for the service.Bug fixes
Enforce: Enabled
for the service.What's new?
Azure > Storage> Storage Account > CMDB
control will now also fetch diagnostic settings details and store them in CMDB.Resource Types
Control Types
Policy Types
Bug fixes
What's new?
Approved > Usage
policy for resource types will now default to Approved
instead of Approved if AWS > {service} > Enabled
.Bug fixes
Bug fixes
Import Set
controls will not require permissions to read the sys_db_object
& sys_dictionary
tables in ServiceNow.Bug fixes
Import Set
controls will not require permissions to read the sys_db_object
& sys_dictionary
tables in ServiceNow.Bug fixes
Import Set
controls will not require permissions to read the sys_db_object
& sys_dictionary
tables in ServiceNow.Bug fixes
Import Set
controls will not require permissions to read the sys_db_object
& sys_dictionary
tables in ServiceNow.Control Types
Policy Types
Bug fixes
Import Set
controls will not require permissions to read the sys_db_object
& sys_dictionary
tables in ServiceNow.Bug fixes
Import Set
controls will not require permissions to read the sys_db_object
& sys_dictionary
tables in ServiceNow.Bug fixes
Import Set
controls will not require permissions to read the sys_db_object
& sys_dictionary
tables in ServiceNow.Bug fixes
Import Set
controls will not require permissions to read the sys_db_object
& sys_dictionary
tables in ServiceNow.Bug fixes
Import Set
controls will not require permissions to read the sys_db_object
& sys_dictionary
tables in ServiceNow.What's new?
AWS > RDS > DB Cluster > Parameter Group > *
policies.Control Types
Policy Types
Action Types
Bug fixes
Bug fixes
Enforce: Enabled
for the service.Bug fixes
Server
UI
Import
button on the Connect page has been updated to Connect
.Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
What's new?
You can now configure Master Authorized Networks for region and zone clusters via Guardrails. To get started, set the GCP > Kubernetes Engine > Region Cluster > Master Authorized Networks Config
and GCP > Kubernetes Engine > Zone Cluster > Master Authorized Networks Config
policies respectively.
Improved descriptions for various resource types to ensure they are clearer and more helpful.
Control Types
Policy Types
Action Types
What's new?
Bug fixes
Resource Types
Control Types
Policy Types
Action Types
What's new?
Approved > Usage
policy for resource types will now default to Approved
instead of Approved if AWS > {service} > Enabled
.Bug fixes
Enforce: Enabled but ignore permission errors
. However, the CMDB control previously ignored permission errors only on the HeadBucket
operation and still entered an error state for permission errors on sub-API calls. The CMDB control will now ignore all sub-API calls if the HeadBucket
operation is denied access. If the HeadBucket operation is successful, the control will attempt to make all sub-API calls and ignore access denied errors if encountered.What's new?
Resource Types
Control Types
Policy Types
Action Types
Resource Types
Control Types
Policy Types
Action Types
What's new?
Approved > Usage
policy for resource types will now default to Approved
instead of Approved if AWS > {service} > Enabled
.Bug fixes
AWS > VPC > VPC > Stack
control would sometimes go into an error state while upserting newly created flow logs in Guardrails due to incorrect mapping of its parent resource. This issue has now been fixed, and the control will upsert flow logs more consistently and reliably than before.Bug fixes
Enforce: Enabled
for the service.What's new?
rds-ca-rsa4096-g1
.Resource Types
Control Types
Policy Types
Action Types
What's new?
AWS > Turbot > Logging > Bucket > Default Encryption
policy is now deprecated because all buckets are now encrypted by default in AWS. As a result, all buckets created and managed via the AWS > Turbot > Logging > Bucket
stack control will now be encrypted by AWS SSE
by default. We've also removed ACL settings for buckets and now apply bucket ownership controls instead via the stack control to align with the latest AWS recommendations. Please upgrade the @turbot/aws-s3
mod to v5.26.0 for the stack control to work reliably as before.Policy Types
Renamed
What's new?
aws_s3_bucket_ownership_controls
Terraform resource for buckets.What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
What's new?
AWS > Config > Configuration Recording
stack control. To get started, set the AWS > Config > Configuration Recording > Terraform Version
policy. We recommend using versions 0.11, 0.12, or 0.15 for this control to create and manage resources effectively and reliably.Policy Types
What's new?
GCP > Turbot > Event Handlers > Pub/Sub
control. To get started, set the GCP > Turbot > Event Handlers > Pub/Sub > Topic > Labels
policy.Policy Types
Bug fixes
ec2:RevokeSecurityGroupEgress
and ec2:RevokeSecurityGroupIngress
events. This issue is now fixed.Bug fixes
AWS > Turbot > Event Handlers
control did not correctly raise the real-time CreateTags
and DeleteTags
events for VPC security group rules. This issue is now fixed.What's new?
GCP > Network > Subnetwork > Flow Log
policy.Control Types
Policy Types
Action Types
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Resource Types
Control Types
Policy Types
Action Types
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
What's new?
GCP > IAM > Service Account > Active
or GCP > IAM > Service Account > Approved
policy to Enforce: Disable inactive with <x> days warning
or Enforce: Disable unapproved
respectively.Action Types
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Bug fixes
AWS > ECR > Repository > CMDB
control went into an error state for shared repositories upserted incorrectly in Guardrails CMDB. Shared repositories will now not be upserted under shared accounts or regions, but will only be upserted under their owner accounts and regions.Bug fixes
ec2:CreateReplaceRootVolumeTask
for instances. This is now fixed.What's new?
Server
UI
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
Azure > Resource Group > ServiceNow > Configuration Item
control would fail to fetch instance credentials internally and did not process the data correctly in ServiceNow. This issue has now been fixed.Bug fixes
Bug fixes
Bug fixes
Control Types
Policy Types
Bug fixes
Bug fixes
Bug fixes
Bug fixes
Bug fixes
What's new?
