Policy types for @turbot/aws-elasticache

Parent

Targets

Valid Value

[
  "Enabled",
  "Disabled",
  "Enabled if AWS > ElastiCache > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled",
    "Enabled if AWS > ElastiCache > Enabled"
  ],
  "default": "Enabled"
}

AWS > ElastiCache > Approved Regions [Default]

A list of AWS regions in which AWS ElastiCache resources are approved for use.

The expected format is an array of regions names. You may use the '*' and
'?' wildcard characters.

This policy is the default value for all AWS ElastiCache resources' Approved > Regions policies.

URI

tmod:@turbot/aws-elasticache#/policy/types/elastiCacheApprovedRegionsDefault

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws#/policy/types/approvedRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;&#92;n{% endfor %}"

Schema

AWS > ElastiCache > Cache Cluster > Active

Determine the action to take when an AWS ElastiCache cache cluster, based on the AWS > ElastiCache > Cache Cluster > Active > * policies.

The control determines whether the resource is in active use, and if not,
has the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > ElastiCache > Cache Cluster > Active > *), raises an alarm, and takes the defined enforcement
action. Each Active sub-policy can calculate a status of active, inactive
or skipped. Generally, if the resource appears to be Active for any reason
it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered
Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Cluster > Active > Age

The age after which the AWS ElastiCache cache cluster
is no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > ElastiCache > Cache Cluster > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterActiveAge

Category

AWS > ElastiCache > Cache Cluster > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Cluster > Active > Budget

The impact of the budget state on the active control. This policy allows you to force
cacheClusters to inactive based on the current budget state, as reflected in
AWS > Account > Budget > State

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > ElastiCache > Cache Cluster > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterActiveBudget

Category

AWS > ElastiCache > Cache Cluster > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if Budget > State is Over or higher",
  "Force inactive if Budget > State is Critical or higher",
  "Force inactive if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if Budget > State is Over or higher",
    "Force inactive if Budget > State is Critical or higher",
    "Force inactive if Budget > State is Shutdown"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Cluster > Active > Last Modified

The number of days since the AWS ElastiCache cache cluster
was last modified before it is considered inactive.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > ElastiCache > Cache Cluster > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterActiveLastModified

Category

AWS > ElastiCache > Cache Cluster > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Cluster > Approved

Determine the action to take when an AWS ElastiCache cache cluster is not approved based on AWS > ElastiCache > Cache Cluster > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Cluster > Approved > Budget

The policy allows you to set cache clusters to unapproved based on the current budget state, as reflected in AWS > Account > Budget > State

This policy will be evaluated by the Approved control. If an AWS ElastiCache cache cluster is not matched by the approved list, it will be subject to the action specified in the AWS > ElastiCache > Cache Cluster > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterApprovedBudget

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Unapproved if Budget > State is Over or higher",
  "Unapproved if Budget > State is Critical or higher",
  "Unapproved if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Unapproved if Budget > State is Over or higher",
    "Unapproved if Budget > State is Critical or higher",
    "Unapproved if Budget > State is Shutdown"
  ],
  "example": [
    "Unapproved if Budget > State is Shutdown"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Cluster > Approved > Custom

Determine whether the AWS ElastiCache cache cluster is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS ElastiCache cache cluster is not approved, it will be subject to the action specified in the AWS > ElastiCache > Cache Cluster > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterApprovedCustom

Category

Parent

Targets

Schema

{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Cluster > Approved > Engines

A list of engines that the AWS ElastiCache cache cluster is approved to use.

The expected format is an array of engines. You may use the * and ? wildcard characters (and more).

