Policy types for @turbot/aws-backup

Parent

Targets

Valid Value

[
  "Enabled",
  "Disabled",
  "Enabled if AWS > Backup > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled",
    "Enabled if AWS > Backup > Enabled"
  ],
  "default": "Enabled"
}

AWS > Backup > Approved Regions [Default]

A list of AWS regions in which AWS Backup resources are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy is the default value for all AWS Backup resources' Approved > Regions policies.

URI

tmod:@turbot/aws-backup#/policy/types/backupApprovedRegionsDefault

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws#/policy/types/approvedRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Backup > Backup Plan > Active

Determine the action to take when an AWS Backup backup plan, based on the AWS > Backup > Backup Plan > Active > * policies.

The control determines whether the resource is in active use, and if not, has the ability to delete / cleanup the resource. When running an automated compliance environment, it's common to end up with a wide range of alarms that are difficult and time consuming to clear. The Active control brings automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the resource (AWS > Backup > Backup Plan > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Plan > Active > Age

The age after which the AWS Backup backup plan is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

The Active control determines whether the resource is in active use, and if not, has the ability to delete / cleanup the resource. When running an automated compliance environment, it's common to end up with a wide range of alarms that are difficult and time consuming to clear. The Active control brings automated, well-defined control to this process.

See Active for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanActiveAge

Category

AWS > Backup > Backup Plan > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Plan > Active > Last Modified

The number of days since the AWS Backup backup plan was last modified before it is considered inactive.

See Active for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanActiveLastModified

Category

AWS > Backup > Backup Plan > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Plan > Approved

Determine the action to take when an AWS Backup backup plan is not approved based on AWS > Backup > Backup Plan > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Plan > Approved > Custom

Determine whether the AWS Backup backup plan is allowed to exist. This policy will be evaluated by the Approved control. If an AWS Backup backup plan is not approved, it will be subject to the action specified in the AWS > Backup > Backup Plan > Approved policy. See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanApprovedCustom

Category

AWS > Backup > Backup Plan > Approved

Parent

Targets

Schema

{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > Backup > Backup Plan > Approved > Regions

A list of AWS regions in which AWS Backup backup plans are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS Backup backup plan is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > Backup > Backup Plan > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanApprovedRegions

Category

AWS > Backup > Backup Plan > Approved

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-backup#/policy/types/backupApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Backup > Backup Plan > Approved > Usage

Determine whether the AWS Backup backup plan is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS Backup backup plan is not approved, it will be subject to the action specified in the AWS > Backup > Backup Plan > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanApprovedUsage

Category

AWS > Backup > Backup Plan > Approved

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > Backup > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > Backup > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > Backup > Enabled"
}

AWS > Backup > Backup Plan > CMDB

Record and synchronize details for AWS Backup backupplan(s) into the CMDB.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Backup > Backup Plan > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored and inherit from the stack that owns it.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanConfigured

Category

Parent

Targets

Valid Value

[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]

Schema

{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > Backup > Backup Plan > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource. A stack cannot claim a resource if it is already claimed by another stack at a higher level of precedence.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanConfiguredPrecedence

Category

AWS > Backup > Backup Plan > Configured

Parent

Targets

Default Template Input

"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"

Default Template

"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"

Schema

{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > Backup > Backup Plan > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanConfiguredSource

Category

AWS > Backup > Backup Plan > Configured

Parent

Targets

Schema

{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > Backup > Backup Plan > Regions

A list of AWS regions in which AWS Backup backup plans are supported for use.

Any backup plans in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-backup#/policy/types/backupRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Backup > Backup Plan > Tags

Determine the action to take when an AWS Backup backup plan tags are not updated based on the AWS > Backup > Backup Plan > Tags > * policies.

The control ensure AWS Backup backup plan tags include tags defined in AWS > Backup > Backup Plan > Tags > Template.

Tags not defined in Backup Plan Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanTags

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Plan > Tags > Template

The template is used to generate the keys and values for AWS Backup backup plan.