What's new?
What's new?
AWS/DynamoDB/Admin
, AWS/DynamoDB/Metadata
and AWS/DynamoDB/Operator
now include permissions for Resource Policy, Imports, Time to Live and Global Table Version.What's new?
Control Types
Policy Types
What's new?
Control Types
Policy Types
What's new?
Table logging
for Storage Accounts
via Azure > Storage > Storage Account > Table > Logging
control. To get started, set the Azure > Storage > Storage Account > Table > Logging
policy.Control Types
Policy Types
Action Types
Azure > Storage > Storage Account > Update Encryption at Rest
Azure > Storage > Storage Account > Update Storage Account Table Logging
The Storage Account CMDB data will now also include information about the account's table service properties.
We've removed the dependency on listKeys
permission for Azure > Storage Account > Container > Discovery
to run its course to completion. This release includes breaking changes in the CMDB data for containers. We recommend updating your existing policy settings to refer to the updated attributes as mentioned below.
Renamed:
isImmutableStorageWithVersioningEnabled
to isImmutableStorageWithVersioning.enabled
Removed:
preventEncryptionScopeOverride
Bug fixes
Azure > Storage > Storage Account > CMDB
control would go into an error state while trying to fetch default Queue and Blob properties if Guardrails did not have permission to list the storage account keys. The control will now not attempt to fetch default Queue and Blob properties if Guardrails does not have the required access for listKeys
, and will run its course to completion without going into an error state.Bug fixes
AWS > S3 > Bucket > CMDB
control if it would go into an error state due to insufficient permissions for the headBucket
operation.What's new?
Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
Control Types
Policy Types
What's new?
Resource Types
Control Types
Policy Types
Action Types
Bug fixes
What's new?
AWS > S3 > Bucket > CMDB
control would go into an error state if Guardrails did not have permissions to call the headBucket
operation on a bucket. Users can now ignore such permission errors and allow the CMDB control to run its course to completion. To get started, set the AWS > S3 > Bucket > CMDB
policy to Enforce: Enabled but ignore permission errors
.Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
Azure > App Service > Web App > Client Certificate Mode
control, ensuring that the Client Certificate Mode is set to Require
correctly. However, we missed an edge case where the control wouldn’t enforce any mode other than the default setting of Ignore
. We have now addressed all cases, and the control will work more reliably and consistently than before.What's new?
What's new?
Server
UI
Smart Folders
are now called Policy Packs
.Policy Packs
from UI.Bug fixes
Server
UI
Policy Packs
from the UI.Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
Enforce: Sync
policy value for integrating Import Sets in ServiceNow.Control Types
Policy Types
Control Types
Policy Types
Control Types
Policy Types
Control Types
Policy Types
Control Types
Policy Types
What's new?
Bug fixes
Azure > App Service > Web App > Client Certificate Mode
control did not apply Enforce: Require
settings correctly. This is now fixed.What's new?
google_monitoring_alert_policy
and google_monitoring_notification_channel
Terraform resources.Control Types
Policy Types
What's new?
google_logging_metric
Terraform resource.Control Types
Policy Types
Bug fixes
Azure > Storage > Storage Account > Queue > Logging
control failed to set queue logging properties correctly. This issue has been fixed, and the control will now function correctly as intended.Bug fixes
Bug fixes
What's new?
GCP > Compute > Instance > Shielded Instance Configuration > *
policies.Control Types
Policy Types
Action Types
What's new?
Azure > CIS v2.0 > 5.05 - Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads)
control will also evaluate SQL databases for SKU Basic/Consumption.Control Types
Policy Types
Bug fixes
Azure > CIS v2.0 > 4 - Database Services > 01.03 - Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key
control did not evaluate the result correctly, as expected. This is now fixed.What's new?
DOCUMENTATION:
resource/turbot_policy_pack
: Added documentation for akas
attribute for the resource. (#179)What's new?
GCP > SQL > Instance > Encryption In Transit
policy.Control Types
Policy Types
Action Types
What's new?
Control Types
Policy Types
What's new?
Basic
to Standard
for Public IP Addresss via Azure > Network > Public IP Address > Standard SKU
control. To get started, set the Azure > Network > Public IP Address > Standard SKU
policy.Control Types
Policy Types
Action Types
What's new?
To get started configuring these rules through Guardrails, the following policies should set according to your desired firewall rules configuration:
Azure > Cosmos DB > Database Account > Firewall
- Configure default access rules for the public endpoint
Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Approved
- Remove unapproved IP ranges
Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required
- Grant access to specific IP ranges
Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Approved
- Remove unapproved virtual network subnets
Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required
- Grant access to specific virtual network subnets
Please note that if the Azure > Cosmos DB > Database Account > Firewall
policy is set to Enforce: Allow only approved virtual networks and IP ranges
, only applications in the configured IP ranges, virtual network subnets, and trusted Microsoft services will be allowed to access the database accounts. If these boundaries are not properly configured beforehand or an application is outside of these boundaries, it will lose access to the database accounts.
Control Types
Policy Types
Action Types
Bug fixes
Bug fixes
What's new?
Bug fixes
GCP > Project > CMDB
control went into an error state while fetching Access Approval settings for the project if Access Transparency was disabled at the organization level. We have now handled such cases gracefully, and the control will fetch all available details without going into an error state.What's new?
GCP > SQL > Instance > Authorized Network > *
policies.GCP > SQL > Instance > Database Flags
policy.GCP > SQL > CMDB
policy to Enforce: Disabled
.Control Types
Policy Types
Action Types
What's new?
