Policy types for @turbot/aws-glue

Parent

Targets

Valid Value

[
  "Enabled",
  "Disabled",
  "Enabled if AWS > Glue > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled",
    "Enabled if AWS > Glue > Enabled"
  ],
  "default": "Enabled"
}

AWS > Glue > Approved Regions [Default]

A list of AWS regions in which AWS Glue resources are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy is the default value for all AWS Glue resources' Approved > Regions policies.

URI

tmod:@turbot/aws-glue#/policy/types/glueApprovedRegionsDefault

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws#/policy/types/approvedRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Glue > Crawler > Active

Determine the action to take when an AWS Glue crawler, based on the AWS > Glue > Crawler > Active > * policies.

The control determines whether the resource is in active use, and if not, has the ability to delete / cleanup the resource. When running an automated compliance environment, it's common to end up with a wide range of alarms that are difficult and time consuming to clear. The Active control brings automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the resource (AWS > Glue > Crawler > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/crawlerActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Glue > Crawler > Active > Age

The age after which the AWS Glue crawler is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

The Active control determines whether the resource is in active use, and if not, has the ability to delete / cleanup the resource. When running an automated compliance environment, it's common to end up with a wide range of alarms that are difficult and time consuming to clear. The Active control brings automated, well-defined control to this process.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/crawlerActiveAge

Category

AWS > Glue > Crawler > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > Glue > Crawler > Active > Budget

The impact of the budget state on the active control. This policy allows you to force crawlers to inactive based on the current budget state, as reflected in AWS > Account > Budget > State

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/crawlerActiveBudget

Category

AWS > Glue > Crawler > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if Budget > State is Over or higher",
  "Force inactive if Budget > State is Critical or higher",
  "Force inactive if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if Budget > State is Over or higher",
    "Force inactive if Budget > State is Critical or higher",
    "Force inactive if Budget > State is Shutdown"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > Glue > Crawler > Active > Last Modified

The number of days since the AWS Glue crawler was last modified before it is considered inactive.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/crawlerActiveLastModified

Category

AWS > Glue > Crawler > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > Glue > Crawler > Approved

Determine the action to take when an AWS Glue crawler is not approved based on AWS > Glue > Crawler > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/crawlerApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > Glue > Crawler > Approved > Budget

The policy allows you to set crawlers to unapproved based on the current budget state, as reflected in AWS > Account > Budget > State

This policy will be evaluated by the Approved control. If an AWS Glue crawler is not matched by the approved list, it will be subject to the action specified in the AWS > Glue > Crawler > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/crawlerApprovedBudget

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Unapproved if Budget > State is Over or higher",
  "Unapproved if Budget > State is Critical or higher",
  "Unapproved if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Unapproved if Budget > State is Over or higher",
    "Unapproved if Budget > State is Critical or higher",
    "Unapproved if Budget > State is Shutdown"
  ],
  "example": [
    "Unapproved if Budget > State is Shutdown"
  ],
  "default": "Skip"
}

AWS > Glue > Crawler > Approved > Custom

Determine whether the AWS Glue crawler is allowed to exist. This policy will be evaluated by the Approved control. If an AWS Glue crawler is not approved, it will be subject to the action specified in the AWS > Glue > Crawler > Approved policy. See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI

tmod:@turbot/aws-glue#/policy/types/crawlerApprovedCustom

Category

Parent

Targets

Schema

{
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > Glue > Crawler > Approved > Regions

A list of AWS regions in which AWS Glue crawlers are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS Glue crawler is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > Glue > Crawler > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/crawlerApprovedRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-glue#/policy/types/glueApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Glue > Crawler > Approved > Usage

Determine whether the AWS Glue crawler is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS Glue crawler is not approved, it will be subject to the action specified in the AWS > Glue > Crawler > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/crawlerApprovedUsage

Category

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > Glue > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > Glue > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > Glue > Enabled"
}

AWS > Glue > Crawler > CMDB

Configure whether to record and synchronize details for the AWS Glue crawler into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Turbot CMDB. All policies and controls in Turbot are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Glue > Crawler > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-glue#/policy/types/crawlerCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Glue > Crawler > Regions

A list of AWS regions in which AWS Glue crawlers are supported for use.

Any crawlers in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-glue#/policy/types/crawlerRegions

Category

Parent

Targets

Schema

{
  "allOf": [
    {
      "$ref": "aws#/definitions/regionNameMatcherList"
    },
    {
      "default": [
        "af-south-1",
        "ap-east-1",
        "ap-northeast-1",
        "ap-northeast-2",
        "ap-south-1",
        "ap-southeast-1",
        "ap-southeast-2",
        "ca-central-1",
        "cn-north-1",
        "cn-northwest-1",
        "eu-central-1",
        "eu-north-1",
        "eu-west-1",
        "eu-west-2",
        "eu-west-3",
        "me-south-1",
        "sa-east-1",
        "us-east-1",
        "us-east-2",
        "us-gov-east-1",
        "us-gov-west-1",
        "us-west-1",
        "us-west-2"
      ]
    }
  ]
}

AWS > Glue > Crawler > Tags

Determine the action to take when an AWS Glue crawler tags are not updated based on the AWS > Glue > Crawler > Tags > * policies.

The control ensure AWS Glue crawler tags include tags defined in AWS > Glue > Crawler > Tags > Template.

Tags not defined in Crawler Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-glue#/policy/types/crawlerTags

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > Glue > Crawler > Tags > Template

The template is used to generate the keys and values for AWS Glue crawler.