Tags not defined in Backup Plan Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanTagsTemplate

Category

AWS > Backup > Backup Plan > Tags

Parent

Targets

Default Template Input

[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-backup#/policy/types/backupTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > Backup > Backup Plan > Usage

Configure the number of AWS Backup backup plans that can be used for this account and the current consumption against the limit.

You can configure the behavior of the control with this AWS > Backup > Backup Plan > Usage policy.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Plan > Usage > Limit

Maximum number of items that can be created for this account.

URI

tmod:@turbot/aws-backup#/policy/types/backupPlanUsageLimit

Category

AWS > Backup > Backup Plan > Usage

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 100
}

AWS > Backup > Backup Selection > Active

Determine the action to take when an AWS Backup backup selection, based on the AWS > Backup > Backup Selection > Active > * policies.

The Active control checks the status of all defined Active policies for the resource (AWS > Backup > Backup Selection > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupSelectionActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Selection > Active > Age

The age after which the AWS Backup backup selection is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

See Active for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupSelectionActiveAge

Category

AWS > Backup > Backup Selection > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Selection > Active > Last Modified

The number of days since the AWS Backup backup selection was last modified before it is considered inactive.

See Active for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupSelectionActiveLastModified

Category

AWS > Backup > Backup Selection > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Selection > Approved

Determine the action to take when an AWS Backup backup selection is not approved based on AWS > Backup > Backup Selection > Approved > * policies.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupSelectionApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Selection > Approved > Custom

Determine whether the AWS Backup backup selection is allowed to exist. This policy will be evaluated by the Approved control. If an AWS Backup backup selection is not approved, it will be subject to the action specified in the AWS > Backup > Backup Selection > Approved policy. See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupSelectionApprovedCustom

Category

AWS > Backup > Backup Selection > Approved

Parent

Targets

Schema

{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > Backup > Backup Selection > Approved > Regions

A list of AWS regions in which AWS Backup backup selections are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS Backup backup selection is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > Backup > Backup Selection > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupSelectionApprovedRegions

Category

AWS > Backup > Backup Selection > Approved

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-backup#/policy/types/backupApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Backup > Backup Selection > Approved > Usage

Determine whether the AWS Backup backup selection is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS Backup backup selection is not approved, it will be subject to the action specified in the AWS > Backup > Backup Selection > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupSelectionApprovedUsage

Category

AWS > Backup > Backup Selection > Approved

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > Backup > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > Backup > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > Backup > Enabled"
}

AWS > Backup > Backup Selection > CMDB

Configure whether to record and synchronize details for the AWS Backup backup selection into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Turbot CMDB. All policies and controls in Turbot are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Backup > Backup Selection > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-backup#/policy/types/backupSelectionCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Backup > Backup Selection > Regions

A list of AWS regions in which AWS Backup backup selections are supported for use.

Any backup selections in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-backup#/policy/types/backupSelectionRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-backup#/policy/types/backupRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Backup > Backup Vault > Active

Determine the action to take when an AWS Backup backup vault, based on the AWS > Backup > Backup Vault > Active > * policies.

The Active control checks the status of all defined Active policies for the resource (AWS > Backup > Backup Vault > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Vault > Active > Age

The age after which the AWS Backup backup vault is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

See Active for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultActiveAge

Category

AWS > Backup > Backup Vault > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Vault > Active > Budget

The impact of the budget state on the active control. This policy allows you to force backupVaults to inactive based on the current budget state, as reflected in AWS > Account > Budget > State

See Active for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultActiveBudget

Category

AWS > Backup > Backup Vault > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if Budget > State is Over or higher",
  "Force inactive if Budget > State is Critical or higher",
  "Force inactive if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if Budget > State is Over or higher",
    "Force inactive if Budget > State is Critical or higher",
    "Force inactive if Budget > State is Shutdown"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Vault > Active > Last Modified

The number of days since the AWS Backup backup vault was last modified before it is considered inactive.