We've updated internal dependencies and now use the latest Azure SDK versions to discover and manage Storage resources in Guardrails. This release includes breaking changes in the CMDB data for storage accounts. We recommend updating your existing policy settings to refer to the updated attributes as mentioned below.
Renamed:
serviceProperties.blob.DeleteRetentionPolicy
to serviceProperties.blob.deleteRetentionPolicy
serviceProperties.blob.DeleteRetentionPolicy.Days
to serviceProperties.blob.deleteRetentionPolicy.days
serviceProperties.blob.DeleteRetentionPolicy.Enabled
to serviceProperties.blob.deleteRetentionPolicy.enabled
serviceProperties.blob.StaticWebsite
to serviceProperties.blob.staticWebsite
serviceProperties.blob.StaticWebsite.Enabled
to serviceProperties.blob.staticWebsite.enabled
serviceProperties.blob.logging
to serviceProperties.blob.blobAnalyticsLogging
serviceProperties.queue.logging
to serviceProperties.queue.queueAnalyticsLogging
Added:
serviceProperties.blob.deleteRetentionPolicy.AllowPermanentDelete
Modified:
serviceProperties.blob.cors
has been changed from string (""
) to array ([]
).serviceProperties.queue.cors
has been changed from string (""
) to array ([]
).Users can now enable/disable Blob logging
for storage accounts. To get started, set the Azure > Storage > Storage Account > Blob > Logging > *
policies.
Users can now check if storage accounts are approved for use based on Infrastructure Encryption settings. To get started, set the Azure > Storage > Storage Account > Approved > Infrastructure Encryption
policy.
Control Types
Renamed
Policy Types
Renamed
Action Types
Renamed
What's new?
Azure > App Service > Web App > Client Certificate Mode
policy.Control Types
Policy Types
Action Types
What's new?
Resource Types
Control Types
Policy Types
Action Types
What's new?
GCP > BigQuery > Dataset > Encryption at Rest > *
policies.Control Types
Policy Types
Action Types
What's new?
Control Types
Policy Types
Bug fixes
AWS > EC2 > Snapshot > CMDB
policy was set to Enforce: Enabled for Snapshots not created with AWS Backup
. This issue has now been fixed.What's new?
GCP > DNS > Managed Zone > DNSSEC Configuration
policy.GCP > DNS > Policy > Logging
policy.Control Types
Policy Types
Action Types
Bug fixes
What's new?
Azure > Compute > Virtual Machine > Trusted launch
policy.Azure > Compute > Disk > Encryption at Rest > *
policies.Control Types
Policy Types
Action Types
What's new?
Azure > App Service > Web App > System Assigned Identity
policy.Control Types
Policy Types
Action Types
Bug fixes
Azure > App Service > Web App > FTPS State
control failed to set the FTPS State correctly for web apps. This issue is now fixed.What's new?
Policy Types
What's new?
Azure > Network Watcher > Flow Log > Retention Policy > *
policies.Control Types
Policy Types
Action Types
What's new?
Azure > Active Directory > Directory > CMDB
control will now also fetch named locations and authorization policy details and store them in CMDB.Bug fixes
AWS > IAM > Account Password Policy > Settings
control not applying custom settings correctly. This issue is fixed, and the CMDB details will now refresh correctly, allowing the corresponding Settings control to work as expected.What's new?
Azure > Security Center > Security Center > CMDB
control will now also fetch security settings details and store them in CMDB.Bug fixes
Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
The default value for GCP > Storage > Bucket > ServiceNow > Import Set
now shows the resource_type_uri
correctly.
Control Types
Added
Policy Types
Added
What's new?
ServiceNow > Turbot > Watches > GCP Archive and Delete Record
action now supports archiving Import Set
records.Control Types
Added
Policy Types
Added
What's new?
ServiceNow > Turbot > Watches > Azure Archive and Delete Record
action now supports archiving Import Set
records.Bug fixes
ServiceNow > Application > CMDB
, ServiceNow > Cost Center > CMDB
& ServiceNow > User > CMDB
have been updated from Enforce: Enabled
to Skip
.Policy Types
Added
Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
OUTBOUND_SECURITY_GROUP_ID
environment variable in Lambda functions now defaults to using the TEF outbound security group when there is no override specified in TEF and TE.Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
Azure > Network > Network Security Group > Ingress Rules > Approved
and Azure > Network > Network Security Group > Egress Rules > Approved
controls previously deleted an entire rule if at least one of the corresponding port prefixes was rejected, even if the others were approved. These controls will now revoke only the rejected port prefixes instead of deleting the entire rule in such cases.Bug fixes
AWS > RDS > DB Instance > Approved
control will now be skipped for instances that belong to a cluster. To check if a cluster is approved for use, please set the AWS > RDS > DB Cluster > Approved > *
policies.AWS > RDS > DB Instance > Approved
control did not stop an unapproved instance if the corresponding policy was set to Enforce: Stop unapproved
or Enforce: Stop unapproved if new
, and deletion protection for the instance was enabled. The control will now stop instances correctly in such cases.What's new?
EncryptionInTransit
TopicPolicy has shifted from a custom resource to AWS CloudFormation’s AWS::SNS::TopicPolicy
.Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
Server
UI
Depends-on
tab on the controls page has been renamed to Related
. It now includes the information from the Depends-on tab along with additional related controls information.Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
Azure > Network > Network Security Group > Ingress Rules > Approved
control would sometimes fail to revoke rejected rules when the corresponding policy was set to Enforce: Delete unapproved
. This has been fixed, and the control will now work more reliably and consistently than before.Bug fixes
Turbot > osquery > Event Handler
action was not able to handle events for large payloads. This issue is now fixed.Bug fixes
GCP > Project > CMDB
control would incorrectly delete a project from Guardrails CMDB if it was unable to fetch Access Approval settings for the project. This issue has been fixed and the control will now attempt to fetch all available details and will not delete the project from CMDB.Bug fixes
Azure > Security Center > Security Center > Auto Provisioning
policy.Control Types
Policy Types
Action Types
What's new?