Tags not defined in Crawler Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-glue#/policy/types/crawlerTagsTemplate

Category

AWS > Glue > Crawler > Tags

Parent

Targets

Default Template Input

[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-glue#/policy/types/glueTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > Glue > Crawler > Usage

Configure the number of AWS Glue crawlers that can be used for this account and the current consumption against the limit.

You can configure the behavior of the control with this AWS > Glue > Crawler > Usage policy.

URI

tmod:@turbot/aws-glue#/policy/types/crawlerUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > Glue > Crawler > Usage > Limit

Maximum number of items that can be created for this account.

URI

tmod:@turbot/aws-glue#/policy/types/crawlerUsageLimit

Category

AWS > Glue > Crawler > Usage

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 1000
}

AWS > Glue > Data Catalog > CMDB

Configure whether to record and synchronize details for the AWS Glue data catalog into the CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Glue > Data Catalog > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-glue#/policy/types/dataCatalogCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Glue > Data Catalog > Connection Password Encryption

Define the Connection Password Encryption settings required for AWS > Glue > Data Catalog.

Connection Password Encryption refers specifically to the encryption of data when written to an underlying storage system. This control determines whether the resource is encrypted at rest, and sets encryption to your desired level.

The Connection Password Encryption control compares the encryption settings against the encryption policies for the resource (AWS > Glue > Data Catalog > Connection Password Encryption > *), raises an alarm, and takes the defined enforcement action

URI

tmod:@turbot/aws-glue#/policy/types/dataCatalogConnectionPasswordEncryption

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: None",
  "Check: None or higher",
  "Check: AWS managed key",
  "Check: AWS managed key or higher",
  "Check: Customer managed key",
  "Check: Connection Password Encryption > Customer Managed Key",
  "Enforce: None",
  "Enforce: AWS managed key",
  "Enforce: AWS managed key or higher",
  "Enforce: Customer managed key",
  "Enforce: Connection Password Encryption > Customer Managed Key"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: None",
    "Check: None or higher",
    "Check: AWS managed key",
    "Check: AWS managed key or higher",
    "Check: Customer managed key",
    "Check: Connection Password Encryption > Customer Managed Key",
    "Enforce: None",
    "Enforce: AWS managed key",
    "Enforce: AWS managed key or higher",
    "Enforce: Customer managed key",
    "Enforce: Connection Password Encryption > Customer Managed Key"
  ],
  "example": [
    "Check: None or higher"
  ],
  "default": "Skip"
}

AWS > Glue > Data Catalog > Connection Password Encryption > Customer Managed Key

Define the KMS key ID for connection password encryption.

Please make sure the key defined in the template has required permissions.

example:
  alias/aws/ebs
  ddc06e04-ce5f-4995-c758-c2b6c510e8fd
  arn:aws:kms:us-east-1:123456789012:key/ddc06e04-ce5f-4995-c758-c2b6c510e8fd
  arn:aws:kms:us-east-1:123456789012:alias/aws/ebs

URI

tmod:@turbot/aws-glue#/policy/types/dataCatalogConnectionPasswordEncryptionCustomerManagedKey

Category

AWS > Glue > Data Catalog > Connection Password Encryption

Parent

Targets

Default Template Input

"{\n  defaultKey: policy(uri: \"aws-kms#/policy/types/keyDefaultCustomerManagedKey\")\n}\n"

Default Template

"{{ $.defaultKey }}"

Schema

{
  "anyOf": [
    {
      "type": "string",
      "pattern": "^alias/[a-zA-Z0-9:/_-]{1,249}$"
    },
    {
      "type": "string",
      "pattern": "^[-a-z0-9-]{1,255}$"
    },
    {
      "type": "string",
      "pattern": "^arn:aws(-us-gov|-cn)?:kms:[a-z]{2}(-gov)?-[a-z]+-[0-9]:[0-9]{12}:key/[-a-z0-9-]{1,255}$"
    },
    {
      "type": "string",
      "pattern": "^arn:aws(-us-gov|-cn)?:kms:[a-z]{2}(-gov)?-[a-z]+-[0-9]:[0-9]{12}:alias/[a-zA-Z0-9:/_-]{1,249}$"
    }
  ],
  "tests": [
    {
      "description": "valid - if keyArn",
      "input": "arn:aws:kms:us-east-1:039305405804:key/ddc06e04-ce5f-4995-b758-c2b6c510e8fd"
    },
    {
      "description": "valid - if aliasName",
      "input": "alias/aws/ebs"
    },
    {
      "description": "valid - if keyId",
      "input": "ddc06e04-ce5f-4995-b758-c2b6c510e8fd"
    },
    {
      "description": "valid - if aliasArn",
      "input": "arn:aws:kms:us-east-1:039305405804:alias/aws/ebs"
    }
  ]
}

AWS > Glue > Data Catalog > Encryption at Rest

Define the Encryption at Rest settings required for AWS > Glue > Data Catalog.

Encryption at Rest refers specifically to the encryption of data when written to an underlying storage system. This control determines whether the resource is encrypted at rest, and sets encryption to your desired level.