This policy will be evaluated by the Approved control. If an AWS ElastiCache cache cluster is not matched by the approved list, it will be subject to the action specified in the AWS > ElastiCache > Cache Cluster > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterApprovedEngines

Category

Parent

Targets

Schema

{
  "type": "array",
  "default": [
    "*"
  ],
  "items": {
    "type": "string",
    "pattern": "^[a-z0-9.?*]+$"
  }
}

AWS > ElastiCache > Cache Cluster > Approved > Regions

A list of AWS regions in which AWS ElastiCache cache clusters are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS ElastiCache cache cluster is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > ElastiCache > Cache Cluster > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterApprovedRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-elasticache#/policy/types/elastiCacheApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;&#92;n{% endfor %}"

Schema

AWS > ElastiCache > Cache Cluster > Approved > Usage

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterApprovedUsage

Category

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > ElastiCache > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > ElastiCache > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > ElastiCache > Enabled"
}

AWS > ElastiCache > Cache Cluster > CMDB

Configure whether to record and synchronize details for the AWS ElastiCache cache cluster into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > ElastiCache > Cache Cluster > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > ElastiCache > Cache Cluster > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterConfigured

Category

Parent

Targets

Valid Value

[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]

Schema

{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > ElastiCache > Cache Cluster > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterConfiguredPrecedence

Category

AWS > ElastiCache > Cache Cluster > Configured

Parent

Targets

Default Template Input

"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"

Default Template

"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"

Schema

{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > ElastiCache > Cache Cluster > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterConfiguredSource

Category

AWS > ElastiCache > Cache Cluster > Configured

Parent

Targets

Schema

{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > ElastiCache > Cache Cluster > Regions

A list of AWS regions in which AWS ElastiCache cache clusters are supported for use.

Any cache clusters in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and
'?' wildcard characters.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-elasticache#/policy/types/elastiCacheRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;&#92;n{% endfor %}"

Schema

AWS > ElastiCache > Cache Cluster > Tags

Determine the action to take when an AWS ElastiCache cache cluster tags are not updated based on the AWS > ElastiCache > Cache Cluster > Tags > * policies.

The control ensure AWS ElastiCache cache cluster tags include tags defined in AWS > ElastiCache > Cache Cluster > Tags > Template.

Tags not defined in Cache Cluster Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterTags

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Cluster > Tags > Template

The template is used to generate the keys and values for AWS ElastiCache cache cluster.

Tags not defined in Cache Cluster Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterTagsTemplate

Category

AWS > ElastiCache > Cache Cluster > Tags

Parent

Targets

aws#/definitions/tagsTemplateInput

Default Template Input

[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-elasticache#/policy/types/elastiCacheTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > ElastiCache > Cache Cluster > Usage

Configure the number of AWS ElastiCache cache clusters that can be used for this region and the current consumption against the limit.

You can configure the behavior of the control with this AWS > ElastiCache > Cache Cluster > Usage policy.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Cluster > Usage > Limit

Maximum number of items that can be created for this region.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheClusterUsageLimit

Category

AWS > ElastiCache > Cache Cluster > Usage

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 90
}

AWS > ElastiCache > Cache Parameter Group > Active

Determine the action to take when an AWS ElastiCache cache parameter group, based on the AWS > ElastiCache > Cache Parameter Group > Active > * policies.

The control determines whether the resource is in active use, and if not,
has the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > ElastiCache > Cache Parameter Group > Active > *), raises an alarm, and takes the defined enforcement
action. Each Active sub-policy can calculate a status of active, inactive
or skipped. Generally, if the resource appears to be Active for any reason
it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered
Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheParameterGroupActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Parameter Group > Active > Age

The age after which the AWS ElastiCache cache parameter group
is no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > ElastiCache > Cache Parameter Group > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheParameterGroupActiveAge

Category

AWS > ElastiCache > Cache Parameter Group > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Parameter Group > Active > Last Modified

The number of days since the AWS ElastiCache cache parameter group
was last modified before it is considered inactive.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > ElastiCache > Cache Parameter Group > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheParameterGroupActiveLastModified

Category

AWS > ElastiCache > Cache Parameter Group > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Parameter Group > Approved