What's new?
Azure > Security Center > Security Center > Defender Plan
control now also supports services like Cloud Posture, Containers and Cosmos DB.What's new?
Server
@azure/msal-node
package.Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
AWS > EC2 > Snapshot > CMDB
policy to Enforce: Enabled for Snapshots not created with AWS Backup
.Bug fixes
AWS > Turbot > Service Roles > Source
policy went to an invalid state if all but the AWS > Turbot > Service Roles > Event Handlers [Global]
policy was enabled. This issue impacted the AWS > Turbot > Service Roles
stack control, preventing the role from being created correctly. This has been fixed, and the AWS > Turbot > Service Roles > Source
policy will now work as expected.Bug fixes
AWS > CIS v3.0 > 1 - Identity and Access Management > 1.02 - Ensure security contact information is registered
control did not evaluate the result correctly, as expected. This is now fixed.What's new?
Updated the existing Flags attribute to include new specific flags that control the operation of Mod Lambda functions within a Virtual Private Cloud (VPC). This update allows Lambdas to use static IP addresses, improving network stability and predictability across different cloud environments. New flags Added to Flags Attribute:
Introduced a new SSM parameter outbound_cidr_ranges to retrieve the Elastic IPs associated with the NAT gateways.
What's new?
Server
osquery/logger
API to support payloads up to 10MB.Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
Bug fixes
AWS > CIS v2.0 > 1 - Identity and Access Management > 1.02 - Ensure security contact information is registered
control did not evaluate the result correctly, as expected. This is now fixed.Bug fixes
Azure > Network > Network Security Group > Ingress Rules > Approved
and Azure > Network > Network Security Group > Egress Rules > Approved
controls previously deleted an entire rule if at least one of the corresponding address prefixes was rejected, even if the others were approved. These controls will now revoke only the rejected address prefix instead of deleting the entire rule in such cases.Bug fixes
GCP > Turbot > Event Handlers > Logging
would go into an Invalid state because of incorrect filter patterns defined in the GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter > @turbot/gcp-bigquerydatatransfer
policy. This is fixed and the control will now work as expected.Bug fixes
compute.networks.delete
for default networks incorrectly, resulting in the inadvertent deletion of those networks from CMDB. This is now fixed.What's new?
Resource Types
Policy Types
What's new?
Control Types
Policy Types
Bug fixes
s3:PutBucketReplication
for buckets. This is now fixed.AWS > S3 > Bucket > Access Logging
control would sometimes go into an error state if the target bucket name started with a number. This is fixed and the control will now work more smoothly and consistently than before.Bug fixes
$logs
) for storage accounts. This is now fixed.Bug fixes
What's new?
Resource Types
Control Types
Policy Types
Action Types
Bug fixes
osquery
instead of Osquery
.Bug fixes
Kubernetes > Node
resources will no longer include the conditions.lastHeartbeatTime
or resource_version
properties to avoid unnecessary notifications in the activity tab.What's new?
Resource Types
Policy Types
What's new?
Resource Types
Policy Types
What's new?
Server
api/latest/osquery/enroll
api/latest/osquery/config
api/latest/osquery/logger
serviceNowCredential
resolver specifically for Kubernetes clusters.@turbot/sdk
) to version 5.15.0 and our fn toolkit (@turbot/fn
) to version 5.22.0, to support FIFO queues.UI
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
Control Types
Policy Types
Action Types
What's new?
Resource Types
Control Types
Policy Types
Action Types
What's new?
Resource Types
Control Types
Policy Types
Action Types
Bug fixes
GCP > IAM > Service Account Key > Active
control will no longer attempt to delete a system-managed service account key deemed inactive by the control.What's new?
AWS > IAM > Access Key > Active > Latest
policy.AWS > IAM > Server Certificate > Active > Expired
policy.Policy Types
Bug fixes
GCP > Project > CMDB
control would go into an error state if Access Approval API was disabled in GCP. This is now fixed.What's new?
/processes
prefix from 1 day to 2 days./osquery
prefix.What's new?
Bug fixes
Azure > Compute > Virtual Machine Scale Set > Tags
control would sometimes fail to update tags correctly for Scale Sets launched via Azure marketplace. This is fixed and the control will now update tags correctly, as expected.What's new?
AWS > VPC > Network ACL > Ingress Rules > Approved > *
policies.Bug fixes
What's new?
AWS > EFS > Mount Target > Approved
policy to Enforce: Delete unapproved
.What's new?
aws_cloudwatch_metric_alarm
resources via Guardrails stacks.Control Types
Policy Types
Bug fixes
aws_securityhub_account
Terraform resource.What's new?
createdBy
details in Turbot CMDB.What's new?
Control Types
Policy Types
Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
Resource Types:
Control Types:
Policy Types:
Action Types:
What's new?
Control Types
Policy Types
Bug fixes
What's new?
Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
Azure > PostgreSQL > Flexible Server > Firewall > IP Ranges > Approved
control did not render correctly on mod inspect. This is now fixed.Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
Azure > Storage > Storage Account > Data Protection
control would go into an error state when container delete retention policy data was not available in CMDB. This issue is fixed and the control will now work as expected.What's new?
Azure > PostgreSQL > Server > Firewall > IP Ranges > Approved > *
and Azure > PostgreSQL > Flexible Server > Firewall > IP Ranges > Approved > *
policies respectively.Azure > PostgreSQL > Flexible Server > Approved
policy to Enforce: Stop unapproved
or Enforce: Stop unapproved if new
.Control Types
Policy Types
Action Types
Bug fixes
What's new?
