Product logo
DocsBlogPricing

Policy types for @turbot/aws-iam

AWS > Account > Permissions

URI
tmod:@turbot/aws-iam#/policy/types/accountPermissions
Category
Parent
Targets

AWS > Account > Permissions > Lockdown

URI
tmod:@turbot/aws-iam#/policy/types/accountPermissionsLockdown
Category
Parent
Targets

AWS > Account > Permissions > Lockdown > Budget

Configure lockdown policies to restrict APIs based on the
budget state (when the current spend exceeds a defined threshold).

URI
tmod:@turbot/aws-iam#/policy/types/accountPermissionsLockdownBudget
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Restrict APIs per `Lockdown > Budget > Restricted APIs`"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Restrict APIs per `Lockdown > Budget > Restricted APIs`"
  ],
  "default": "Skip"
}

AWS > Account > Permissions > Lockdown > Budget > Restricted APIs

A yaml object that contains a list of APIs that should
be restricted when the budget reaches a specific state.

For example, to restrict users from running and starting
new ec2 instances, starting RDS databases, or creating
Redshift clusters when the budget state is Critical or
higher, enter:

<br />Critical:<br /> - ec2:RunInstance<br /> - ec2:StartInstance<br /> - rds:StartDB*<br /> - redshift:createcluster<br />

URI
tmod:@turbot/aws-iam#/policy/types/accountPermissionsLockdownBudgetRestrictedApis
Category
Parent
Targets
Schema

AWS > IAM > API Enabled

Configure whether the AWS S3 API is enabled.

Note: Disabling the service disables the API for ALL users
and roles, and Guardrails will have no access to the API.

URI
tmod:@turbot/aws-iam#/policy/types/iamApiEnabled
Category
Parent
Targets
Valid Value
[
  "Enabled",
  "Disabled",
  "Enabled if AWS > IAM > Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled",
    "Enabled if AWS > IAM > Enabled"
  ],
  "default": "Enabled"
}

AWS > IAM > Access Analyzer > Active

Determine the action to take when an AWS IAM access analyzer, based on the AWS > IAM > Access Analyzer > Active > * policies.

The control determines whether the resource is in active use, and if not,
has the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Access Analyzer > Active > *), raises an alarm, and takes the defined enforcement
action. Each Active sub-policy can calculate a status of active, inactive
or skipped. Generally, if the resource appears to be Active for any reason
it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered
Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/accessAnalyzerActive
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > IAM > Access Analyzer > Active > Age

The age after which the AWS IAM access analyzer
is no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Access Analyzer > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/accessAnalyzerActiveAge
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Access Analyzer > Active > Last Modified

The number of days since the AWS IAM access analyzer
was last modified before it is considered inactive.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Access Analyzer > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/accessAnalyzerActiveLastModified
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Access Analyzer > Approved

Determine the action to take when an AWS IAM access analyzer is not approved based on AWS > IAM > Access Analyzer > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/accessAnalyzerApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > IAM > Access Analyzer > Approved > Custom

Determine whether the AWS IAM access analyzer is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS IAM access analyzer is not approved, it will be subject to the action specified in the AWS > IAM > Access Analyzer > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI
tmod:@turbot/aws-iam#/policy/types/accessAnalyzerApprovedCustom
Category
Parent
Targets
Schema
{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > IAM > Access Analyzer > Approved > Regions

A list of AWS regions in which AWS IAM access analyzers are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS IAM access analyzer is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > IAM > Access Analyzer > Approved policy.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/accessAnalyzerApprovedRegions
Category
Parent
Targets
Default Template Input
"{\n  regions: policy(uri: \"tmod:@turbot/aws-iam#/policy/types/accessAnalyzerRegions\")\n}\n"
Default Template
"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;&#92;n{% endfor %}"
Schema

AWS > IAM > Access Analyzer > Approved > Usage

Determine whether the AWS IAM access analyzer is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS IAM access analyzer is not approved, it will be subject to the action specified in the AWS > IAM > Access Analyzer > Approved policy.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/accessAnalyzerApprovedUsage
Category
Parent
Targets
Valid Value
[
  "Not approved",
  "Approved",
  "Approved if AWS > IAM > Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > IAM > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > IAM > Enabled"
}

AWS > IAM > Access Analyzer > CMDB

Configure whether to record and synchronize details for the AWS IAM access analyzer into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > IAM > Access Analyzer > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI
tmod:@turbot/aws-iam#/policy/types/accessAnalyzerCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Access Analyzer > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it.