See Active for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultActiveLastModified

Category

AWS > Backup > Backup Vault > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Vault > Approved

Determine the action to take when an AWS Backup backup vault is not approved based on AWS > Backup > Backup Vault > Approved > * policies.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Vault > Approved > Budget

The policy allows you to set backup vaults to unapproved based on the current budget state, as reflected in AWS > Account > Budget > State

This policy will be evaluated by the Approved control. If an AWS Backup backup vault is not matched by the approved list, it will be subject to the action specified in the AWS > Backup > Backup Vault > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultApprovedBudget

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Unapproved if Budget > State is Over or higher",
  "Unapproved if Budget > State is Critical or higher",
  "Unapproved if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Unapproved if Budget > State is Over or higher",
    "Unapproved if Budget > State is Critical or higher",
    "Unapproved if Budget > State is Shutdown"
  ],
  "example": [
    "Unapproved if Budget > State is Shutdown"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Vault > Approved > Custom

Determine whether the AWS Backup backup vault is allowed to exist. This policy will be evaluated by the Approved control. If an AWS Backup backup vault is not approved, it will be subject to the action specified in the AWS > Backup > Backup Vault > Approved policy. See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultApprovedCustom

Category

Parent

Targets

Resource > Encryption at Rest

Schema

{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > Backup > Backup Vault > Approved > Encryption at Rest

Define the Encryption at Rest settings required for AWS > Backup > Backup Vault.

Encryption at Rest refers specifically to the encryption of data when written to an underlying storage system. This control determines whether the resource is encrypted at rest, and sets encryption to your desired level.

The Encryption at Rest control compares the encryption settings against the encryption policies for the resource (AWS > Backup > Backup Vault > Encryption at Rest > *), raises an alarm, and takes the defined enforcement action

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultEncryptionAtRest

Category

Parent

Targets

Resource > Encryption at Rest

Valid Value

[
  "None",
  "None or higher",
  "AWS managed key",
  "AWS managed key or higher",
  "Customer managed key",
  "Encryption at Rest > Customer Managed Key"
]

Schema

{
  "type": "string",
  "enum": [
    "None",
    "None or higher",
    "AWS managed key",
    "AWS managed key or higher",
    "Customer managed key",
    "Encryption at Rest > Customer Managed Key"
  ],
  "example": [
    "None or higher"
  ],
  "default": "None or higher"
}

AWS > Backup > Backup Vault > Approved > Encryption at Rest > Customer Managed Key

Define the KMS key ID for encryption at rest.

Please make sure the key defined in the template has required permissions.

example:
  alias/aws/ebs
  ddc06e04-ce5f-4995-c758-c2b6c510e8fd
  arn:aws:kms:us-east-1:123456789012:key/ddc06e04-ce5f-4995-c758-c2b6c510e8fd
  arn:aws:kms:us-east-1:123456789012:alias/aws/ebs

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultEncryptionAtRestCustomerManagedKey

Category

Parent

AWS > Backup > Backup Vault > Approved > Encryption at Rest

Targets

Default Template Input

"{\n  defaultKey: policy(uri: \"aws-kms#/policy/types/keyDefaultCustomerManagedKey\")\n}\n"

Default Template

"{{ $.defaultKey }}"

Schema

{
  "anyOf": [
    {
      "type": "string",
      "pattern": "^alias/[a-zA-Z0-9:/_-]{1,249}$"
    },
    {
      "type": "string",
      "pattern": "^[-a-z0-9-]{1,255}$"
    },
    {
      "type": "string",
      "pattern": "^arn:aws(-us-gov|-cn)?:kms:[a-z]{2}(-gov)?-[a-z]+-[0-9]:[0-9]{12}:key/[-a-z0-9-]{1,255}$"
    },
    {
      "type": "string",
      "pattern": "^arn:aws(-us-gov|-cn)?:kms:[a-z]{2}(-gov)?-[a-z]+-[0-9]:[0-9]{12}:alias/[a-zA-Z0-9:/_-]{1,249}$"
    }
  ],
  "tests": [
    {
      "description": "valid - if keyArn",
      "input": "arn:aws:kms:us-east-1:039305405804:key/ddc06e04-ce5f-4995-b758-c2b6c510e8fd"
    },
    {
      "description": "valid - if aliasName",
      "input": "alias/aws/ebs"
    },
    {
      "description": "valid - if keyId",
      "input": "ddc06e04-ce5f-4995-b758-c2b6c510e8fd"
    },
    {
      "description": "valid - if aliasArn",
      "input": "arn:aws:kms:us-east-1:039305405804:alias/aws/ebs"
    }
  ]
}