The Encryption at Rest control compares the encryption settings against the encryption policies for the resource (AWS > Glue > Data Catalog > Encryption at Rest > *), raises an alarm, and takes the defined enforcement action

URI

tmod:@turbot/aws-glue#/policy/types/dataCatalogEncryptionAtRest

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: None",
  "Check: None or higher",
  "Check: AWS managed key",
  "Check: AWS managed key or higher",
  "Check: Customer managed key",
  "Check: Encryption at Rest > Customer Managed Key",
  "Enforce: None",
  "Enforce: AWS managed key",
  "Enforce: AWS managed key or higher",
  "Enforce: Customer managed key",
  "Enforce: Encryption at Rest > Customer Managed Key"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: None",
    "Check: None or higher",
    "Check: AWS managed key",
    "Check: AWS managed key or higher",
    "Check: Customer managed key",
    "Check: Encryption at Rest > Customer Managed Key",
    "Enforce: None",
    "Enforce: AWS managed key",
    "Enforce: AWS managed key or higher",
    "Enforce: Customer managed key",
    "Enforce: Encryption at Rest > Customer Managed Key"
  ],
  "example": [
    "Check: None or higher"
  ],
  "default": "Skip"
}

AWS > Glue > Data Catalog > Encryption at Rest > Customer Managed Key

Define the KMS key ID for encryption at rest.

Please make sure the key defined in the template has required permissions.

example:
  alias/aws/ebs
  ddc06e04-ce5f-4995-c758-c2b6c510e8fd
  arn:aws:kms:us-east-1:123456789012:key/ddc06e04-ce5f-4995-c758-c2b6c510e8fd
  arn:aws:kms:us-east-1:123456789012:alias/aws/ebs

URI

tmod:@turbot/aws-glue#/policy/types/dataCatalogEncryptionAtRestCustomerManagedKey

Category

AWS > Glue > Data Catalog > Encryption at Rest

Parent

Targets

Default Template Input

"{\n  defaultKey: policy(uri: \"aws-kms#/policy/types/keyDefaultCustomerManagedKey\")\n}\n"

Default Template

"{{ $.defaultKey }}"

Schema

{
  "anyOf": [
    {
      "type": "string",
      "pattern": "^alias/[a-zA-Z0-9:/_-]{1,249}$"
    },
    {
      "type": "string",
      "pattern": "^[-a-z0-9-]{1,255}$"
    },
    {
      "type": "string",
      "pattern": "^arn:aws(-us-gov|-cn)?:kms:[a-z]{2}(-gov)?-[a-z]+-[0-9]:[0-9]{12}:key/[-a-z0-9-]{1,255}$"
    },
    {
      "type": "string",
      "pattern": "^arn:aws(-us-gov|-cn)?:kms:[a-z]{2}(-gov)?-[a-z]+-[0-9]:[0-9]{12}:alias/[a-zA-Z0-9:/_-]{1,249}$"
    }
  ],
  "tests": [
    {
      "description": "valid - if keyArn",
      "input": "arn:aws:kms:us-east-1:039305405804:key/ddc06e04-ce5f-4995-b758-c2b6c510e8fd"
    },
    {
      "description": "valid - if aliasName",
      "input": "alias/aws/ebs"
    },
    {
      "description": "valid - if keyId",
      "input": "ddc06e04-ce5f-4995-b758-c2b6c510e8fd"
    },
    {
      "description": "valid - if aliasArn",
      "input": "arn:aws:kms:us-east-1:039305405804:alias/aws/ebs"
    }
  ]
}

AWS > Glue > Data Catalog > Regions

A list of AWS regions in which AWS Glue data catalogs are supported for use.

Any data catalogs in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-glue#/policy/types/dataCatalogRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-glue#/policy/types/glueRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Glue > Database > Active

Determine the action to take when an AWS Glue database, based on the AWS > Glue > Database > Active > * policies.

The Active control checks the status of all defined Active policies for the resource (AWS > Glue > Database > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/databaseActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Glue > Database > Active > Age

The age after which the AWS Glue database is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/databaseActiveAge

Category

AWS > Glue > Database > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > Glue > Database > Active > Budget

The impact of the budget state on the active control. This policy allows you to force databases to inactive based on the current budget state, as reflected in AWS > Account > Budget > State

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/databaseActiveBudget

Category

AWS > Glue > Database > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if Budget > State is Over or higher",
  "Force inactive if Budget > State is Critical or higher",
  "Force inactive if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if Budget > State is Over or higher",
    "Force inactive if Budget > State is Critical or higher",
    "Force inactive if Budget > State is Shutdown"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > Glue > Database > Active > Last Modified

The number of days since the AWS Glue database was last modified before it is considered inactive.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/databaseActiveLastModified

Category

AWS > Glue > Database > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > Glue > Database > Approved

Determine the action to take when an AWS Glue database is not approved based on AWS > Glue > Database > Approved > * policies.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/databaseApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > Glue > Database > Approved > Budget

The policy allows you to set databases to unapproved based on the current budget state, as reflected in AWS > Account > Budget > State

This policy will be evaluated by the Approved control. If an AWS Glue database is not matched by the approved list, it will be subject to the action specified in the AWS > Glue > Database > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/databaseApprovedBudget

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Unapproved if Budget > State is Over or higher",
  "Unapproved if Budget > State is Critical or higher",
  "Unapproved if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Unapproved if Budget > State is Over or higher",
    "Unapproved if Budget > State is Critical or higher",
    "Unapproved if Budget > State is Shutdown"
  ],
  "example": [
    "Unapproved if Budget > State is Shutdown"
  ],
  "default": "Skip"
}

AWS > Glue > Database > Approved > Custom

Determine whether the AWS Glue database is allowed to exist. This policy will be evaluated by the Approved control. If an AWS Glue database is not approved, it will be subject to the action specified in the AWS > Glue > Database > Approved policy. See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/databaseApprovedCustom

Category

Parent

Targets

Schema

{
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > Glue > Database > Approved > Regions

A list of AWS regions in which AWS Glue databases are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS Glue database is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > Glue > Database > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/databaseApprovedRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-glue#/policy/types/glueApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Glue > Database > Approved > Usage

Determine whether the AWS Glue database is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS Glue database is not approved, it will be subject to the action specified in the AWS > Glue > Database > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/databaseApprovedUsage

Category

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > Glue > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > Glue > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > Glue > Enabled"
}

AWS > Glue > Database > CMDB

Configure whether to record and synchronize details for the AWS Glue database into the CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Glue > Database > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-glue#/policy/types/databaseCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Glue > Database > Regions

A list of AWS regions in which AWS Glue databases are supported for use.