Control Types
User consent for applications
is set to Do not allow user consent
Enable Infrastructure Encryption
for Each Storage Account in Azure Storage is Set to enabled
Policy Types
User consent for applications
is set to Do not allow user consent
User consent for applications
is set to Do not allow user consent
> AttestationEnable Infrastructure Encryption
for Each Storage Account in Azure Storage is Set to enabled
What's new?
worker_factory
in the CloudWatch Dashboard widgets "Events Queue Activity" and "Events Queue Backlog"._worker_factory
queue._worker
queue.Bug fixes
Server
UI
template_input
property of the policy setting in the Terraform plan to YAML format, improving clarity and manageability.Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
Turbot > Process Monitor
control to operate within the priority queue, ensuring more timely and efficient processing of critical tasks.Turbot > Workspace > Background Tasks
control to modify the next_tick_timestamp for any policy values that previously had incorrect defaults.Bug fixes
What's new?
Azure > Storage > Storage Account > Access Keys > Rotation Reminder > *
and Azure > Storage > Storage Account > Data Protection > Soft Delete > *
policies respectively.Control Types
Policy Types
Action Types
What's new?
Azure > SQL > Server > Firewall > IP Ranges > Approved > *
policies.Control Types
Policy Types
Action Types
Bug fixes
rotationPeriod
and nextRotationTime
attributes for Crypto Keys did not update correctly in CMDB when the rotation policy for such keys was removed. This is now fixed.What's new?
Azure > MySQL > Flexible Server > Encryption in Transit > *
policies.createdBy
details in Turbot CMDB.Control Types
Policy Types
Action Types
What's new?
createdBy
details in Turbot CMDB.Policy Types
Bug fixes
AWS > VPC > Flow Log > Configured
control would sometimes go into an error state for flow logs created via the AWS console, even though they were correctly claimed by a Guardrails stack. This is now fixed.What's new?
Azure > PostgreSQL > Flexible Server > Audit Logging > *
policies.Control Types
Policy Types
Action Types
What's new?
Azure > Key Vault > Key > Expiration > *
and Azure > Key Vault > Secret > Expiration > *
policies respectively.Control Types
Policy Types
Action Types
What's new?
What's new?
Bug fixes
Azure > Storage > Storage Account > Queue > Logging
control would go into a skipped state for storage accounts, irrespective of any policy setting for Logging. This issue is fixed and the control will now work as expected.What's new?
Azure > Network > Public IP Address > Approved
policy to Enforce: Delete unapproved
.What's new?
Azure > PostgresSql > Flexible Server > Encryption in Transit > *
policies.Control Types
Policy Types
Action Types
What's new?
Azure > Active Directory > User > Approved
policy to Enforce: Delete unapproved
.Policy Types
What's new?
Azure > MySQL > Flexible Server > Minimum TLS Version > *
policies.What's new?
What's new?
What's new?
Control Types
Policy Types
Bug fixes
What's new?
AWS > EC2 > Account Attributes > Instance Metadata Service Defaults > *
policies.Bug fixes
AWS > EC2 > Instance > Approved
control would sometimes fail to stop instances that were discovered in Guardrails via real-time events if the AWS > EC2 > Instance > Approved
policy was set to Enforce: Stop unapproved if new
. This is now fixed.What's new?
What's new?
connection_throttling
parameter for PostgreSQL servers. To get started, set the Azure > PostgreSQL > Server > Audit Logging > Connection Throttling
policy.What's new?
What's new?
AWS > KMS > Key > Approved
policy to Enforce: Disable unapproved
.Bug fixes
Enforce: Enabled but ignore permission errors
for the AWS > SNS > Subscription > CMDB
policy, allowing the corresponding CMDB control to ignore permission errors, if any, and proceed to completion. However, configuring the CMDB policy to Enforce: Enabled but ignore permission errors
inadvertently introduced a bug, resulting in the removal of real-time events for Subscription from the SNS EventBridge rule created by the Event Handlers. This issue has now been fixed.Bug fixes
Enforce: Enabled but ignore permission errors
for the AWS > KMS > Key > CMDB
policy, allowing the corresponding CMDB control to ignore permission errors, if any, and proceed to completion. However, configuring the CMDB policy to Enforce: Enabled but ignore permission errors
inadvertently introduced a bug, resulting in the removal of the EventBridge Rule for KMS by the Event Handlers. This issue has now been fixed.Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
Control Types:
Policy Types:
Action Types:
Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
Enforce: Disabled
. This is now fixed.Bug fixes
AWS > VPC > VPC > Stack
control failed to claim security group rules correctly if the protocol
for such rules was set to All
or TCP
in the stack's source policy. This issue has been fixed, and the control will now claim such rules correctly.Bug fixes
Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
AWS > SageMaker > Code Repository > Regions
policy, which led to the AWS > SageMaker > Code Repository > Discovery
control being in an error state for those regions. We've now removed the unsupported US Gov cloud regions from the Regions policy.What's new?