AWS > Backup > Backup Vault > Approved > Regions

A list of AWS regions in which AWS Backup backup vaults are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS Backup backup vault is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > Backup > Backup Vault > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultApprovedRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-backup#/policy/types/backupApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Backup > Backup Vault > Approved > Usage

Determine whether the AWS Backup backup vault is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS Backup backup vault is not approved, it will be subject to the action specified in the AWS > Backup > Backup Vault > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultApprovedUsage

Category

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > Backup > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > Backup > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > Backup > Enabled"
}

AWS > Backup > Backup Vault > CMDB

Configure whether to record and synchronize details for the AWS Backup backup vault into the CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Backup > Backup Vault > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Backup > Backup Vault > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored and inherit from the stack that owns it.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultConfigured

Category

Parent

Targets

Valid Value

[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]

Schema

{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > Backup > Backup Vault > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource. A stack cannot claim a resource if it is already claimed by another stack at a higher level of precedence.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultConfiguredPrecedence

Category

AWS > Backup > Backup Vault > Configured

Parent

Targets

Default Template Input

"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"

Default Template

"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"

Schema

{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > Backup > Backup Vault > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultConfiguredSource

Category

AWS > Backup > Backup Vault > Configured

Parent

Targets

Schema

{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > Backup > Backup Vault > Regions

A list of AWS regions in which AWS Backup backup vaults are supported for use.

Any backup vaults in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-backup#/policy/types/backupRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Backup > Backup Vault > Tags

Determine the action to take when an AWS Backup backup vault tags are not updated based on the AWS > Backup > Backup Vault > Tags > * policies.

The control ensure AWS Backup backup vault tags include tags defined in AWS > Backup > Backup Vault > Tags > Template.

Tags not defined in Backup Vault Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultTags

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Vault > Tags > Template

The template is used to generate the keys and values for AWS Backup backup vault.

Tags not defined in Backup Vault Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultTagsTemplate

Category

AWS > Backup > Backup Vault > Tags

Parent

Targets

Default Template Input

[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-backup#/policy/types/backupTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > Backup > Backup Vault > Usage

Configure the number of AWS Backup backup vaults that can be used for this account and the current consumption against the limit.

You can configure the behavior of the control with this AWS > Backup > Backup Vault > Usage policy.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > Backup > Backup Vault > Usage > Limit

Maximum number of items that can be created for this account.

URI

tmod:@turbot/aws-backup#/policy/types/backupVaultUsageLimit

Category

AWS > Backup > Backup Vault > Usage

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 100
}

AWS > Backup > Enabled

Configure whether the AWS Backup service is enabled. This will only affect Turbot managed User Roles and will allow the Turbot managed user to access AWS Backup service.

Enabled policy allows Turbot managed users to perform all the actions for the service
Enabled: Metadata Only policy allows Turbot managed users to perform only the metadata level actions for the service (like describe*, list*)

Note:

Disabled policy disables the service but does NOT disable the API for Turbot or SuperUsers
All the resource data stored in the Turbot CMDB is considered to be metadata
For more information related to permissions and grant levels, please check the documentation

URI

tmod:@turbot/aws-backup#/policy/types/backupEnabled

Category

Parent

Targets

Valid Value

[
  "Enabled",
  "Enabled: Metadata Only",
  "Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled",
    "Enabled: Metadata Only",
    "Disabled"
  ],
  "example": [
    "Enabled"
  ],
  "default": "Disabled"
}

AWS > Backup > Permissions

Configure whether permissions policies are in effect for AWS Backup.