Any databases in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-glue#/policy/types/databaseRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-glue#/policy/types/glueRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Glue > Database > Usage

Configure the number of AWS Glue databases that can be used for this account and the current consumption against the limit.

You can configure the behavior of the control with this AWS > Glue > Database > Usage policy.

URI

tmod:@turbot/aws-glue#/policy/types/databaseUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > Glue > Database > Usage > Limit

Maximum number of items that can be created for this account.

URI

tmod:@turbot/aws-glue#/policy/types/databaseUsageLimit

Category

AWS > Glue > Database > Usage

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 10000
}

AWS > Glue > Development Endpoint [Deprecated] > Active

Determine the action to take when an AWS Glue development endpoint, based on the AWS > Glue > Development Endpoint > Active > * policies.

The Active control checks the status of all defined Active policies for the resource (AWS > Glue > Development Endpoint > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Glue > Development Endpoint [Deprecated] > Active > Age

The age after which the AWS Glue development endpoint is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointActiveAge

Category

AWS > Glue > Development Endpoint [Deprecated] > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > Glue > Development Endpoint [Deprecated] > Active > Budget

The impact of the budget state on the active control. This policy allows you to force devEndpoints to inactive based on the current budget state, as reflected in AWS > Account > Budget > State

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointActiveBudget

Category

AWS > Glue > Development Endpoint [Deprecated] > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if Budget > State is Over or higher",
  "Force inactive if Budget > State is Critical or higher",
  "Force inactive if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if Budget > State is Over or higher",
    "Force inactive if Budget > State is Critical or higher",
    "Force inactive if Budget > State is Shutdown"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > Glue > Development Endpoint [Deprecated] > Active > Last Modified

The number of days since the AWS Glue development endpoint was last modified before it is considered inactive.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointActiveLastModified

Category

AWS > Glue > Development Endpoint [Deprecated] > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > Glue > Development Endpoint [Deprecated] > Active > Recently Used

The number of days since the AWS Glue development endpoint was last used before it is considered inactive. The Active control determines whether the resource is in active use, and if not, has the ability to delete / cleanup the resource. When running an automated compliance environment, it's common to end up with a wide range of alarms that are difficult and time consuming to clear. The Active control brings automated, well-defined control to this process. The Active control checks the status of all defined Active policies for the resource (AWS > Glue > Development Endpoint > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved. See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointActiveRecentlyUsed

Category

AWS > Glue > Development Endpoint [Deprecated] > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if recently used <= 1 day",
  "Active if recently used <= 3 days",
  "Active if recently used <= 7 days",
  "Active if recently used <= 14 days",
  "Active if recently used <= 30 days",
  "Active if recently used <= 60 days",
  "Active if recently used <= 90 days",
  "Active if recently used <= 180 days",
  "Active if recently used <= 365 days",
  "Force active if recently used <= 1 day",
  "Force active if recently used <= 3 days",
  "Force active if recently used <= 7 days",
  "Force active if recently used <= 14 days",
  "Force active if recently used <= 30 days",
  "Force active if recently used <= 60 days",
  "Force active if recently used <= 90 days",
  "Force active if recently used <= 180 days",
  "Force active if recently used <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if recently used <= 1 day",
    "Active if recently used <= 3 days",
    "Active if recently used <= 7 days",
    "Active if recently used <= 14 days",
    "Active if recently used <= 30 days",
    "Active if recently used <= 60 days",
    "Active if recently used <= 90 days",
    "Active if recently used <= 180 days",
    "Active if recently used <= 365 days",
    "Force active if recently used <= 1 day",
    "Force active if recently used <= 3 days",
    "Force active if recently used <= 7 days",
    "Force active if recently used <= 14 days",
    "Force active if recently used <= 30 days",
    "Force active if recently used <= 60 days",
    "Force active if recently used <= 90 days",
    "Force active if recently used <= 180 days",
    "Force active if recently used <= 365 days"
  ],
  "example": [
    "Active if recently used <= 90 days"
  ],
  "default": "Skip"
}

AWS > Glue > Development Endpoint [Deprecated] > Approved

Determine the action to take when an AWS Glue development endpoint is not approved based on AWS > Glue > Development Endpoint > Approved > * policies.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > Glue > Development Endpoint [Deprecated] > Approved > Budget

The policy allows you to set development endpoints to unapproved based on the current budget state, as reflected in AWS > Account > Budget > State

This policy will be evaluated by the Approved control. If an AWS Glue development endpoint is not matched by the approved list, it will be subject to the action specified in the AWS > Glue > Development Endpoint > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointApprovedBudget

Category

AWS > Glue > Development Endpoint [Deprecated] > Approved

Parent

Targets

Valid Value

[
  "Skip",
  "Unapproved if Budget > State is Over or higher",
  "Unapproved if Budget > State is Critical or higher",
  "Unapproved if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Unapproved if Budget > State is Over or higher",
    "Unapproved if Budget > State is Critical or higher",
    "Unapproved if Budget > State is Shutdown"
  ],
  "example": [
    "Unapproved if Budget > State is Shutdown"
  ],
  "default": "Skip"
}