Determine the action to take when an AWS ElastiCache cache parameter group is not approved based on AWS > ElastiCache > Cache Parameter Group > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheParameterGroupApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Parameter Group > Approved > Custom

Determine whether the AWS ElastiCache cache parameter group is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS ElastiCache cache parameter group is not approved, it will be subject to the action specified in the AWS > ElastiCache > Cache Parameter Group > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheParameterGroupApprovedCustom

Category

AWS > ElastiCache > Cache Parameter Group > Approved

Parent

Targets

Schema

{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Parameter Group > Approved > Regions

A list of AWS regions in which AWS ElastiCache cache parameter groups are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS ElastiCache cache parameter group is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > ElastiCache > Cache Parameter Group > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheParameterGroupApprovedRegions

Category

AWS > ElastiCache > Cache Parameter Group > Approved

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-elasticache#/policy/types/elastiCacheApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;&#92;n{% endfor %}"

Schema

AWS > ElastiCache > Cache Parameter Group > Approved > Usage

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheParameterGroupApprovedUsage

Category

AWS > ElastiCache > Cache Parameter Group > Approved

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > ElastiCache > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > ElastiCache > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > ElastiCache > Enabled"
}

AWS > ElastiCache > Cache Parameter Group > CMDB

Configure whether to record and synchronize details for the AWS ElastiCache cache parameter group into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > ElastiCache > Cache Parameter Group > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheParameterGroupCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > ElastiCache > Cache Parameter Group > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheParameterGroupConfigured

Category

Parent

Targets

Valid Value

[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]

Schema

{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > ElastiCache > Cache Parameter Group > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheParameterGroupConfiguredPrecedence

Category

AWS > ElastiCache > Cache Parameter Group > Configured

Parent

Targets

Default Template Input

"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"

Default Template

"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"

Schema

{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > ElastiCache > Cache Parameter Group > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheParameterGroupConfiguredSource

Category

AWS > ElastiCache > Cache Parameter Group > Configured

Parent

Targets

Schema

{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > ElastiCache > Cache Parameter Group > Regions

A list of AWS regions in which AWS ElastiCache cache parameter groups are supported for use.

Any cache parameter groups in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and
'?' wildcard characters.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheParameterGroupRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-elasticache#/policy/types/elastiCacheRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;&#92;n{% endfor %}"

Schema

AWS > ElastiCache > Cache Parameter Group > Usage

Configure the number of AWS ElastiCache cache parameter groups that can be used for this region and the current consumption against the limit.

You can configure the behavior of the control with this AWS > ElastiCache > Cache Parameter Group > Usage policy.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheParameterGroupUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Cache Parameter Group > Usage > Limit

Maximum number of items that can be created for this region.

URI

tmod:@turbot/aws-elasticache#/policy/types/cacheParameterGroupUsageLimit

Category

AWS > ElastiCache > Cache Parameter Group > Usage

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 150
}

AWS > ElastiCache > Enabled

Configure whether the AWS ElastiCache service is enabled.
This will only affect Guardrails managed User Roles and will allow the Guardrails managed user to access AWS ElastiCache service.
- Enabled policy allows Guardrails managed users to perform all the actions for the service
- Enabled: Metadata Only policy allows Guardrails managed users to perform only the metadata level actions for the service (like describe*, list*)

Note:
- Disabled policy disables the service but does NOT disable the API for Guardrails or SuperUsers
- All the resource data stored in the Guardrails CMDB is considered to be metadata
- For more information related to permissions and grant levels, please check the documentation

URI

tmod:@turbot/aws-elasticache#/policy/types/elastiCacheEnabled

Category

Parent

Targets

Valid Value

[
  "Enabled",
  "Enabled: Metadata Only",
  "Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled",
    "Enabled: Metadata Only",
    "Disabled"
  ],
  "example": [
    "Enabled"
  ],
  "default": "Disabled"
}

AWS > ElastiCache > Permissions

Configure whether permissions policies are in effect for AWS ElastiCache.