This setting does not affect account level permissions (AWS/Admin, AWS/Owner, etc)

Note: The behavior of this policy depends on the value of AWS > Permissions.

URI

tmod:@turbot/aws-backup#/policy/types/backupPermissions

Category

Parent

Targets

Valid Value

[
  "Enabled",
  "Disabled",
  "Enabled if AWS > Backup > Enabled & AWS > Backup > API Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled",
    "Enabled if AWS > Backup > Enabled & AWS > Backup > API Enabled"
  ],
  "example": [
    "Enabled"
  ],
  "default": "Enabled if AWS > Backup > Enabled & AWS > Backup > API Enabled"
}

AWS > Backup > Permissions > Levels

Define the permissions levels that can be used to grant access to an AWS account. Permissions levels defined will appear in the UI to assign access to Turbot users. This policy provides a default for Permissions > Levels in each service, however you can explicitly override the setting for each service if desired

URI

tmod:@turbot/aws-backup#/policy/types/backupPermissionsLevels

Category

AWS > Backup > Permissions

Parent

Targets

Default Template Input

[
  "{\n  item: account {\n    turbot{\n      id\n    }\n  }\n}\n",
  "{\n  availableLevels: policyValues(filter:\"policyTypeLevel:self resourceId:{{ $.item.turbot.id }} policyType:'tmod:@turbot/aws-iam#/policy/types/permissionsLevelsDefault'\") {\n    items {\n      value\n    }\n  }\n}\n"
]

Default Template

"{% if $.availableLevels.items[0].value | length == 0 %} [] {% endif %}{% for item in $.availableLevels.items[0].value %}- {{ item }}\n{% endfor %}"

Schema

{
  "type": "array",
  "items": {
    "type": "string",
    "enum": [
      "Metadata",
      "ReadOnly",
      "Operator",
      "Admin",
      "Owner"
    ]
  }
}

AWS > Backup > Permissions > Levels > Modifiers

A map of AWS API to Turbot Permission Level used to customize Turbot's standard permissions. You can add, remove or redefine the mapping of AWS API operations to Turbot permissions levels here.

Note: Modifiers are cumulative - if you add a permission to the Metadata level, it is also added to ReadOnly, Operator and Admin. Modifier policies set here apply ONLY to the AWS level

example:
  - &quot;glacier:createvault&quot;: admin
  - &quot;glacier:ListVaults&quot;: metadata
  - &quot;s3:DeleteBucket&quot;: none

URI

tmod:@turbot/aws-backup#/policy/types/backupPermissionsLevelsModifiers

Category

AWS > Backup > Permissions > Levels

Parent

Targets

aws-iam#/definitions/awsModifierList

Schema

AWS > Backup > Permissions > Lockdown

URI

tmod:@turbot/aws-backup#/policy/types/backupPermissionsLockdown

Category

AWS > Backup > Permissions

Parent

Targets

AWS > Backup > Permissions > Lockdown > API Boundary

Configure whether the AWS backup API is enabled for all users and roles in turbot-managed boundary policies.

Note: Disabling the service disables the API for ALL users and roles, and Turbot will have no access to the API.

URI

tmod:@turbot/aws-backup#/policy/types/backupPermissionsLockdownApiBoundary

Category

AWS > Backup > Permissions > Lockdown

Parent

Targets

Valid Value

[
  "Enabled if AWS > Backup > API Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled if AWS > Backup > API Enabled"
  ],
  "example": [
    "Enabled if AWS > Backup > API Enabled"
  ],
  "default": "Enabled if AWS > Backup > API Enabled"
}

AWS > Backup > Protected Resource > CMDB

Configure whether to record and synchronize details for the AWS Backup protected resource into the CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Backup > Protected Resource > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-backup#/policy/types/protectedResourceCmdb

Category

AWS > Backup > Protected Resource

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Backup > Protected Resource > Regions

A list of AWS regions in which AWS Backup protected resources are supported for use.

Any protected resources in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-backup#/policy/types/protectedResourceRegions

Category

AWS > Backup > Protected Resource

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-backup#/policy/types/backupRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Backup > Recovery Point > Active

Determine the action to take when an AWS Backup recovery point, based on the AWS > Backup > Recovery Point > Active > * policies.