AWS > Glue > Development Endpoint [Deprecated] > Approved > Custom

Determine whether the AWS Glue development endpoint is allowed to exist. This policy will be evaluated by the Approved control. If an AWS Glue development endpoint is not approved, it will be subject to the action specified in the AWS > Glue > Development Endpoint > Approved policy. See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointApprovedCustom

Category

AWS > Glue > Development Endpoint [Deprecated] > Approved

Parent

Targets

Schema

{
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > Glue > Development Endpoint [Deprecated] > Approved > Regions

A list of AWS regions in which AWS Glue development endpoints are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS Glue development endpoint is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > Glue > Development Endpoint > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointApprovedRegions

Category

AWS > Glue > Development Endpoint [Deprecated] > Approved

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-glue#/policy/types/glueApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Glue > Development Endpoint [Deprecated] > Approved > Usage

Determine whether the AWS Glue development endpoint is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS Glue development endpoint is not approved, it will be subject to the action specified in the AWS > Glue > Development Endpoint > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointApprovedUsage

Category

AWS > Glue > Development Endpoint [Deprecated] > Approved

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > Glue > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > Glue > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > Glue > Enabled"
}

AWS > Glue > Development Endpoint [Deprecated] > CMDB

Configure whether to record and synchronize details for the AWS Glue development endpoint into the CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Glue > Development Endpoint > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

Note: This resource type has been deprecated in v5.8.4 and will be removed in v6.0.0.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Glue > Development Endpoint [Deprecated] > Regions

A list of AWS regions in which AWS Glue development endpoints are supported for use.

Any development endpoints in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointRegions

Category

Parent

Targets

Schema

{
  "allOf": [
    {
      "$ref": "aws#/definitions/regionNameMatcherList"
    },
    {
      "default": [
        "af-south-1",
        "ap-east-1",
        "ap-northeast-1",
        "ap-northeast-2",
        "ap-south-1",
        "ap-southeast-1",
        "ap-southeast-2",
        "ca-central-1",
        "cn-north-1",
        "cn-northwest-1",
        "eu-central-1",
        "eu-north-1",
        "eu-west-1",
        "eu-west-2",
        "eu-west-3",
        "me-south-1",
        "sa-east-1",
        "us-east-1",
        "us-east-2",
        "us-gov-east-1",
        "us-gov-west-1",
        "us-west-1",
        "us-west-3"
      ]
    }
  ]
}

AWS > Glue > Development Endpoint [Deprecated] > Tags

Determine the action to take when an AWS Glue development endpoint tags are not updated based on the AWS > Glue > Development Endpoint > Tags > * policies.

The control ensure AWS Glue development endpoint tags include tags defined in AWS > Glue > Development Endpoint > Tags > Template.

Tags not defined in Development Endpoint Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointTags

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > Glue > Development Endpoint [Deprecated] > Tags > Template

The template is used to generate the keys and values for AWS Glue development endpoint.

Tags not defined in Development Endpoint Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointTagsTemplate

Category

AWS > Glue > Development Endpoint [Deprecated] > Tags

Parent

Targets

Default Template Input

[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-glue#/policy/types/glueTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > Glue > Development Endpoint [Deprecated] > Usage

Configure the number of AWS Glue development endpoints that can be used for this account and the current consumption against the limit.

You can configure the behavior of the control with this AWS > Glue > Development Endpoint > Usage policy.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > Glue > Development Endpoint [Deprecated] > Usage > Limit

Maximum number of items that can be created for this account.

URI

tmod:@turbot/aws-glue#/policy/types/devEndpointUsageLimit

Category

AWS > Glue > Development Endpoint [Deprecated] > Usage

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 25
}

AWS > Glue > Enabled

Configure whether the AWS Glue service is enabled. This will only affect Turbot managed User Roles and will allow the Turbot managed user to access AWS Glue service.

Enabled policy allows Turbot managed users to perform all the actions for the service
Enabled: Metadata Only policy allows Turbot managed users to perform only the metadata level actions for the service (like describe*, list*)

Note:

Disabled policy disables the service but does NOT disable the API for Turbot or SuperUsers
All the resource data stored in the Turbot CMDB is considered to be metadata
For more information related to permissions and grant levels, please check the documentation

URI

tmod:@turbot/aws-glue#/policy/types/glueEnabled

Category

Parent

Targets

Valid Value

[
  "Enabled",
  "Enabled: Metadata Only",
  "Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled",
    "Enabled: Metadata Only",
    "Disabled"
  ],
  "example": [
    "Enabled"
  ],
  "default": "Disabled"
}

AWS > Glue > Job > Active

Determine the action to take when an AWS Glue job, based on the AWS > Glue > Job > Active > * policies.

The Active control checks the status of all defined Active policies for the resource (AWS > Glue > Job > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/jobActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Glue > Job > Active > Age

The age after which the AWS Glue job is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/jobActiveAge

Category

AWS > Glue > Job > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > Glue > Job > Active > Budget

The impact of the budget state on the active control. This policy allows you to force jobs to inactive based on the current budget state, as reflected in AWS > Account > Budget > State

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/jobActiveBudget

Category

AWS > Glue > Job > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if Budget > State is Over or higher",
  "Force inactive if Budget > State is Critical or higher",
  "Force inactive if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if Budget > State is Over or higher",
    "Force inactive if Budget > State is Critical or higher",
    "Force inactive if Budget > State is Shutdown"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > Glue > Job > Active > Last Modified

The number of days since the AWS Glue job was last modified before it is considered inactive.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/jobActiveLastModified

Category

AWS > Glue > Job > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > Glue > Job > Approved