URI
tmod:@turbot/aws-iam#/policy/types/accessAnalyzerConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > Access Analyzer > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/accessAnalyzerConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > Access Analyzer > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource.

URI
tmod:@turbot/aws-iam#/policy/types/accessAnalyzerConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > Access Analyzer > Regions

A list of AWS regions in which AWS IAM access analyzers are supported for use.

Any access analyzers in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and
'?' wildcard characters.

URI
tmod:@turbot/aws-iam#/policy/types/accessAnalyzerRegions
Category
Parent
Targets
Schema
{
  "allOf": [
    {
      "$ref": "aws#/definitions/regionNameMatcherList"
    },
    {
      "default": [
        "af-south-1",
        "ap-east-1",
        "ap-northeast-1",
        "ap-northeast-2",
        "ap-northeast-3",
        "ap-south-1",
        "ap-southeast-1",
        "ap-southeast-2",
        "ca-central-1",
        "eu-central-1",
        "eu-north-1",
        "eu-south-1",
        "eu-west-1",
        "eu-west-2",
        "eu-west-3",
        "me-south-1",
        "sa-east-1",
        "us-east-1",
        "us-east-2",
        "us-gov-east-1",
        "us-gov-west-1",
        "us-west-1",
        "us-west-2"
      ]
    }
  ]
}

AWS > IAM > Access Analyzer > Tags

Determine the action to take when an AWS IAM access analyzer tags are not updated based on the AWS > IAM > Access Analyzer > Tags > * policies.

The control ensure AWS IAM access analyzer tags include tags defined in AWS > IAM > Access Analyzer > Tags > Template.

Tags not defined in Access Analyzer Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI
tmod:@turbot/aws-iam#/policy/types/accessAnalyzerTags
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > IAM > Access Analyzer > Tags > Template

The template is used to generate the keys and values for AWS IAM access analyzer.

Tags not defined in Access Analyzer Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI
tmod:@turbot/aws-iam#/policy/types/accessAnalyzerTagsTemplate
Category
Parent
Targets
Default Template Input
[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-iam#/policy/types/iamTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]
Default Template
"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"
Schema

AWS > IAM > Access Key > Active

Determine the action to take when an AWS IAM access key, based on the AWS > IAM > Access Key > Active > * policies.

The control determines whether the resource is in active use, and if not,
has the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Access Key > Active > *), raises an alarm, and takes the defined enforcement
action. Each Active sub-policy can calculate a status of active, inactive
or skipped. Generally, if the resource appears to be Active for any reason
it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered
Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/accessKeyActive
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning",
  "Enforce: Deactivate inactive with 1 day warning",
  "Enforce: Deactivate inactive with 3 days warning",
  "Enforce: Deactivate inactive with 7 days warning",
  "Enforce: Deactivate inactive with 14 days warning",
  "Enforce: Deactivate inactive with 30 days warning",
  "Enforce: Deactivate inactive with 60 days warning",
  "Enforce: Deactivate inactive with 90 days warning",
  "Enforce: Deactivate inactive with 180 days warning",
  "Enforce: Deactivate inactive with 365 days warning"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning",
    "Enforce: Deactivate inactive with 1 day warning",
    "Enforce: Deactivate inactive with 3 days warning",
    "Enforce: Deactivate inactive with 7 days warning",
    "Enforce: Deactivate inactive with 14 days warning",
    "Enforce: Deactivate inactive with 30 days warning",
    "Enforce: Deactivate inactive with 60 days warning",
    "Enforce: Deactivate inactive with 90 days warning",
    "Enforce: Deactivate inactive with 180 days warning",
    "Enforce: Deactivate inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > IAM > Access Key > Active > Age

The age after which the AWS IAM access key
is no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Access Key > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/accessKeyActiveAge
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Access Key > Active > Last Modified

The number of days since the AWS IAM access key
was last modified before it is considered inactive.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Access Key > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/accessKeyActiveLastModified
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Access Key > Active > Recently Used