The Active control checks the status of all defined Active policies for the resource (AWS > Backup > Recovery Point > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-backup#/policy/types/recoveryPointActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Backup > Recovery Point > Active > Age

The age after which the AWS Backup recovery point is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

See Active for more information.

URI

tmod:@turbot/aws-backup#/policy/types/recoveryPointActiveAge

Category

AWS > Backup > Recovery Point > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > Backup > Recovery Point > Active > Budget

The impact of the budget state on the active control. This policy allows you to force recoveryPoints to inactive based on the current budget state, as reflected in AWS > Account > Budget > State

See Active for more information.

URI

tmod:@turbot/aws-backup#/policy/types/recoveryPointActiveBudget

Category

AWS > Backup > Recovery Point > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if Budget > State is Over or higher",
  "Force inactive if Budget > State is Critical or higher",
  "Force inactive if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if Budget > State is Over or higher",
    "Force inactive if Budget > State is Critical or higher",
    "Force inactive if Budget > State is Shutdown"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > Backup > Recovery Point > Active > Last Modified

The number of days since the AWS Backup recovery point was last modified before it is considered inactive.

See Active for more information.

URI

tmod:@turbot/aws-backup#/policy/types/recoveryPointActiveLastModified

Category

AWS > Backup > Recovery Point > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > Backup > Recovery Point > Approved

Determine the action to take when an AWS Backup recovery point is not approved based on AWS > Backup > Recovery Point > Approved > * policies.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/recoveryPointApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > Backup > Recovery Point > Approved > Budget

The policy allows you to set recovery points to unapproved based on the current budget state, as reflected in AWS > Account > Budget > State

This policy will be evaluated by the Approved control. If an AWS Backup recovery point is not matched by the approved list, it will be subject to the action specified in the AWS > Backup > Recovery Point > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/recoveryPointApprovedBudget

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Unapproved if Budget > State is Over or higher",
  "Unapproved if Budget > State is Critical or higher",
  "Unapproved if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Unapproved if Budget > State is Over or higher",
    "Unapproved if Budget > State is Critical or higher",
    "Unapproved if Budget > State is Shutdown"
  ],
  "example": [
    "Unapproved if Budget > State is Shutdown"
  ],
  "default": "Skip"
}

AWS > Backup > Recovery Point > Approved > Custom

Determine whether the AWS Backup recovery point is allowed to exist. This policy will be evaluated by the Approved control. If an AWS Backup recovery point is not approved, it will be subject to the action specified in the AWS > Backup > Recovery Point > Approved policy. See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/recoveryPointApprovedCustom

Category

Parent

Targets

Schema

{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > Backup > Recovery Point > Approved > Regions

A list of AWS regions in which AWS Backup recovery points are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS Backup recovery point is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > Backup > Recovery Point > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/recoveryPointApprovedRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-backup#/policy/types/backupApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Backup > Recovery Point > Approved > Usage

Determine whether the AWS Backup recovery point is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS Backup recovery point is not approved, it will be subject to the action specified in the AWS > Backup > Recovery Point > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-backup#/policy/types/recoveryPointApprovedUsage

Category

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > Backup > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > Backup > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > Backup > Enabled"
}

AWS > Backup > Recovery Point > CMDB

Configure whether to record and synchronize details for the AWS Backup recovery point into the CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Backup > Recovery Point > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-backup#/policy/types/recoveryPointCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Backup > Recovery Point > Regions

A list of AWS regions in which AWS Backup recovery points are supported for use.

Any recovery points in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-backup#/policy/types/recoveryPointRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-backup#/policy/types/backupRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Backup > Recovery Point > Tags

Determine the action to take when an AWS Backup recovery point tags are not updated based on the AWS > Backup > Recovery Point > Tags > * policies.

The control ensure AWS Backup recovery point tags include tags defined in AWS > Backup > Recovery Point > Tags > Template.

