Control types for @turbot/aws-ec2

Category

Targets

AWS > EC2 > AMI > Approved

Take an action when an AWS EC2 ami is not approved based on AWS > EC2 > AMI > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-ec2#/control/types/amiApproved

Parent

Category

Targets

AWS > EC2 > AMI > CMDB

Record and synchronize details for the AWS EC2 ami into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > EC2 > AMI > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI

tmod:@turbot/aws-ec2#/control/types/amiCmdb

Parent

Category

Targets

AWS > EC2 > AMI > Configured

Maintain AWS > EC2 > AMI configuration

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI

tmod:@turbot/aws-ec2#/control/types/amiConfigured

Parent

Category

Targets

AWS > EC2 > AMI > Discovery

Discover all AWS EC2 ami resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > EC2 > AMI > Regions policy, the CMDB control will delete the resource from the CMDB.

URI

tmod:@turbot/aws-ec2#/control/types/amiDiscovery

Parent

Category

Targets

AWS > EC2 > AMI > Tags

Take an action when an AWS EC2 ami tags is not updated based on the AWS > EC2 > AMI > Tags > * policies.

If the resource is not updated with the tags defined in AWS > EC2 > AMI > Tags > Template, this control raises an alarm and takes the defined enforcement action.

See Tags for more information.

URI

tmod:@turbot/aws-ec2#/control/types/amiTags

Parent

Category

Targets

AWS > EC2 > AMI > Trusted Access

Manage trusted access for AWS EC2 AMIs.

AWS allows EC2 AMIs to be shared with specific AWS accounts.
This control allows you to configure whether such sharing is allowed, and to which accounts.

If set to Enforce, access to non-trusted accounts will be removed.

URI

tmod:@turbot/aws-ec2#/control/types/amiTrustedAccess

Parent

Security > Trusted Access

Category

Targets

AWS > EC2 > AMI > Usage

The Usage control determines whether the number of AWS EC2 ami resources exceeds the configured usage limit for this region.

You can configure the behavior of this control with the AWS > EC2 > AMI > Usage policy, and set the limit with the AWS > EC2 > AMI > Usage > Limit policy.

URI

tmod:@turbot/aws-ec2#/control/types/amiUsage

Parent

Category

Targets

AWS > EC2 > Account Attributes > Block Public Access for AMIs

Configure Block Public Access settings for Amazon Machine Images (AMIs) on AWS > EC2 > Account Attributes.

URI

tmod:@turbot/aws-ec2#/control/types/ec2AccountAttributesBlockPublicImageAccess

Parent

Category

Security

Targets

AWS > EC2 > Account Attributes > Block Public Access for Snapshots

Configure Block Public Access settings for Snapshots on AWS > EC2 > Account Attributes.

URI

tmod:@turbot/aws-ec2#/control/types/ec2AccountAttributesBlockPublicAccessForSnapshot

Parent

Category

Security

Targets

AWS > EC2 > Account Attributes > CMDB

Record and synchronize details for the AWS EC2 account attributes into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > EC2 > Account Attributes > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI

tmod:@turbot/aws-ec2#/control/types/ec2AccountAttributesCmdb

Parent

Category

Targets

AWS > EC2 > Account Attributes > Discovery

Discover all AWS EC2 account attributes resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > EC2 > Account Attributes > Regions policy, the CMDB control will delete the resource from the CMDB.

URI

tmod:@turbot/aws-ec2#/control/types/ec2AccountAttributesDiscovery

Parent

Category

Targets

AWS > EC2 > Account Attributes > EBS Encryption by Default

Define the EBS Encryption by Default settings required for AWS > EC2 > Account Attributes.

Encryption at Rest refers specifically to the encryption of data when written
to an underlying storage system. This control determines whether the resource
is encrypted at rest, and sets encryption to your desired level.

The EBS Encryption by Default control compares the encryption settings against the encryption policies for the resource
(AWS > EC2 > Account Attributes > EBS Encryption by Default > *),
raises an alarm, and takes the defined enforcement action.