The number of days since the AWS IAM access key was last used before it is considered inactive.
The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.
The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Access Key > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.
See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/accessKeyActiveRecentlyUsed
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if recently used <= 1 day",
  "Active if recently used <= 3 days",
  "Active if recently used <= 7 days",
  "Active if recently used <= 14 days",
  "Active if recently used <= 30 days",
  "Active if recently used <= 60 days",
  "Active if recently used <= 90 days",
  "Active if recently used <= 180 days",
  "Active if recently used <= 365 days",
  "Force active if recently used <= 1 day",
  "Force active if recently used <= 3 days",
  "Force active if recently used <= 7 days",
  "Force active if recently used <= 14 days",
  "Force active if recently used <= 30 days",
  "Force active if recently used <= 60 days",
  "Force active if recently used <= 90 days",
  "Force active if recently used <= 180 days",
  "Force active if recently used <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if recently used <= 1 day",
    "Active if recently used <= 3 days",
    "Active if recently used <= 7 days",
    "Active if recently used <= 14 days",
    "Active if recently used <= 30 days",
    "Active if recently used <= 60 days",
    "Active if recently used <= 90 days",
    "Active if recently used <= 180 days",
    "Active if recently used <= 365 days",
    "Force active if recently used <= 1 day",
    "Force active if recently used <= 3 days",
    "Force active if recently used <= 7 days",
    "Force active if recently used <= 14 days",
    "Force active if recently used <= 30 days",
    "Force active if recently used <= 60 days",
    "Force active if recently used <= 90 days",
    "Force active if recently used <= 180 days",
    "Force active if recently used <= 365 days"
  ],
  "example": [
    "Active if recently used <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Access Key > Active > Status

The policy allows you to
check which status determines if the AWS IAM access key is active.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Access Key > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

The policy values for AWS IAM access key are deprecated and replaced by new values.
The deprecated values will be removed in next major version.

| Deprecated Values | Current Values |
|-------------------------------------|----------------------------------------|
| Active if status is active | Active if $.Status is active |
| Force active if status is active | Force active if $.Status is active |

URI
tmod:@turbot/aws-iam#/policy/types/accessKeyActiveStatus
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if status is active",
  "Force active if status is active",
  "Active if $.Status is active",
  "Force active if $.Status is active"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if status is active",
    "Force active if status is active",
    "Active if $.Status is active",
    "Force active if $.Status is active"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > IAM > Access Key > CMDB

Configure whether to record and synchronize details for the AWS IAM access key into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/accessKeyCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Access Key > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI
tmod:@turbot/aws-iam#/policy/types/accessKeyConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > Access Key > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/accessKeyConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > Access Key > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource

URI
tmod:@turbot/aws-iam#/policy/types/accessKeyConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > Access Key > Usage

Configure the number of AWS IAM access keys that can be used for this user and the current consumption against the limit.

You can configure the behavior of the control with this AWS > IAM > Access Key > Usage policy.

URI
tmod:@turbot/aws-iam#/policy/types/accessKeyUsage
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > IAM > Access Key > Usage > Limit

Maximum number of items that can be created for this user.

URI
tmod:@turbot/aws-iam#/policy/types/accessKeyUsageLimit
Category
Parent
Targets
Schema
{
  "type": "integer",
  "minimum": 0,
  "default": 2
}

AWS > IAM > Account Password Policy > CMDB

Configure whether to record and synchronize details for the AWS IAM account password policy into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/accountPasswordPolicyCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Account Password Policy > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI
tmod:@turbot/aws-iam#/policy/types/accountPasswordPolicyConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > Account Password Policy > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/accountPasswordPolicyConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > Account Password Policy > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource

URI
tmod:@turbot/aws-iam#/policy/types/accountPasswordPolicyConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > Account Password Policy > Settings

Check if the IAM account password policy is in sync with the account password settings policies.

URI
tmod:@turbot/aws-iam#/policy/types/accountPasswordPolicySettings
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Configured",
  "Enforce: Configured"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Configured",
    "Enforce: Configured"
  ],
  "example": [
    "Check: Configured"
  ],
  "default": "Skip"
}

AWS > IAM > Account Password Policy > Settings > Allow Users to Change

You can permit all IAM users in your account to use the IAM console to change their own passwords, as described in Permitting IAM users to change their own passwords.

Refer to Setting an account password policy for IAM users for more information on account password policies.