Bug fixes
Enforce: Disabled
. This is now fixed.Bug fixes
Enforce: Disabled
. This is now fixed.AWS > VPC > VPC > Stack
control that prevented it from recognizing security group rules with the port range set to 0 correctly. However, the control still failed to claim existing security group rules available in Guardrails CMDB, due to an inadvertent bug introduced in v5.9.2. This issue has now been fixed, and the control will correctly claim existing security group rules.Bug fixes
Enforce: Disabled
. This is now fixed.Bug fixes
lists
events for various storage resources. We've now improved our events filter to ignore these lists
events, thereby reducing unnecessary processing.Bug fixes
Enforce: Disabled
. This is now fixed.Bug fixes
Enforce: Disabled
. This is now fixed.Bug fixes
Enforce: Disabled
. This is now fixed.AWS > EC2 > Snapshot > Active
and AWS > EC2 > Snapshot > Approved
controls will now not attempt to delete a snapshot if it has one or more AMIs attached to it.ec2-reports:*
permissions are now removed from the mod.Bug fixes
CreateDefaultVpc
events. However, we overlooked an edge case in the fix. We have now addressed this issue, ensuring that Internet Gateways will be reliably discovered and upserted into the Guardrails CMDB. We recommend updating the aws-vpc-core
mod to version 5.17.1 or higher to enable Guardrails to correctly process real-time CreateDefaultVpc events for Internet Gateways.Enforce: Disabled
. This is now fixed.Bug fixes
AWS > VPC > VPC > Stack
control would sometimes go into an error state after creating security group rules with port range set to 0. This occurred because the control failed to recognize the existing rule in Guardrails CMDB and attempted to create a new rule instead. This issue has been fixed, and the stack control will now work correctly as expected.AWS > VPC > Security Group > CMDB
control would sometimes go into an error state for security groups shared from other AWS accounts. We will now exclude shared security groups and only upsert security groups that belong to the owner account.What's new?
You can now also manage the IAM Permissions model for Guardrails Users via the AWS > Turbot > IAM > Managed
control. The AWS > Turbot > IAM > Managed
control is faster and more efficient than the existing AWS > Turbot > IAM
control because it utilizes Native AWS APIs rather than Terraform to manage IAM resources. Please note that this feature will work as intended only on TE v5.42.19 or higher and turbot-iam
mod v5.11.0 or higher.
Control Types
Policy Types
Policy Types Renamed
Action Types
Bug fixes
The AWS > IAM > Group > CMDB
, AWS > IAM > Role > CMDB
, and AWS > IAM > User > CMDB
controls previously failed to fetch all attachments for groups, roles, and users, respectively, due to the lack of pagination support. This issue has been fixed, and the controls will now correctly fetch all respective attachments.
Bug fixes
Server
/tenant/${workspaceFullId}
to Advanced
.resolvedSchema
if not available in the schema.UI
AWS > Turbot > IAM > Managed
control.Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
Turbot > IAM > Permissions > Compiled > Levels > Turbot
policy will now be evaluated correctly and consistently.Bug fixes
What's new?
The AWS > S3 > Bucket
CMDB data will now also include information about Bucket Intelligent Tiering Configuration.
A few policy values in the AWS > S3 > Bucket > Encyprion at Rest
policy have now been deprecated and will be removed in the next major mod version (v6.0.0) because they are no longer supported by AWS.
| Deprecated Values
|-
| Check: None
| Check: None or higher
| Enforce: None
| Enforce: None or higher
Bug fixes
CreateDefaultVpc
events. This issue has been fixed, and Internet Gateways will now be more reliably upserted into the Guardrails CMDB.
We recommend updating the aws-vpc-core
mod to v5.17.1 or higher to allow Guardrails to process the CreateDefaultVpc
event for Internet Gateways correctly.Bug fixes
CreateDefaultVpc
events. This issue has been fixed, and DHCP Options will now be more reliably upserted into the Guardrails CMDB.Bug fixes
lists
events for various Dataproc resources. We've now improved our events filter to ignore these lists
events, thereby reducing unnecessary processing.Bug fixes
GCP > Turbot > Event Handlers > Pub/Sub
stack control previously attempted to create a topic and its IAM member incorrectly when the GCP > Turbot > Event Handlers > Logging > Unique Writer Identity
policy was set to Enforce: Unique Identity
, but the project number for the project was not available. This is fixed and the control will transition to an Invalid state until Guardrails can correctly fetch the project number.What's new?
Control Types:
Policy Types:
Action Types
Bug fixes
AWS > S3 > Bucket > Encryption in Transit
and AWS > S3 > Bucket > Encryption at Rest
control to wait for a few minutes before applying the respective policies to new buckets created via Cloudformation Stacks. We've now extended this feature to all buckets regardless of how they were created, to ensure that IaC changes can be correctly applied to buckets without interference from immediate policy enforcements.What's new?
What's new?
Note
To use the latest RDS certificate in commercial cloud, please upgrade TE to 5.42.3 or higher and update the RDS CA Certificate for Commercial Cloud
parameter.
Bug fixes
Server
UI
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
What's new?
Control Types:
Policy Types:
What's new?
AWS > Secrets Manager > Secret > CMDB
control would go into an error state if Guardrails did not have permissions to describe a secret. Users can now ignore such permission errors and allow the CMDB control to run its course to completion. To get started, set the AWS > Secrets Manager > Secret > CMDB
policy to Enforce: Enabled but ignore permission errors
.What's new?
You can now attach custom IAM Groups to Guardrails users if the AWS > Turbot > Permissions
policy is set to Enforce: User Mode
. To get started, set the AWS > Turbot > Permissions > Custom Group Levels [Account]
policy and then attach the custom group to a user via the Grant Permission button on the Permissions page. Please note that this feature will work as intended only on TE v5.42.18 or higher and turbot-iam
mod v5.11.0 or higher.
Policy Types:
Policy Types renamed:
What's new?
Control Types:
Policy Types:
Bug fixes
AWS > VPC > VPC > Stack
control would sometimes fail to claim existing Flow Logs in Guardrails CMDB. This is now fixed.What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
Bug fixes
AWS > SNS > Subscription > CMDB
control would go into an error state if Guardrails did not have permissions to describe a subscription. Users can now ignore such permission errors and allow the CMDB control to run its course to completion. To get started, set the AWS > SNS > Subscription > CMDB
policy to Enforce: Enabled but ignore permission errors
.What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
Bug fixes
GCP > Compute Engine > Instance Template > CMDB
control would sometimes go into an error state due to a bad internal build. This is fixed and the control will now work as expected.Bug fixes
Azure > Subscription
, importing subscriptions encountered schema validation problems. This issue has been resolved, and you can now successfully import subscriptions as before.Bug fixes
What's new?
ap-northeast-3
in the AWS > Account > Regions
policy.What's new?
af-south-1
, ap-northeast-3
, ap-south-2
, ap-southeast-3
, ap-southeast-4
, ca-west-1
, eu-central-2
, eu-south-1
, eu-south-2
, il-central-1
and me-central-1
regions in the AWS > Logs > Regions
policy.What's new?