Tags not defined in Recovery Point Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-backup#/policy/types/recoveryPointTags

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > Backup > Recovery Point > Tags > Template

The template is used to generate the keys and values for AWS Backup recovery point.

Tags not defined in Recovery Point Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-backup#/policy/types/recoveryPointTagsTemplate

Category

AWS > Backup > Recovery Point > Tags

Parent

Targets

Default Template Input

[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-backup#/policy/types/backupTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > Backup > Region Settings > CMDB

Configure whether to record and synchronize details for the AWS Backup Region Settings into the CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Backup > Region Settings > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-backup#/policy/types/regionSettingsCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Backup > Region Settings > Regions

A list of AWS regions in which AWS Backup region settings are supported for use.

Any region settings in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-backup#/policy/types/regionSettingsRegions

Category

Parent

Targets

Schema

{
  "allOf": [
    {
      "$ref": "aws#/definitions/regionNameMatcherList"
    },
    {
      "default": [
        "ap-east-1",
        "ap-northeast-1",
        "ap-northeast-2",
        "ap-south-1",
        "ap-southeast-1",
        "ap-southeast-2",
        "ca-central-1",
        "cn-north-1",
        "cn-northwest-1",
        "eu-central-1",
        "eu-north-1",
        "eu-west-1",
        "eu-west-2",
        "eu-west-3",
        "me-south-1",
        "sa-east-1",
        "us-east-1",
        "us-east-2",
        "us-west-1",
        "us-west-2"
      ]
    }
  ]
}

AWS > Backup > Region Settings > Service Opt-In

Update the current service opt-in settings for the Region. If service-opt-in is enabled for a service, AWS Backup tries to protect that service's resources in this Region, when the resource is included in an on-demand backup or scheduled backup plan. Otherwise, AWS Backup does not try to protect that service's resources in this Region.

URI

tmod:@turbot/aws-backup#/policy/types/regionSettingsServiceOptIn

Category

Other

Parent

Targets

AWS > Backup > Region Settings > Service Opt-In

Valid Value

[
  "Skip",
  "Check: Service opt-in per resources list",
  "Enforce: Service opt-in per resources list"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Service opt-in per resources list",
    "Enforce: Service opt-in per resources list"
  ],
  "default": "Skip"
}

AWS > Backup > Region Settings > Service Opt-In > Resources

Enable and disable resource types (e.g., EC2, EFS, etc.) that will be protected by backup plans in this account and region. You will need to enable newly launched resource types before they are protected.

URI

tmod:@turbot/aws-backup#/policy/types/regionSettingsResources

Category

Other

Parent

Targets

Schema

{
  "type": "array",
  "items": {
    "type": "string",
    "enum": [
      "Aurora",
      "DynamoDB",
      "EBS",
      "EC2",
      "EFS",
      "FSx",
      "RDS",
      "Storage Gateway"
    ]
  },
  "default": [
    "Aurora",
    "DynamoDB",
    "EBS",
    "EC2",
    "EFS",
    "FSx",
    "RDS",
    "Storage Gateway"
  ]
}

AWS > Backup > Regions

A list of AWS regions in which AWS Backup resources are supported for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy is the default value for all AWS Backup resources' Regions policies.

URI

tmod:@turbot/aws-backup#/policy/types/backupRegionsDefault

Category

Parent

Targets

Schema

{
  "allOf": [
    {
      "$ref": "aws#/definitions/regionNameMatcherList"
    },
    {
      "default": [
        "ap-east-1",
        "ap-northeast-1",
        "ap-northeast-2",
        "ap-south-1",
        "ap-southeast-1",
        "ap-southeast-2",
        "ca-central-1",
        "cn-north-1",
        "cn-northwest-1",
        "eu-central-1",
        "eu-north-1",
        "eu-west-1",
        "eu-west-2",
        "eu-west-3",
        "me-south-1",
        "sa-east-1",
        "us-east-1",
        "us-east-2",
        "us-gov-east-1",
        "us-gov-west-1",
        "us-west-1",
        "us-west-2"
      ]
    }
  ]
}

AWS > Backup > Stack

Configure a custom stack on AWS, per the custom Stack > Source.