This setting does not affect account level permissions (AWS/Admin, AWS/Owner, etc)

Note: The behavior of this policy depends on the value of AWS > Permissions.

URI

tmod:@turbot/aws-elasticache#/policy/types/elastiCachePermissions

Category

Parent

Targets

Valid Value

[
  "Enabled",
  "Disabled",
  "Enabled if AWS > ElastiCache > Enabled & AWS > ElastiCache > API Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled",
    "Enabled if AWS > ElastiCache > Enabled & AWS > ElastiCache > API Enabled"
  ],
  "example": [
    "Enabled"
  ],
  "default": "Enabled if AWS > ElastiCache > Enabled & AWS > ElastiCache > API Enabled"
}

AWS > ElastiCache > Permissions > Levels

Define the permissions levels that can be used to grant access to an AWS account.
Permissions levels defined will appear in the UI to assign access to Guardrails users.
This policy provides a default for Permissions > Levels in each service,
however you can explicitly override the setting for each service if desired

URI

tmod:@turbot/aws-elasticache#/policy/types/elastiCachePermissionsLevels

Category

AWS > ElastiCache > Permissions

Parent

Targets

Default Template Input

[
  "{\n  item: account {\n    turbot{\n      id\n    }\n  }\n}\n",
  "{\n  availableLevels: policyValues(filter:\"policyTypeLevel:self resourceId:{{ $.item.turbot.id }} policyTypeId:'tmod:@turbot/aws-iam#/policy/types/permissionsLevelsDefault'\") {\n    items {\n      value\n    }\n  }\n}\n"
]

Default Template

"{% if $.availableLevels.items[0].value | length == 0 %} [] {% endif %}{% for item in $.availableLevels.items[0].value %}- {{ item }}&#92;n{% endfor %}"

Schema

{
  "type": "array",
  "items": {
    "type": "string",
    "enum": [
      "Metadata",
      "ReadOnly",
      "Operator",
      "Admin",
      "Owner"
    ]
  }
}

AWS > ElastiCache > Permissions > Levels > Modifiers

A map of AWS API to Guardrails Permission Level used to customize Guardrails' standard permissions.
You can add, remove or redefine the mapping of AWS API operations to Guardrails permissions levels here.

Note: Modifiers are cumulative - if you add a permission to the Metadata level, it is also added to ReadOnly, Operator and Admin.
Modifier policies set here apply ONLY to the AWS level

 example: - "glacier:createvault": admin - "glacier:ListVaults": metadata - "s3:DeleteBucket": none 

URI

tmod:@turbot/aws-elasticache#/policy/types/elastiCachePermissionsLevelsModifiers

Category

AWS > ElastiCache > Permissions > Levels

Parent

Targets

aws-iam#/definitions/awsModifierList

Schema

AWS > ElastiCache > Permissions > Lockdown

URI

tmod:@turbot/aws-elasticache#/policy/types/elastiCachePermissionsLockdown

Category

AWS > ElastiCache > Permissions

Parent

Targets

AWS > ElastiCache > Permissions > Lockdown > API Boundary

Configure whether the AWS elastiCache API is enabled for all users and roles in guardrails-managed boundary policies.

Note: Disabling the service disables the API for ALL users and roles, and Guardrails will have no access to the API.

URI

tmod:@turbot/aws-elasticache#/policy/types/elastiCachePermissionsLockdownApiBoundary

Category

AWS > ElastiCache > Permissions > Lockdown

Parent

Targets

Valid Value

[
  "Enabled if AWS > ElastiCache > API Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled if AWS > ElastiCache > API Enabled"
  ],
  "example": [
    "Enabled if AWS > ElastiCache > API Enabled"
  ],
  "default": "Enabled if AWS > ElastiCache > API Enabled"
}

AWS > ElastiCache > Regions

A list of AWS regions in which AWS ElastiCache resources are supported for use.

The expected format is an array of regions names. You may use the '*' and
'?' wildcard characters.