URI

tmod:@turbot/aws-ec2#/control/types/ec2AccountAttributesEbsEncryptionByDefault

Parent

Category

Other

Targets

AWS > EC2 > Account Attributes > Instance Metadata Service Defaults

Instance metadata is data about your instance that you can use to configure or manage the running instance.
Instance metadata is divided into categories, for example, host name, events, and security groups.

Instance metadata can be accessed from a running instance using one of the following methods:

Instance Metadata Service Version 1 (IMDSv1) – a request/response method

Instance Metadata Service Version 2 (IMDSv2) – a session-oriented method

By default, you can use either IMDSv1 or IMDSv2, or both. However, the instance metadata service can be specifically
configured to use IMDSv2 on each instance. When you specify that IMDSv2 must be used, IMDSv1 no longer works.

URI

tmod:@turbot/aws-ec2#/control/types/ec2AccountAttributesInstanceMetadataServiceDefaults

Parent

Resource > Data Protection

Category

Targets

AWS > EC2 > Application Load Balancer > Access Logging

Define the Access Logging settings required for AWS > EC2 > Application Load Balancer.

AWS > EC2 > Application Load Balancer provides access logs that capture
detailed information about requests sent to your load
balancer. Each log contains information such as the time the
request was received, the client's IP address, latencies,
request paths, and server responses. You can use these
access logs to analyze traffic patterns and troubleshoot
issues.

URI

tmod:@turbot/aws-ec2#/control/types/applicationLoadBalancerAccessLogging

Parent

Category

Resource > Logging

Targets

AWS > EC2 > Application Load Balancer > Active

Take an action when an AWS EC2 application load balancer is not active based on the
AWS > EC2 > Application Load Balancer > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > EC2 > Application Load Balancer > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-ec2#/control/types/applicationLoadBalancerActive

Parent

Category

Targets

AWS > EC2 > Application Load Balancer > Approved

Take an action when an AWS EC2 application load balancer is not approved based on AWS > EC2 > Application Load Balancer > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-ec2#/control/types/applicationLoadBalancerApproved

Parent

Category

Targets

AWS > EC2 > Application Load Balancer > CMDB

Record and synchronize details for the AWS EC2 application load balancer into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > EC2 > Application Load Balancer > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI

tmod:@turbot/aws-ec2#/control/types/applicationLoadBalancerCmdb

Parent

Category

Targets

AWS > EC2 > Application Load Balancer > Configured

Maintain AWS > EC2 > Application Load Balancer configuration

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI

tmod:@turbot/aws-ec2#/control/types/applicationLoadBalancerConfigured

Parent

Category

Targets

AWS > EC2 > Application Load Balancer > Discovery

Discover all AWS EC2 application load balancer resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > EC2 > Application Load Balancer > Regions policy, the CMDB control will delete the resource from the CMDB.

URI

tmod:@turbot/aws-ec2#/control/types/applicationLoadBalancerDiscovery

Parent

Category

Targets

AWS > EC2 > Application Load Balancer > Tags

Take an action when an AWS EC2 application load balancer tags is not updated based on the AWS > EC2 > Application Load Balancer > Tags > * policies.

If the resource is not updated with the tags defined in AWS > EC2 > Application Load Balancer > Tags > Template, this control raises an alarm and takes the defined enforcement action.

See Tags for more information.

URI

tmod:@turbot/aws-ec2#/control/types/applicationLoadBalancerTags

Parent

Category

Targets

AWS > EC2 > Application Load Balancer > Usage

The Usage control determines whether the number of AWS EC2 application load balancer resources exceeds the configured usage limit for this region.

You can configure the behavior of this control with the AWS > EC2 > Application Load Balancer > Usage policy, and set the limit with the AWS > EC2 > Application Load Balancer > Usage > Limit policy.