A Turbot Stack is a set of resources configured by Turbot, as specified via Terraform source. Stacks are responsible for the creation and deletion of multiple resources. Once created, stack resources are responsible for configuring themselves from the stack source via their Configured control.

URI

tmod:@turbot/aws-backup#/policy/types/backupStack

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Configured",
  "Enforce: Configured"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Configured",
    "Enforce: Configured"
  ],
  "default": "Skip"
}

AWS > Backup > Stack > Secret Variables

Terraform secret variables in Terraform HCL that will be used as inputs to the stack as a .tfvars file.

URI

tmod:@turbot/aws-backup#/policy/types/backupStackSecretVariables

Category

Parent

Targets

Schema

{
  "type": "string",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > Backup > Stack > Source

The Terraform HCL source used to configure this stack.

URI

tmod:@turbot/aws-backup#/policy/types/backupStackSource

Category

Parent

Targets

Schema

{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > Backup > Stack > Terraform Version

The Version of Terraform to use for this stack. Specify an npm-style semver string to determine which version of the Terraform container Turbot will use to run this stack.

URI

tmod:@turbot/aws-backup#/policy/types/backupStackTerraformVersion

Category

Parent

Targets

Default Template Input

"{\n  terraformVersion: policy(uri:\"tmod:@turbot/turbot#/policy/types/stackTerraformVersion\")\n}\n"

Default Template

"{% if $.terraformVersion %}&quot;{{$.terraformVersion}}&quot;{% else %}&quot;&quot;{% endif %}"

Schema

{
  "type": "string"
}

AWS > Backup > Stack > Variables

Terraform variables in Terraform HCL that will be used as inputs to the stack as a .tfvars file.

URI

tmod:@turbot/aws-backup#/policy/types/backupStackVariables

Category

Parent

Targets

Schema

{
  "type": "string",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > Backup > Tags Template [Default]

A template used to generate the keys and values for AWS Backup resources.

By default, all Backup resource Tags > Template policies will use this value.

URI

tmod:@turbot/aws-backup#/policy/types/backupTagsTemplate

Category

Parent

Targets

Default Template Input

"{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws#/policy/types/defaultTagsTemplate\") {\n    value\n  }\n}\n"

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > Turbot > Event Handlers > Events > Rules > Event Sources > @turbot/aws-backup

AWS Backup CloudWatch Events event sources for the Turbot Event Handlers.

URI

tmod:@turbot/aws-backup#/policy/types/backupEventSources

Category

AWS > Turbot > Event Handlers > Events > Rules > Event Sources

Parent

Targets

Schema

{
  "type": "array",
  "items": {
    "type": "string"
  },
  "default": [
    "aws.backup"
  ]
}

AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-backup

A read-only policy generated by Turbot that lists the APIs that should be added to the turbot-managed (hard) boundary policy, thereby enabling them to be assigned to users and roles. This value will change depending on the value of the value of the AWS > Backup > Permissions > Lockdown > API Boundary policy

URI

tmod:@turbot/aws-backup#/policy/types/awsCompiledApiBoundary

Category

AWS > Turbot > Permissions > Compiled > API Boundary

Parent

Targets

Schema

{
  "type": "array"
}

AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-backup

A calculated policy that Turbot uses to create a compiled list of ALL permissions for AWS Backup that is used as input to the stack that manages the Turbot IAM permissions objects.

URI

tmod:@turbot/aws-backup#/policy/types/awsLevelsCompiled

Category

AWS > Turbot > Permissions > Compiled > Levels

Parent

Targets

aws-iam#/definitions/awsLevelDefinitionList

Schema

AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-backup

A calculated policy that Turbot uses to create a compiled list of ALL permissions for AWS Backup that is used as input to the control that manages the IAM stack.

URI

tmod:@turbot/aws-backup#/policy/types/awsCompiledServicePermissions

Category

AWS > Turbot > Permissions > Compiled > Service Permissions

Parent

Targets