You can now configure Block Public Access for Snapshots. To get started, set the AWS > EC2 > Account Attributes > Block Public Access for Snapshots
policy.
You can now also disable Block Public Access for AMIs. To get started, set the AWS > EC2 > Account Attributes > Block Public Access for AMIs
policy.
AWS/EC2/Admin
, AWS/EC2/Metadata
and AWS/EC2/Operator
now includes permissions for Verified Access Endpoints, Verified Access Groups and Verified Access Trust Providers.
Control Types:
Policy Types:
Action Types:
Bug fixes
What's new?
Deny: *
for HTTP in SNS Policy.What's new?
Bug fixes
Deny:*
policy for HTTP traffic back to the turbot-policy-parameter custom lambda code.Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
createdBy
details in Turbot CMDB.What's new?
createdBy
details in Turbot CMDB.What's new?
createdBy
details in Turbot CMDB.v1.10.1 of the Terraform Provider for Guardrails is now available.
Bug fixes
resource/turbot_file
: terraform apply failed to update content
of an existing File in Guardrails. This is now fixed.What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Policy Types:
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
What's new?
What's new?
createdBy
details in Turbot CMDB.What's new?
What's new?
What's new?
createdBy
details in Turbot CMDB.Bug fixes
The AWS > EC2 > Key Pair > Discovery
control would sometimes go into an error state if a Key Pair alias included escape characters. This is now fixed.
Control Types renamed:
AWS > EC2 > Volume > Configuration
to AWS > EC2 > Volume > Performance Configuration
Policy Types renamed:
AWS > EC2 > Volume > Configuration
to AWS > EC2 > Volume > Performance Configuration
AWS > EC2 > Volume > Configuration > IOPS Capacity
to AWS > EC2 > Volume > Performance Configuration > IOPS Capacity
AWS > EC2 > Volume > Configuration > Throughput
to AWS > EC2 > Volume > Performance Configuration > Throughput
AWS > EC2 > Volume > Configuration > Type
to AWS > EC2 > Volume > Performance Configuration > Type
Action Types renamed:
AWS > EC2 > Volume > Update Configuration
to AWS > EC2 > Volume > Update Performance Configuration
Bug fixes
Turbot > Policy Setting Expiration
control will now run every 12 hours to manage policy setting expirations more consistently than before.What's new?
What's new?
What's new?
createdBy
details in Turbot CMDB.What's new?
createdBy
details in Turbot CMDB.What's new?
What's new?
What's new?
createdBy
details in Turbot CMDB.What's new?
createdBy
details in Turbot CMDB.What's new?
What's new?
createdBy
details in Turbot CMDB.Bug fixes
What's new?
What's new?
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Policy Types:
What's new?
createdBy
details in Turbot CMDB.What's new?
createdBy
details in Turbot CMDB.What's new?
What's new?
What's new?
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
Action Types:
What's new?
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
What's new?
Resource Types:
Control Types:
Policy Types:
Action Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
Bug fixes
GCP > Turbot > Event Poller
control now includes a precheck condition to avoid running GraphQL input queries when the GCP > Turbot > Event Poller
policy is set to Disabled
. You won’t notice any difference and the control should run lighter and quicker than before.Bug fixes
Azure > Turbot > Event Poller
and Azure > Turbot > Management Group Event Poller
controls now include a precheck condition to avoid running GraphQL input queries when the Azure > Turbot > Event Poller
and Azure > Turbot > Management Group Event Poller
policies are set to Disabled
respectively. You won’t notice any difference and the controls should run lighter and quicker than before.Bug fixes
Azure > Turbot > Directory Event Poller
control now includes a precheck condition to avoid running GraphQL input queries when the Azure > Turbot > Directory Event Poller
policy is set to Disabled
. You won’t notice any difference and the control should run lighter and quicker than before.Bug fixes
AWS > Turbot > Event Poller
control now includes a precheck condition to avoid running GraphQL input queries when the AWS > Turbot > Event Poller
policy is set to Disabled
. You won’t notice any difference and the control should run lighter and quicker than before.What's new?
Resource Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
aws_network_interface_sg_attachment
Terraform resource for AWS > EC2 > Network Interface
.Bug fixes
AWS > EC2 > Instance > CMDB
control would sometimes trigger multiple times if EnclaveOptions
was not set as part of the AWS > EC2 > Instance > CMDB > Attributes
policy. This would result in unnecessary Lambda runs for the control. The EnclaveOptions
attribute is now available in the CMDB data by default and the EnclaveOptions
policy value in AWS > EC2 > Instance > CMDB > Attributes
policy has now been deprecated, and will be removed in the next major version.What's new?
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Server
Require Signed Assertion Response
.UI:
Require Signed Assertion Response
for enhanced security in SAML authentication.Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Enhanced Security and Compatibility Guide for SAML Authentication
Description:
The recent update to @node-saml/passport-saml
mandates the signing of the assertion response. To ensure backward compatibility, we have introduced a new configuration option in the UI:
By default, this option is set to Disabled
to maintain compatibility with existing setups.
Recommendations: We recommend enabling this option as it adds an additional layer of security. However, please be aware that enabling this setting might impact the SAML login functionality.
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
What's new?