Determine the action to take when an AWS Glue job is not approved based on AWS > Glue > Job > Approved > * policies.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/jobApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > Glue > Job > Approved > Budget

The policy allows you to set jobs to unapproved based on the current budget state, as reflected in AWS > Account > Budget > State

This policy will be evaluated by the Approved control. If an AWS Glue job is not matched by the approved list, it will be subject to the action specified in the AWS > Glue > Job > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/jobApprovedBudget

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Unapproved if Budget > State is Over or higher",
  "Unapproved if Budget > State is Critical or higher",
  "Unapproved if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Unapproved if Budget > State is Over or higher",
    "Unapproved if Budget > State is Critical or higher",
    "Unapproved if Budget > State is Shutdown"
  ],
  "example": [
    "Unapproved if Budget > State is Shutdown"
  ],
  "default": "Skip"
}

AWS > Glue > Job > Approved > Custom

Determine whether the AWS Glue job is allowed to exist. This policy will be evaluated by the Approved control. If an AWS Glue job is not approved, it will be subject to the action specified in the AWS > Glue > Job > Approved policy. See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/jobApprovedCustom

Category

Parent

Targets

Schema

{
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > Glue > Job > Approved > Regions

A list of AWS regions in which AWS Glue jobs are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS Glue job is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > Glue > Job > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/jobApprovedRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-glue#/policy/types/glueApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Glue > Job > Approved > Usage

Determine whether the AWS Glue job is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS Glue job is not approved, it will be subject to the action specified in the AWS > Glue > Job > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/jobApprovedUsage

Category

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > Glue > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > Glue > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > Glue > Enabled"
}

AWS > Glue > Job > CMDB

Configure whether to record and synchronize details for the AWS Glue job into the CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Glue > Job > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-glue#/policy/types/jobCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Glue > Job > Regions

A list of AWS regions in which AWS Glue jobs are supported for use.

Any jobs in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-glue#/policy/types/jobRegions

Category

Parent

Targets

Schema

{
  "allOf": [
    {
      "$ref": "aws#/definitions/regionNameMatcherList"
    },
    {
      "default": [
        "af-south-1",
        "ap-east-1",
        "ap-northeast-1",
        "ap-northeast-2",
        "ap-south-1",
        "ap-southeast-1",
        "ap-southeast-2",
        "ca-central-1",
        "cn-north-1",
        "cn-northwest-1",
        "eu-central-1",
        "eu-north-1",
        "eu-west-1",
        "eu-west-2",
        "eu-west-3",
        "me-south-1",
        "sa-east-1",
        "us-east-1",
        "us-east-2",
        "us-gov-east-1",
        "us-gov-west-1",
        "us-west-1",
        "us-west-2"
      ]
    }
  ]
}

AWS > Glue > Job > Tags

Determine the action to take when an AWS Glue job tags are not updated based on the AWS > Glue > Job > Tags > * policies.

The control ensure AWS Glue job tags include tags defined in AWS > Glue > Job > Tags > Template.

Tags not defined in Job Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-glue#/policy/types/jobTags

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > Glue > Job > Tags > Template

The template is used to generate the keys and values for AWS Glue job.

Tags not defined in Job Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-glue#/policy/types/jobTagsTemplate

Category

Parent

AWS > Glue > Job > Tags

Targets

Default Template Input

[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-glue#/policy/types/glueTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > Glue > Job > Usage

Configure the number of AWS Glue jobs that can be used for this account and the current consumption against the limit.

You can configure the behavior of the control with this AWS > Glue > Job > Usage policy.

URI

tmod:@turbot/aws-glue#/policy/types/jobUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > Glue > Job > Usage > Limit

Maximum number of items that can be created for this account.

URI

tmod:@turbot/aws-glue#/policy/types/jobUsageLimit

Category

Parent

AWS > Glue > Job > Usage

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 1000
}

AWS > Glue > ML Transform > Active

Determine the action to take when an AWS Glue ml transform, based on the AWS > Glue > ML Transform > Active > * policies.

The Active control checks the status of all defined Active policies for the resource (AWS > Glue > ML Transform > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Glue > ML Transform > Active > Age

The age after which the AWS Glue ml transform is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformActiveAge

Category

AWS > Glue > ML Transform > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > Glue > ML Transform > Active > Budget

The impact of the budget state on the active control. This policy allows you to force mlTransforms to inactive based on the current budget state, as reflected in AWS > Account > Budget > State

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformActiveBudget

Category

AWS > Glue > ML Transform > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if Budget > State is Over or higher",
  "Force inactive if Budget > State is Critical or higher",
  "Force inactive if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if Budget > State is Over or higher",
    "Force inactive if Budget > State is Critical or higher",
    "Force inactive if Budget > State is Shutdown"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > Glue > ML Transform > Active > Last Modified

The number of days since the AWS Glue ml transform was last modified before it is considered inactive.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformActiveLastModified

Category

AWS > Glue > ML Transform > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > Glue > ML Transform > Approved

Determine the action to take when an AWS Glue ml transform is not approved based on AWS > Glue > ML Transform > Approved > * policies.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > Glue > ML Transform > Approved > Budget

The policy allows you to set ml transforms to unapproved based on the current budget state, as reflected in AWS > Account > Budget > State

This policy will be evaluated by the Approved control. If an AWS Glue ml transform is not matched by the approved list, it will be subject to the action specified in the AWS > Glue > ML Transform > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformApprovedBudget

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Unapproved if Budget > State is Over or higher",
  "Unapproved if Budget > State is Critical or higher",
  "Unapproved if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Unapproved if Budget > State is Over or higher",
    "Unapproved if Budget > State is Critical or higher",
    "Unapproved if Budget > State is Shutdown"
  ],
  "example": [
    "Unapproved if Budget > State is Shutdown"
  ],
  "default": "Skip"
}