URI

tmod:@turbot/aws-ec2#/control/types/applicationLoadBalancerUsage

Parent

Category

Targets

AWS > EC2 > Auto Scaling Group > Active

Take an action when an AWS EC2 auto scaling group is not active based on the
AWS > EC2 > Auto Scaling Group > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > EC2 > Auto Scaling Group > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-ec2#/control/types/autoScalingGroupActive

Parent

Category

Targets

AWS > EC2 > Auto Scaling Group > Approved

Take an action when an AWS EC2 auto scaling group is not approved based on AWS > EC2 > Auto Scaling Group > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-ec2#/control/types/autoScalingGroupApproved

Parent

Category

Targets

AWS > EC2 > Auto Scaling Group > CMDB

Record and synchronize details for the AWS EC2 auto scaling group into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > EC2 > Auto Scaling Group > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI

tmod:@turbot/aws-ec2#/control/types/autoScalingGroupCmdb

Parent

Category

Targets

AWS > EC2 > Auto Scaling Group > Discovery

Discover all AWS EC2 auto scaling group resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > EC2 > Auto Scaling Group > Regions policy, the CMDB control will delete the resource from the CMDB.

URI

tmod:@turbot/aws-ec2#/control/types/autoScalingGroupDiscovery

Parent

Category

Targets

AWS > EC2 > Auto Scaling Group > Tags

Take an action when an AWS EC2 auto scaling group tags is not updated based on the AWS > EC2 > Auto Scaling Group > Tags > * policies.

If the resource is not updated with the tags defined in AWS > EC2 > Auto Scaling Group > Tags > Template, this control raises an alarm and takes the defined enforcement action.

See Tags for more information.

URI

tmod:@turbot/aws-ec2#/control/types/autoScalingGroupTags

Parent

Category

Targets

AWS > EC2 > Auto Scaling Group > Usage

The Usage control determines whether the number of AWS EC2 auto scaling group resources exceeds the configured usage limit for this region.

You can configure the behavior of this control with the AWS > EC2 > Auto Scaling Group > Usage policy, and set the limit with the AWS > EC2 > Auto Scaling Group > Usage > Limit policy.

URI

tmod:@turbot/aws-ec2#/control/types/autoScalingGroupUsage

Parent

Category

Targets

AWS > EC2 > Classic Load Balancer > Access Logging

Define the Access Logging settings required for AWS > EC2 > Classic Load Balancer.

AWS > EC2 > Classic Load Balancer provides access logs that capture
detailed information about requests sent to your load
balancer. Each log contains information such as the time the
request was received, the client's IP address, latencies,
request paths, and server responses. You can use these
access logs to analyze traffic patterns and troubleshoot
issues.

URI

tmod:@turbot/aws-ec2#/control/types/classicLoadBalancerAccessLogging

Parent

Category

Resource > Logging

Targets

AWS > EC2 > Classic Load Balancer > Active

Take an action when an AWS EC2 classic load balancer is not active based on the
AWS > EC2 > Classic Load Balancer > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > EC2 > Classic Load Balancer > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-ec2#/control/types/classicLoadBalancerActive

Parent

Category

Targets

AWS > EC2 > Classic Load Balancer > Approved

Take an action when an AWS EC2 classic load balancer is not approved based on AWS > EC2 > Classic Load Balancer > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-ec2#/control/types/classicLoadBalancerApproved

Parent

Category

Targets

AWS > EC2 > Classic Load Balancer > CMDB

Record and synchronize details for the AWS EC2 classic load balancer into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > EC2 > Classic Load Balancer > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI

tmod:@turbot/aws-ec2#/control/types/classicLoadBalancerCmdb

Parent

Category

Targets

AWS > EC2 > Classic Load Balancer > Configured

Maintain AWS > EC2 > Classic Load Balancer configuration

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI

tmod:@turbot/aws-ec2#/control/types/classicLoadBalancerConfigured

Parent

Category

Targets

AWS > EC2 > Classic Load Balancer > Discovery

Discover all AWS EC2 classic load balancer resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > EC2 > Classic Load Balancer > Regions policy, the CMDB control will delete the resource from the CMDB.

