Resolve Calculated Policy Evaluation Errors

In this guide, you will:

• Use Guardrails console to identify and resolve calculated policy evaluation errors.

A Calculated Policy dynamically determines policy settings by sourcing CMDB data, executing a GraphQL query, and applying a Nunjucks template to generate a resource-specific policy value. Any policy setting can be calculated, making policies more context-aware and adaptable.

However, calculated policies can sometimes encounter errors due to misconfigurations or data inconsistencies, leading to controls entering an error state. Ensuring these policies are properly configured and promptly fixed is crucial for maintaining compliance and system stability.

Prerequisites

• Turbot/Admin permissions at the Turbot resource level.
• Familiarity with the Guardrails console.
• Knowledge of the Jinja2/Nunjucks template language.

Step 1: Navigate to Policies

Log into the Guardrails console with provided local credentials or by using any SAML based login and Select Policies from the top navigation menu.

Step 2: Select Policy Value

Select the calculated policy in an error state that needs to be resolved. This redirects to the Policy Value page, where the error message is displayed.

Here, the error occurs due to TypeError: Cannot read properties of undefined (reading 'toString'), indicating that the referenced property is undefined and cannot be converted to a string.

Step 3: Select Calculated Policy

Select the Calculated policy, with an ✅ EFFECTIVE SETTING.

Step 4: Edit Policy Setting

Select Edit from the top right corner.

Choose Launch calculated policy builder.

This displays the GraphQL query and Jinja2/Nunjucks template used in the calculated policy, providing insight into how the policy value is generated.

Step 5: Resolve Calculated Policy

Select the Test Resource, update the corrected Jinja2/Nunjucks template, and view the real-time output to verify if the fix is successful. Choose Update.

Select Update from the Update Policy Setting page.

Step 6: Review

• Verify that the policy value transitions to an OK state, confirming the issue has been resolved successfully.

• Verify that the affected control transitions to an OK state.

Troubleshooting