AWS > Glue > ML Transform > Approved > Custom

Determine whether the AWS Glue ml transform is allowed to exist. This policy will be evaluated by the Approved control. If an AWS Glue ml transform is not approved, it will be subject to the action specified in the AWS > Glue > ML Transform > Approved policy. See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformApprovedCustom

Category

Parent

Targets

Schema

{
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > Glue > ML Transform > Approved > Regions

A list of AWS regions in which AWS Glue ml transforms are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS Glue ml transform is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > Glue > ML Transform > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformApprovedRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-glue#/policy/types/glueApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Glue > ML Transform > Approved > Usage

Determine whether the AWS Glue ml transform is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS Glue ml transform is not approved, it will be subject to the action specified in the AWS > Glue > ML Transform > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformApprovedUsage

Category

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > Glue > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > Glue > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > Glue > Enabled"
}

AWS > Glue > ML Transform > CMDB

Configure whether to record and synchronize details for the AWS Glue ml transform into the CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Glue > ML Transform > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Glue > ML Transform > Regions

A list of AWS regions in which AWS Glue ml transforms are supported for use.

Any ml transforms in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformRegions

Category

Parent

Targets

Schema

{
  "allOf": [
    {
      "$ref": "aws#/definitions/regionNameMatcherList"
    },
    {
      "default": [
        "af-south-1",
        "ap-east-1",
        "ap-northeast-1",
        "ap-northeast-2",
        "ap-south-1",
        "ap-southeast-1",
        "ap-southeast-2",
        "ca-central-1",
        "cn-north-1",
        "cn-northwest-1",
        "eu-central-1",
        "eu-north-1",
        "eu-west-1",
        "eu-west-2",
        "eu-west-3",
        "me-south-1",
        "sa-east-1",
        "us-east-1",
        "us-east-2",
        "us-gov-west-1",
        "us-west-1",
        "us-west-2"
      ]
    }
  ]
}

AWS > Glue > ML Transform > Tags

Determine the action to take when an AWS Glue ml transform tags are not updated based on the AWS > Glue > ML Transform > Tags > * policies.

The control ensure AWS Glue ml transform tags include tags defined in AWS > Glue > ML Transform > Tags > Template.

Tags not defined in ML Transform Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformTags

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > Glue > ML Transform > Tags > Template

The template is used to generate the keys and values for AWS Glue ml transform.

Tags not defined in ML Transform Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformTagsTemplate

Category

AWS > Glue > ML Transform > Tags

Parent

Targets

Default Template Input

[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-glue#/policy/types/glueTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > Glue > ML Transform > Usage

Configure the number of AWS Glue ml transforms that can be used for this account and the current consumption against the limit.

You can configure the behavior of the control with this AWS > Glue > ML Transform > Usage policy.

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > Glue > ML Transform > Usage > Limit

Maximum number of items that can be created for this account.

URI

tmod:@turbot/aws-glue#/policy/types/mlTransformUsageLimit

Category

AWS > Glue > ML Transform > Usage

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 100
}

AWS > Glue > Permissions

Configure whether permissions policies are in effect for AWS Glue.

This setting does not affect account level permissions (AWS/Admin, AWS/Owner, etc)

Note: The behavior of this policy depends on the value of AWS > Permissions.

URI

tmod:@turbot/aws-glue#/policy/types/gluePermissions

Category

Parent

Targets

Valid Value

[
  "Enabled",
  "Disabled",
  "Enabled if AWS > Glue > Enabled & AWS > Glue > API Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled",
    "Enabled if AWS > Glue > Enabled & AWS > Glue > API Enabled"
  ],
  "example": [
    "Enabled"
  ],
  "default": "Enabled if AWS > Glue > Enabled & AWS > Glue > API Enabled"
}

AWS > Glue > Permissions > Levels

Define the permissions levels that can be used to grant access to an AWS account. Permissions levels defined will appear in the UI to assign access to Turbot users. This policy provides a default for Permissions > Levels in each service, however you can explicitly override the setting for each service if desired

URI

tmod:@turbot/aws-glue#/policy/types/gluePermissionsLevels

Category

Parent

AWS > Glue > Permissions

Targets

Default Template Input

[
  "{\n  item: account {\n    turbot{\n      id\n    }\n  }\n}\n",
  "{\n  availableLevels: policyValues(filter:\"policyTypeLevel:self resourceId:{{ $.item.turbot.id }} policyType:'tmod:@turbot/aws-iam#/policy/types/permissionsLevelsDefault'\") {\n    items {\n      value\n    }\n  }\n}\n"
]

Default Template

"{% if $.availableLevels.items[0].value | length == 0 %} [] {% endif %}{% for item in $.availableLevels.items[0].value %}- {{ item }}\n{% endfor %}"

Schema

{
  "type": "array",
  "items": {
    "type": "string",
    "enum": [
      "Metadata",
      "ReadOnly",
      "Operator",
      "Admin",
      "Owner"
    ]
  }
}

AWS > Glue > Permissions > Levels > Modifiers

A map of AWS API to Turbot Permission Level used to customize Turbot's standard permissions. You can add, remove or redefine the mapping of AWS API operations to Turbot permissions levels here.