URI
tmod:@turbot/aws-iam#/policy/types/accountPasswordPolicySettingsAllowUsersToChange
Category
Parent
Targets
Valid Value
[
  "Enabled",
  "Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled"
  ],
  "example": "Enabled",
  "default": "Enabled"
}

AWS > IAM > Account Password Policy > Settings > Hard Expiry

You can prevent IAM users from choosing a new password after their current password has expired. For example, a password policy can specify a password expiration period. If an IAM user fails to choose a new password before the expiration period ends, the IAM user cannot set a new password. In that case, the IAM user must request a password reset from an account administrator in order to regain access to the AWS Management Console. You can also leave this check box cleared. If an IAM user allows his or her password to expire, the user in this scenario is required to set a new password before accessing the AWS Management Console.

Refer to Setting an account password policy for IAM users for more information on account password policies.

URI
tmod:@turbot/aws-iam#/policy/types/accountPasswordPolicySettingsHardExpiry
Category
Parent
Targets
Valid Value
[
  "Enabled",
  "Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled"
  ],
  "example": "Enabled",
  "default": "Enabled"
}

AWS > IAM > Account Password Policy > Settings > Max Age

You can set IAM user passwords to be valid for only the specified number of days. You specify the number of days that passwords remain valid after they are set. For example, when you enable password expiration and set the password expiration period to 90 days, an IAM user can use a password for up to 90 days. After 90 days, the password expires and the IAM user must set a new password before accessing the AWS Management Console. You can choose a password expiration period between 1 and 1095 days, inclusive.

Refer to Setting an account password policy for IAM users for more information on account password policies.

URI
tmod:@turbot/aws-iam#/policy/types/accountPasswordPolicySettingsMaxAge
Category
Parent
Targets
Schema
{
  "type": "integer",
  "minimum": 1,
  "maximum": 1095,
  "example": 90,
  "default": 90
}

AWS > IAM > Account Password Policy > Settings > Minimum Length

You can specify the minimum number of characters allowed in an IAM user password. You can type any number from 6 to 128.

Refer to Setting an account password policy for IAM users for more information on account password policies.

URI
tmod:@turbot/aws-iam#/policy/types/accountPasswordPolicySettingsMinimumLength
Category
Parent
Targets
Schema
{
  "type": "integer",
  "minimum": 6,
  "maximum": 128,
  "example": 14,
  "default": 14
}

AWS > IAM > Account Password Policy > Settings > Require Lowercase Characters

You can require that IAM user passwords contain at least one lowercase character from the ISO basic Latin alphabet (a to z).

Refer to Setting an account password policy for IAM users for more information on account password policies.

URI
tmod:@turbot/aws-iam#/policy/types/accountPasswordPolicySettingsRequireLowercaseCharacters
Category
Parent
Targets
Valid Value
[
  "Enabled",
  "Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled"
  ],
  "example": "Enabled",
  "default": "Enabled"
}

AWS > IAM > Account Password Policy > Settings > Require Numbers

You can require that IAM user passwords contain at least one numeric character (0 to 9).

Refer to Setting an account password policy for IAM users for more information on account password policies.

URI
tmod:@turbot/aws-iam#/policy/types/accountPasswordPolicySettingsRequireNumbers
Category
Parent
Targets
Valid Value
[
  "Enabled",
  "Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled"
  ],
  "example": "Enabled",
  "default": "Enabled"
}

AWS > IAM > Account Password Policy > Settings > Require Symbols

You can require that IAM user passwords contain at least one of the following nonalphanumeric characters:
! @ # $ % ^ &amp; * ( ) _ + - = [ ] { } | &#39;

Refer to Setting an account password policy for IAM users for more information on account password policies.

URI
tmod:@turbot/aws-iam#/policy/types/accountPasswordPolicySettingsRequireSymbols
Category
Parent
Targets
Valid Value
[
  "Enabled",
  "Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled"
  ],
  "example": "Enabled",
  "default": "Enabled"
}

AWS > IAM > Account Password Policy > Settings > Require Uppercase Characters

You can require that IAM user passwords contain at least one uppercase character from the ISO basic Latin alphabet (A to Z).

Refer to Setting an account password policy for IAM users for more information on account password policies.