This policy is the default value for all AWS ElastiCache resources' Regions policies.

URI

tmod:@turbot/aws-elasticache#/policy/types/elastiCacheRegionsDefault

Category

Parent

Targets

Schema

{
  "allOf": [
    {
      "$ref": "aws#/definitions/regionNameMatcherList"
    },
    {
      "default": [
        "af-south-1",
        "ap-east-1",
        "ap-northeast-1",
        "ap-northeast-2",
        "ap-northeast-3",
        "ap-south-1",
        "ap-southeast-1",
        "ap-southeast-2",
        "ca-central-1",
        "cn-north-1",
        "cn-northwest-1",
        "eu-central-1",
        "eu-north-1",
        "eu-west-1",
        "eu-west-2",
        "eu-west-3",
        "me-south-1",
        "sa-east-1",
        "us-east-1",
        "us-east-2",
        "us-gov-east-1",
        "us-gov-west-1",
        "us-west-1",
        "us-west-2"
      ]
    }
  ]
}

AWS > ElastiCache > Replication Group > Active

Determine the action to take when an AWS ElastiCache replication group, based on the AWS > ElastiCache > Replication Group > Active > * policies.

The control determines whether the resource is in active use, and if not,
has the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > ElastiCache > Replication Group > Active > *), raises an alarm, and takes the defined enforcement
action. Each Active sub-policy can calculate a status of active, inactive
or skipped. Generally, if the resource appears to be Active for any reason
it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered
Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Replication Group > Active > Age

The age after which the AWS ElastiCache replication group
is no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > ElastiCache > Replication Group > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupActiveAge

Category

AWS > ElastiCache > Replication Group > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Replication Group > Active > Last Modified

The number of days since the AWS ElastiCache replication group
was last modified before it is considered inactive.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > ElastiCache > Replication Group > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupActiveLastModified

Category

AWS > ElastiCache > Replication Group > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Replication Group > Approved

Determine the action to take when an AWS ElastiCache replication group is not approved based on AWS > ElastiCache > Replication Group > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Replication Group > Approved > Custom

Determine whether the AWS ElastiCache replication group is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS ElastiCache replication group is not approved, it will be subject to the action specified in the AWS > ElastiCache > Replication Group > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupApprovedCustom

Category

AWS > ElastiCache > Replication Group > Approved

Parent

Targets

Schema

{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > ElastiCache > Replication Group > Approved > Regions

A list of AWS regions in which AWS ElastiCache replication groups are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS ElastiCache replication group is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > ElastiCache > Replication Group > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupApprovedRegions

Category

AWS > ElastiCache > Replication Group > Approved

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-elasticache#/policy/types/elastiCacheApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;&#92;n{% endfor %}"

Schema

AWS > ElastiCache > Replication Group > Approved > Usage

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupApprovedUsage

Category

AWS > ElastiCache > Replication Group > Approved

Parent

Targets

Resource > Data Protection

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > ElastiCache > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > ElastiCache > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > ElastiCache > Enabled"
}

AWS > ElastiCache > Replication Group > Backup

Configure backup settings on an AWS > ElastiCache > Replication Group.

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupBackup

Category

Parent

Targets

Resource > Data Protection

Valid Value

[
  "Skip",
  "Check: Backup Disabled",
  "Check: Backup Enabled",
  "Enforce: Backup Disabled",
  "Enforce: Backup Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Backup Disabled",
    "Check: Backup Enabled",
    "Enforce: Backup Disabled",
    "Enforce: Backup Enabled"
  ],
  "example": [
    "Check: Backup Enabled"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Replication Group > Backup > Retention Period

The number of days for which automated backups are retained before they are automatically deleted.

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupBackupRetentionPeriod

Category

Parent

AWS > ElastiCache > Replication Group > Backup

Targets

Resource > Data Protection

Schema

{
  "type": "integer",
  "minimum": 1,
  "maximum": 35,
  "default": 7
}

AWS > ElastiCache > Replication Group > Backup > Window

The daily start time and duration during which automated backups are initiated.