Note: Modifiers are cumulative - if you add a permission to the Metadata level, it is also added to ReadOnly, Operator and Admin. Modifier policies set here apply ONLY to the AWS level

example:
  - &quot;glacier:createvault&quot;: admin
  - &quot;glacier:ListVaults&quot;: metadata
  - &quot;s3:DeleteBucket&quot;: none

URI

tmod:@turbot/aws-glue#/policy/types/gluePermissionsLevelsModifiers

Category

AWS > Glue > Permissions > Levels

Parent

Targets

aws-iam#/definitions/awsModifierList

Schema

AWS > Glue > Permissions > Lockdown

URI

tmod:@turbot/aws-glue#/policy/types/gluePermissionsLockdown

Category

Parent

AWS > Glue > Permissions

Targets

AWS > Glue > Permissions > Lockdown > API Boundary

Configure whether the AWS glue API is enabled for all users and roles in turbot-managed boundary policies.

Note: Disabling the service disables the API for ALL users and roles, and Turbot will have no access to the API.

URI

tmod:@turbot/aws-glue#/policy/types/gluePermissionsLockdownApiBoundary

Category

AWS > Glue > Permissions > Lockdown

Parent

Targets

Valid Value

[
  "Enabled if AWS > Glue > API Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled if AWS > Glue > API Enabled"
  ],
  "example": [
    "Enabled if AWS > Glue > API Enabled"
  ],
  "default": "Enabled if AWS > Glue > API Enabled"
}

AWS > Glue > Regions

A list of AWS regions in which AWS Glue resources are supported for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy is the default value for all AWS Glue resources' Regions policies.

URI

tmod:@turbot/aws-glue#/policy/types/glueRegionsDefault

Category

Parent

Targets

Schema

{
  "allOf": [
    {
      "$ref": "aws#/definitions/regionNameMatcherList"
    },
    {
      "default": [
        "ap-east-1",
        "ap-northeast-1",
        "ap-northeast-2",
        "ap-south-1",
        "ap-southeast-1",
        "ap-southeast-2",
        "ca-central-1",
        "cn-north-1",
        "cn-northwest-1",
        "eu-central-1",
        "eu-north-1",
        "eu-west-1",
        "eu-west-2",
        "eu-west-3",
        "me-south-1",
        "sa-east-1",
        "us-east-1",
        "us-east-2",
        "us-gov-east-1",
        "us-gov-west-1",
        "us-west-1",
        "us-west-2"
      ]
    }
  ]
}

AWS > Glue > Security Configuration > Active

Determine the action to take when an AWS Glue security configuration, based on the AWS > Glue > Security Configuration > Active > * policies.

The Active control checks the status of all defined Active policies for the resource (AWS > Glue > Security Configuration > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/securityConfigurationActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Glue > Security Configuration > Active > Age

The age after which the AWS Glue security configuration is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/securityConfigurationActiveAge

Category

AWS > Glue > Security Configuration > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > Glue > Security Configuration > Active > Last Modified

The number of days since the AWS Glue security configuration was last modified before it is considered inactive.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/securityConfigurationActiveLastModified

Category

AWS > Glue > Security Configuration > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > Glue > Security Configuration > Approved

Determine the action to take when an AWS Glue security configuration is not approved based on AWS > Glue > Security Configuration > Approved > * policies.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/securityConfigurationApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > Glue > Security Configuration > Approved > Custom

Determine whether the AWS Glue security configuration is allowed to exist. This policy will be evaluated by the Approved control. If an AWS Glue security configuration is not approved, it will be subject to the action specified in the AWS > Glue > Security Configuration > Approved policy. See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/securityConfigurationApprovedCustom

Category

AWS > Glue > Security Configuration > Approved

Parent

Targets

Schema

{
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > Glue > Security Configuration > Approved > Regions

A list of AWS regions in which AWS Glue security configurations are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS Glue security configuration is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > Glue > Security Configuration > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/securityConfigurationApprovedRegions

Category

AWS > Glue > Security Configuration > Approved

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-glue#/policy/types/glueApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Glue > Security Configuration > Approved > Usage

Determine whether the AWS Glue security configuration is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS Glue security configuration is not approved, it will be subject to the action specified in the AWS > Glue > Security Configuration > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-glue#/policy/types/securityConfigurationApprovedUsage

Category

AWS > Glue > Security Configuration > Approved

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > Glue > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > Glue > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > Glue > Enabled"
}

AWS > Glue > Security Configuration > CMDB

Configure whether to record and synchronize details for the AWS Glue security configuration into the CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Glue > Security Configuration > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-glue#/policy/types/securityConfigurationCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Glue > Security Configuration > Regions

A list of AWS regions in which AWS Glue security configurations are supported for use.

Any security configurations in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-glue#/policy/types/securityConfigurationRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-glue#/policy/types/glueRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Glue > Security Configuration > Usage

Configure the number of AWS Glue security configurations that can be used for this region and the current consumption against the limit.

You can configure the behavior of the control with this AWS > Glue > Security Configuration > Usage policy.

URI

tmod:@turbot/aws-glue#/policy/types/securityConfigurationUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > Glue > Security Configuration > Usage > Limit

Maximum number of items that can be created for this region.

URI

tmod:@turbot/aws-glue#/policy/types/securityConfigurationUsageLimit

Category

AWS > Glue > Security Configuration > Usage

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 250
}

AWS > Glue > Table > Active

Determine the action to take when an AWS Glue , based on the AWS > Glue > > Active > * policies.

The Active control checks the status of all defined Active policies for the resource (AWS > Glue > > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/tableActive

Category

Parent

AWS > Glue > Table

Targets

AWS > Glue > Table

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Glue > Table > Active > Age

The age after which the AWS Glue is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

See Active for more information.

URI

tmod:@turbot/aws-glue#/policy/types/tableActiveAge

Category