Control Types:
Policy Types:
Bug fixes
AWS > RDS > DB Instance > Discovery
control would sometimes upsert DocumentDB Instances as RDS Instances in Guardrails CMDB. This is fixed and the control will now filter out DocumentDB Instances while upserting resources in CMDB.What's new?
What's new?
Control Types:
Policy Types:
Action Types:
Bug fixes
AWS > IAM > Account Password Policy > CMDB
control would incorrectly go into an Alarm state when Guardrails was denied access to fetch the Account Password Policy data. This is fixed and the control will now move to an Error state instead for such cases.Bug fixes
What's new?
AWS/CloudFront/Admin
and AWS/CloudFront/Metadata
will now also include permissions for CloudFront KeyValueStore.Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
What's new?
Policy Types:
Control Types:
Action Types:
What's new?
Policy Types:
Control Types:
What's new?
Policy Types:
Control Types:
What's new?
Policy Types:
Control Types:
What's new?
Policy Types:
Control Types:
What's new?
Policy Types:
Control Types:
Action Types:
What's new?
Policy Types:
Control Types:
What's new?
Policy Types:
Control Types:
What's new?
Policy Types:
Control Types:
What's new?
Policy Types:
Control Types:
What's new?
Policy Types:
Control Types:
What's new?
Policy Types:
Control Types:
Bug fixes
ServiceNow > Turbot > Watches > AWS
control would fail to delete/archive records in ServiceNow. This is now fixed.Bug fixes
Requirements
Base images
Alpine: 3.17.5 Ubuntu: 22.04.3
Bug fixes
cmdb_ci*
Table. This is fixed and users will now be able to extend the resource's Table off of any Table in ServiceNow.Bug fixes
cmdb_ci*
Table. This is fixed and users will now be able to extend the resource's Table off of any Table in ServiceNow.Bug fixes
cmdb_ci*
Table. This is fixed and users will now be able to extend the resource's Table off of any Table in ServiceNow.Bug fixes
cmdb_ci*
Table. This is fixed and users will now be able to extend the resource's Table off of any Table in ServiceNow.Bug fixes
cmdb_ci*
Table. This is fixed and users will now be able to extend the resource's Table off of any Table in ServiceNow.Bug fixes
cmdb_ci*
Table. This is fixed and users will now be able to extend the resource's Table off of any Table in ServiceNow.Bug fixes
cmdb_ci*
Table. This is fixed and users will now be able to extend the resource's Table off of any Table in ServiceNow.Bug fixes
Bug fixes
Bug fixes
Bug fixes
Bug fixes
Bug fixes
Bug fixes
Bug fixes
Bug fixes
AWS > Turbot > Event Poller
policy will now be automatically set to Disabled
if any of the AWS > Turbot > Event Handlers
or AWS > Turbot > Event Handlers [Global]
policies is set to Enforce: Configured
.Bug fixes
Bug fixes
What's new?
Resource Types:
Policy Types:
Control Types:
Action Types:
What's new?
Policy Types:
Control Types:
What's new?
Policy Types:
Control Types:
What's new?
Policy Types:
Control Types:
What's new?
Policy Types:
Control Types:
Action Types:
What's new?
Policy Types:
Control Types:
What's new?
Policy Types:
Control Types:
What's new?
Policy Types:
Control Types:
What's new?
Server
UI:
What's new?
What's new?
Resource Types:
Policy Types:
What's new?
What's new?
What's new?
You can now Enable/Disable Firebase Management API via Guardrails. To get started, set the GCP > Firebase > API Enabled
policy.
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Control Types:
Policy Types:
Action Types:
What's new?
Added support for newer US, Europe, India and US Government regions in the Azure > Synapse Analytics > Regions
policy.
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
What's new?
What's new?
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
What's new?
createdBy
details in Turbot CMDB.What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
What's new?
createdBy
details in Turbot CMDB.What's new?
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
What's new?
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
What's new?
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
What's new?
Users can now perform quick actions on resources to remediate cloud configuration issues or skip Turbot alarms for issues that they want to come back to later. To get started, click on the Actions
button, which will reveal a dropdown menu with available actions, and select one. See Quick Actions for more information.
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
Action Types:
What's new?
Users can now perform quick actions on resources to remediate cloud configuration issues or skip Turbot alarms for issues that they want to come back to later. To get started, click on the Actions
button, which will reveal a dropdown menu with available actions, and select one. See Quick Actions for more information.
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Policy Types:
Action Types:
What's new?
Users can now perform quick actions on resources to remediate cloud configuration issues or skip Turbot alarms for issues that they want to come back to later. To get started, click on the Actions
button, which will reveal a dropdown menu with available actions, and select one. See Quick Actions for more information.
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
Action Types:
What's new?
Users can now perform quick actions on resources to remediate cloud configuration issues or skip Turbot alarms for issues that they want to come back to later. To get started, click on the Actions
button, which will reveal a dropdown menu with available actions, and select one. See Quick Actions for more information.
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
Action Types:
What's new?
Users can now perform quick actions on resources to remediate cloud configuration issues or skip Turbot alarms for issues that they want to come back to later. To get started, click on the Actions
button, which will reveal a dropdown menu with available actions, and select one. See Quick Actions for more information.
We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.
Resource's metadata will now also include createdBy
details in Turbot CMDB.
Policy Types:
Action Types:
What's new?
Server
passport-saml
to @node-saml/passport-saml
: 4.0.4Require Signed Authentication Response
and Strict Audience Validation
.UI:
Require Signed Authentication Response
and Strict Audience Validation
for enhanced security in SAML authentication.Enhanced Security and Compatibility Guide for SAML Authentication
Description
The recent package change for @node-saml/passport-saml
has made it mandatory to sign the audience response and perform audience validation. To maintain ba