URI
tmod:@turbot/aws-iam#/policy/types/accountPasswordPolicySettingsRequireUppercaseCharacters
Category
Parent
Targets
Valid Value
[
  "Enabled",
  "Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled"
  ],
  "example": "Enabled",
  "default": "Enabled"
}

AWS > IAM > Account Password Policy > Settings > Reuse Prevention

You can prevent IAM users from reusing a specified number of previous passwords. You can set the number of previous passwords from 1 to 24, inclusive.

Refer to Setting an account password policy for IAM users for more information on account password policies.

URI
tmod:@turbot/aws-iam#/policy/types/accountPasswordPolicySettingsReusePrevention
Category
Parent
Targets
Schema
{
  "type": "integer",
  "minimum": 1,
  "maximum": 24,
  "example": 5,
  "default": 5
}

AWS > IAM > Account Summary > CMDB

Configure whether to record and synchronize details for the AWS IAM account summary into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/accountSummaryCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Credential Report > CMDB

Configure whether to record and synchronize details for the AWS IAM credential report into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/credentialReportCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Enabled

Enabled IAM.

URI
tmod:@turbot/aws-iam#/policy/types/iamEnabled
Category
Parent
Targets
Valid Value
[
  "Enabled",
  "Enabled: Metadata Only",
  "Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled",
    "Enabled: Metadata Only",
    "Disabled"
  ],
  "example": [
    "Enabled"
  ],
  "default": "Disabled"
}

AWS > IAM > Group > Active

Determine the action to take when an AWS IAM group, based on the AWS > IAM > Group > Active > * policies.

The control determines whether the resource is in active use, and if not,
has the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Group > Active > *), raises an alarm, and takes the defined enforcement
action. Each Active sub-policy can calculate a status of active, inactive
or skipped. Generally, if the resource appears to be Active for any reason
it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered
Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/groupActive
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > IAM > Group > Active > Age

The age after which the AWS IAM group
is no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Group > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/groupActiveAge
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Group > Active > Budget

The impact of the budget state on the active control. This policy allows you to force
groups to inactive based on the current budget state, as reflected in
AWS > Account > Budget > State

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Group > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/groupActiveBudget
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Force inactive if Budget > State is Over or higher",
  "Force inactive if Budget > State is Critical or higher",
  "Force inactive if Budget > State is Shutdown"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if Budget > State is Over or higher",
    "Force inactive if Budget > State is Critical or higher",
    "Force inactive if Budget > State is Shutdown"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > IAM > Group > Active > Last Modified

The number of days since the AWS IAM group
was last modified before it is considered inactive.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Group > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/groupActiveLastModified
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Group > Approved

Determine the action to take when an AWS IAM group is not approved based on AWS > IAM > Group > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/groupApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved",
  "Enforce: Delete unapproved if new"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > IAM > Group > Approved > Budget

The policy allows you to set groups to unapproved based on the current budget state, as reflected in AWS > Account > Budget > State

This policy will be evaluated by the Approved control. If an AWS IAM group is not matched by the approved list, it will be subject to the action specified in the AWS > IAM > Group > Approved policy.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/groupApprovedBudget
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Unapproved if Budget > State is Over or higher",
  "Unapproved if Budget > State is Critical or higher",
  "Unapproved if Budget > State is Shutdown"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Unapproved if Budget > State is Over or higher",
    "Unapproved if Budget > State is Critical or higher",
    "Unapproved if Budget > State is Shutdown"
  ],
  "example": [
    "Unapproved if Budget > State is Shutdown"
  ],
  "default": "Skip"
}

AWS > IAM > Group > Approved > Custom

Determine whether the AWS IAM group is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS IAM group is not approved, it will be subject to the action specified in the AWS > IAM > Group > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI
tmod:@turbot/aws-iam#/policy/types/groupApprovedCustom
Category
Parent
Targets
Schema
{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > IAM > Group > Approved > Turbot

Determine whether IAM Policies that are defined and configured by Guardrails (for example, from the Permissions stack or the Service Roles stack) will always be approved.