Note - This is a 24h UTC time format (hh:mm).

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupBackupWindow

Category

Parent

AWS > ElastiCache > Replication Group > Backup

Targets

Schema

{
  "type": "string",
  "default": "00:00-01:00",
  "example": "00:00-15:00"
}

AWS > ElastiCache > Replication Group > CMDB

Configure whether to record and synchronize details for the AWS ElastiCache replication group into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > ElastiCache > Replication Group > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > ElastiCache > Replication Group > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it.

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupConfigured

Category

Parent

Targets

Valid Value

[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]

Schema

{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > ElastiCache > Replication Group > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupConfiguredPrecedence

Category

AWS > ElastiCache > Replication Group > Configured

Parent

Targets

Default Template Input

"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"

Default Template

"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"

Schema

{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > ElastiCache > Replication Group > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource.

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupConfiguredSource

Category

AWS > ElastiCache > Replication Group > Configured

Parent

Targets

Schema

{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > ElastiCache > Replication Group > Regions

A list of AWS regions in which AWS ElastiCache replication groups are supported for use.

Any replication groups in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and
'?' wildcard characters.

URI

tmod:@turbot/aws-elasticache#/policy/types/replicationGroupRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-elasticache#/policy/types/elastiCacheRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;&#92;n{% endfor %}"

Schema

AWS > ElastiCache > Snapshot > Active

Determine the action to take when an AWS ElastiCache snapshot, based on the AWS > ElastiCache > Snapshot > Active > * policies.

The control determines whether the resource is in active use, and if not,
has the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > ElastiCache > Snapshot > Active > *), raises an alarm, and takes the defined enforcement
action. Each Active sub-policy can calculate a status of active, inactive
or skipped. Generally, if the resource appears to be Active for any reason
it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered
Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/snapshotActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Snapshot > Active > Age

The age after which the AWS ElastiCache snapshot
is no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > ElastiCache > Snapshot > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/snapshotActiveAge

Category

AWS > ElastiCache > Snapshot > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Snapshot > Active > Last Modified

The number of days since the AWS ElastiCache snapshot
was last modified before it is considered inactive.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > ElastiCache > Snapshot > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/snapshotActiveLastModified

Category

AWS > ElastiCache > Snapshot > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Snapshot > Approved

Determine the action to take when an AWS ElastiCache snapshot is not approved based on AWS > ElastiCache > Snapshot > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/snapshotApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Snapshot > Approved > Custom

Determine whether the AWS ElastiCache snapshot is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS ElastiCache snapshot is not approved, it will be subject to the action specified in the AWS > ElastiCache > Snapshot > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI

tmod:@turbot/aws-elasticache#/policy/types/snapshotApprovedCustom

Category

AWS > ElastiCache > Snapshot > Approved

Parent

Targets

Schema

{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > ElastiCache > Snapshot > Approved > Regions

A list of AWS regions in which AWS ElastiCache snapshots are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS ElastiCache snapshot is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > ElastiCache > Snapshot > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/snapshotApprovedRegions

Category

AWS > ElastiCache > Snapshot > Approved

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-elasticache#/policy/types/elastiCacheApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;&#92;n{% endfor %}"

Schema

AWS > ElastiCache > Snapshot > Approved > Usage

URI

tmod:@turbot/aws-elasticache#/policy/types/snapshotApprovedUsage

Category

AWS > ElastiCache > Snapshot > Approved

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > ElastiCache > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > ElastiCache > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > ElastiCache > Enabled"
}

AWS > ElastiCache > Snapshot > CMDB

Configure whether to record and synchronize details for the AWS ElastiCache snapshot into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > ElastiCache > Snapshot > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-elasticache#/policy/types/snapshotCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > ElastiCache > Snapshot > Regions

A list of AWS regions in which AWS ElastiCache snapshots are supported for use.