URI

tmod:@turbot/aws-ec2#/control/types/classicLoadBalancerDiscovery

Parent

Category

Targets

AWS > EC2 > Classic Load Balancer > Tags

Take an action when an AWS EC2 classic load balancer tags is not updated based on the AWS > EC2 > Classic Load Balancer > Tags > * policies.

If the resource is not updated with the tags defined in AWS > EC2 > Classic Load Balancer > Tags > Template, this control raises an alarm and takes the defined enforcement action.

See Tags for more information.

URI

tmod:@turbot/aws-ec2#/control/types/classicLoadBalancerTags

Parent

Category

Targets

AWS > EC2 > Classic Load Balancer > Usage

The Usage control determines whether the number of AWS EC2 classic load balancer resources exceeds the configured usage limit for this region.

You can configure the behavior of this control with the AWS > EC2 > Classic Load Balancer > Usage policy, and set the limit with the AWS > EC2 > Classic Load Balancer > Usage > Limit policy.

URI

tmod:@turbot/aws-ec2#/control/types/classicLoadBalancerUsage

Parent

Category

Targets

AWS > EC2 > Classic Load Balancer Listener > Active

Take an action when an AWS EC2 classic load balancer listener is not active based on the
AWS > EC2 > Classic Load Balancer Listener > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > EC2 > Classic Load Balancer Listener > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-ec2#/control/types/classicLoadBalancerListenerActive

Parent

Category

Targets

AWS > EC2 > Classic Load Balancer Listener > Approved

Take an action when an AWS EC2 classic load balancer listener is not approved based on AWS > EC2 > Classic Load Balancer Listener > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-ec2#/control/types/classicLoadBalancerListenerApproved

Parent

Category

Targets

AWS > EC2 > Classic Load Balancer Listener > CMDB

Record and synchronize details for the AWS EC2 classic load balancer listener into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > EC2 > Classic Load Balancer Listener > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI

tmod:@turbot/aws-ec2#/control/types/classicLoadBalancerListenerCmdb

Parent

Category

Targets

AWS > EC2 > Classic Load Balancer Listener > Discovery

Discover all AWS EC2 classic load balancer listener resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > EC2 > Classic Load Balancer Listener > Regions policy, the CMDB control will delete the resource from the CMDB.

URI

tmod:@turbot/aws-ec2#/control/types/classicLoadBalancerListenerDiscovery

Parent

Category

Targets

AWS > EC2 > Classic Load Balancer Listener > SSL Policy

Take an action when an AWS EC2 classic load balancer listener is not using an allowed SSL policy.

If the SSL policy specified in the AWS > EC2 > Classic Load Balancer Listener > SSL Policy > Default policy is not in the AWS > EC2 > Classic Load Balancer Listener > SSL Policy > Allowed policy, the control will move to invalid to prevent a conflict.

URI

tmod:@turbot/aws-ec2#/control/types/classicLoadBalancerListenerSslPolicy

Parent

Category

Other

Targets

AWS > EC2 > Classic Load Balancer Listener > Usage

The Usage control determines whether the number of AWS EC2 classic load balancer listener resources exceeds the configured usage limit for this classicLoadBalancer.

You can configure the behavior of this control with the AWS > EC2 > Classic Load Balancer Listener > Usage policy, and set the limit with the AWS > EC2 > Classic Load Balancer Listener > Usage > Limit policy.

URI

tmod:@turbot/aws-ec2#/control/types/classicLoadBalancerListenerUsage

Parent

Category

Targets

AWS > EC2 > Gateway Load Balancer > Active

Take an action when an AWS EC2 gateway load balancer is not active based on the
AWS > EC2 > Gateway Load Balancer > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > EC2 > Gateway Load Balancer > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-ec2#/control/types/gatewayLoadBalancerActive

Parent

Category

Targets

AWS > EC2 > Gateway Load Balancer > Approved

Take an action when an AWS EC2 gateway load balancer is not approved based on AWS > EC2 > Gateway Load Balancer > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-ec2#/control/types/gatewayLoadBalancerApproved