Any snapshots in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and
'?' wildcard characters.

URI

tmod:@turbot/aws-elasticache#/policy/types/snapshotRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-elasticache#/policy/types/elastiCacheRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;&#92;n{% endfor %}"

Schema

AWS > ElastiCache > Snapshot > Tags

Determine the action to take when an AWS ElastiCache snapshot tags are not updated based on the AWS > ElastiCache > Snapshot > Tags > * policies.

The control ensure AWS ElastiCache snapshot tags include tags defined in AWS > ElastiCache > Snapshot > Tags > Template.

Tags not defined in Snapshot Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/snapshotTags

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Snapshot > Tags > Template

The template is used to generate the keys and values for AWS ElastiCache snapshot.

Tags not defined in Snapshot Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-elasticache#/policy/types/snapshotTagsTemplate

Category

AWS > ElastiCache > Snapshot > Tags

Parent

Targets

aws#/definitions/tagsTemplateInput

Default Template Input

[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-elasticache#/policy/types/elastiCacheTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > ElastiCache > Snapshot > Usage

Configure the number of AWS ElastiCache snapshots that can be used for this region and the current consumption against the limit.

You can configure the behavior of the control with this AWS > ElastiCache > Snapshot > Usage policy.

URI

tmod:@turbot/aws-elasticache#/policy/types/snapshotUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > ElastiCache > Snapshot > Usage > Limit

Maximum number of items that can be created for this region.

URI

tmod:@turbot/aws-elasticache#/policy/types/snapshotUsageLimit

Category

AWS > ElastiCache > Snapshot > Usage

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 90
}

AWS > ElastiCache > Tags Template [Default]

A template used to generate the keys and values for AWS ElastiCache resources.

By default, all ElastiCache resource Tags > Template policies will use this value.

URI

tmod:@turbot/aws-elasticache#/policy/types/elastiCacheTagsTemplate

Category

Parent

Targets

aws#/definitions/tagsTemplateInput

Default Template Input

"{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws#/policy/types/defaultTagsTemplate\") {\n    value\n  }\n}\n"

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > Turbot > Event Handlers > Events > Rules > Event Sources > @turbot/aws-elasticache

AWS ElastiCache CloudWatch Events event sources for the Turbot Event Handlers.

URI

tmod:@turbot/aws-elasticache#/policy/types/elastiCacheEventSources

Category

AWS > Turbot > Event Handlers > Events > Rules > Event Sources

Parent

Targets

Schema

{
  "type": "array",
  "items": {
    "type": "string"
  },
  "default": [
    "aws.elasticache"
  ]
}

AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-elasticache

A read-only policy generated by Guardrails that lists the APIs that
should be added to the guardrails-managed (hard) boundary policy,
thereby enabling them to be assigned to users and roles.
This value will change depending on the value of the value of the
AWS > ElastiCache > Permissions > Lockdown > API Boundary policy

URI

tmod:@turbot/aws-elasticache#/policy/types/awsCompiledApiBoundary

Category

AWS > Turbot > Permissions > Compiled > API Boundary

Parent

Targets

Schema

{
  "type": "array"
}

AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-elasticache

A calculated policy that Guardrails uses to create a compiled list of ALL permissions for AWS ElastiCache
that is used as input to the stack that manages the Guardrails IAM permissions objects.

URI

tmod:@turbot/aws-elasticache#/policy/types/awsLevelsCompiled

Category

AWS > Turbot > Permissions > Compiled > Levels

Parent

Targets

aws-iam#/definitions/awsLevelDefinitionList

Schema

AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-elasticache

A calculated policy that Guardrails uses to create a compiled list of ALL permissions for AWS ElastiCache
that is used as input to the control that manages the IAM stack.

URI

tmod:@turbot/aws-elasticache#/policy/types/awsCompiledServicePermissions

Category

AWS > Turbot > Permissions > Compiled > Service Permissions

Parent

Targets