Parent

Category

Targets

AWS > EC2 > Gateway Load Balancer > CMDB

Record and synchronize details for the AWS EC2 gateway load balancer into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > EC2 > Gateway Load Balancer > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI

tmod:@turbot/aws-ec2#/control/types/gatewayLoadBalancerCmdb

Parent

Category

Targets

AWS > EC2 > Gateway Load Balancer > Discovery

Discover all AWS EC2 gateway load balancer resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > EC2 > Gateway Load Balancer > Regions policy, the CMDB control will delete the resource from the CMDB.

URI

tmod:@turbot/aws-ec2#/control/types/gatewayLoadBalancerDiscovery

Parent

Category

Targets

AWS > EC2 > Gateway Load Balancer > Tags

Take an action when an AWS EC2 gateway load balancer tags is not updated based on the AWS > EC2 > Gateway Load Balancer > Tags > * policies.

If the resource is not updated with the tags defined in AWS > EC2 > Gateway Load Balancer > Tags > Template, this control raises an alarm and takes the defined enforcement action.

See Tags for more information.

URI

tmod:@turbot/aws-ec2#/control/types/gatewayLoadBalancerTags

Parent

Category

Targets

AWS > EC2 > Gateway Load Balancer > Usage

The Usage control determines whether the number of AWS EC2 gateway load balancer resources exceeds the configured usage limit for this region.

You can configure the behavior of this control with the AWS > EC2 > Gateway Load Balancer > Usage policy, and set the limit with the AWS > EC2 > Gateway Load Balancer > Usage > Limit policy.

URI

tmod:@turbot/aws-ec2#/control/types/gatewayLoadBalancerUsage

Parent

Category

Targets

AWS > EC2 > Instance > Active

Take an action when an AWS EC2 instance is not active based on the
AWS > EC2 > Instance > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > EC2 > Instance > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-ec2#/control/types/instanceActive

Parent

Category

Targets

AWS > EC2 > Instance > Approved

Take an action when an AWS EC2 instance is not approved based on AWS > EC2 > Instance > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-ec2#/control/types/instanceApproved

Parent

Category

Targets

AWS > EC2 > Instance > CMDB

Record and synchronize details for the AWS EC2 instance into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > EC2 > Instance > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI

tmod:@turbot/aws-ec2#/control/types/instanceCmdb

Parent

Category

Targets

AWS > EC2 > Instance > Configured

Maintain AWS > EC2 > Instance configuration

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI

tmod:@turbot/aws-ec2#/control/types/instanceConfigured

Parent

Category

Targets

AWS > EC2 > Instance > Detailed Monitoring

Define the Detailed Monitoring settings required for AWS > EC2 > Instance > Detailed Monitoring.

If detailed monitoring is enabled then Amazon EC2 console displays monitoring graphs with a 1-minute period for the instance.

Note: Enabling detailed monitoring will incur additional charges.

URI

tmod:@turbot/aws-ec2#/control/types/instanceDetailedMonitoring

Parent

Category

Resource > Logging

Targets

AWS > EC2 > Instance > Discovery

Discover all AWS EC2 instance resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > EC2 > Instance > Regions policy, the CMDB control will delete the resource from the CMDB.

URI

tmod:@turbot/aws-ec2#/control/types/instanceDiscovery

Parent

Category

Targets

AWS > EC2 > Instance > Instance Profile

Determine whether the IAM instance profile is attached to instance.

URI

tmod:@turbot/aws-ec2#/control/types/instanceInstanceProfile

Parent

Category

Other

Targets

The Usage control determines whether the number of AWS EC2 volume resources exceeds the configured usage limit for this region.

You can configure the behavior of this control with the AWS > EC2 > Volume > Usage policy, and set the limit with the AWS > EC2 > Volume > Usage > Limit policy.

URI

tmod:@turbot/aws-ec2#/control/types/volumeUsage

Parent

AWS > EC2 > Volume

Category

Targets