URI
tmod:@turbot/aws-iam#/policy/types/groupApprovedTurbot
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Force Approved for Turbot Group"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Force Approved for Turbot Group"
  ],
  "default": "Force Approved for Turbot Group"
}

AWS > IAM > Group > Approved > Usage

Determine whether the AWS IAM group is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS IAM group is not approved, it will be subject to the action specified in the AWS > IAM > Group > Approved policy.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/groupApprovedUsage
Category
Parent
Targets
Valid Value
[
  "Not approved",
  "Approved",
  "Approved if AWS > IAM > Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > IAM > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > IAM > Enabled"
}

AWS > IAM > Group > CMDB

Configure whether to record and synchronize details for the AWS IAM group into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/groupCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Group > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI
tmod:@turbot/aws-iam#/policy/types/groupConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > Group > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/groupConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > Group > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource

URI
tmod:@turbot/aws-iam#/policy/types/groupConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > Group > Group Policy Attachments > Active

Check if the AWS IAM Grouppolicyattachment is active based on AWS > IAM > Grouppolicyattachment > Active > * policies.

URI
tmod:@turbot/aws-iam#/policy/types/groupPolicyAttachmentActive
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > IAM > Group > Group Policy Attachments > Active > Last Modified

Check if AWS groupPolicyAttachment is active based on when it was last modified.

URI
tmod:@turbot/aws-iam#/policy/types/groupPolicyAttachmentActiveLastModified
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Group > Group Policy Attachments > CMDB

Configure whether to record and synchronize details for the AWS IAM group policy attachments into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/groupPolicyAttachmentCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Group > Group Policy Attachments > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI
tmod:@turbot/aws-iam#/policy/types/groupPolicyAttachmentConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > Group > Group Policy Attachments > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/groupPolicyAttachmentConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > Group > Group Policy Attachments > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource

URI
tmod:@turbot/aws-iam#/policy/types/groupPolicyAttachmentConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > Group > Inline Policy > Approved

Determine the action to take when an AWS IAM group inline policy is not approved based on AWS > IAM > Group > Inline Policy > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/groupInlinePolicyApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved",
  "Enforce: Delete unapproved if new"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > IAM > Group > Inline Policy > Approved > Custom

Determine whether the AWS IAM group inline policy is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS IAM group inline policy is not approved, it will be subject to the action specified in the AWS > IAM > Group > Inline Policy > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI
tmod:@turbot/aws-iam#/policy/types/groupInlinePolicyApprovedCustom
Category
Parent
Targets
Schema
{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > IAM > Group > Inline Policy > Approved > Usage

Determine whether the AWS IAM group inline policy is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS IAM group inline policy is not approved, it will be subject to the action specified in the AWS > IAM > Group > Inline Policy > Approved policy.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/groupInlinePolicyApprovedUsage
Category
Parent
Targets
Valid Value
[
  "Not approved",
  "Approved",
  "Approved if AWS > IAM > Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > IAM > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > IAM > Enabled"
}

AWS > IAM > Group > Inline Policy > CMDB

Configure whether to record and synchronize details for the AWS IAM group inline policy into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/groupInlinePolicyCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Group > Inline Policy > Statements

URI
tmod:@turbot/aws-iam#/policy/types/groupInlinePolicyStatements
Category
Parent
Targets

AWS > IAM > Group > Inline Policy > Statements > Approved

Configure IAM Policy Statements checking. This policy defines whether to verify the
policy statements are approved, as well as the subsequent action to take on unapproved
statements.

Rules for all Approved policies will be compiled in Approved > Compiled Rules
and then evaluated. If set to "Enforce: Delete unapproved", any unapproved statements
will be removed from the policy.

URI
tmod:@turbot/aws-iam#/policy/types/groupInlinePolicyStatementsApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete Unapproved"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete Unapproved"
  ],
  "default": "Skip"
}

AWS > IAM > Group > Inline Policy > Statements > Approved > Administrator Access

If set to "Disabled", IAM Policy statements that allow any action ('') on any resource ('') will be unapproved.

URI
tmod:@turbot/aws-iam#/policy/types/groupInlinePolicyStatementsApprovedAdminAccess
Category
Parent
Targets
Valid Value
[
  "Enabled: Allow Administrator Access ('*:*') policies",
  "Disabled: Disallow Administrator Access ('*:*') policies"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled: Allow Administrator Access ('*:*') policies",
    "Disabled: Disallow Administrator Access ('*:*') policies"
  ],
  "default": "Enabled: Allow Administrator Access ('*:*') policies"
}

AWS > IAM > Group > Inline Policy > Statements > Approved > Compiled Rules

A read-only Object Control List (OCL) to approved or reject policy statements for an IAM policy. This policy is generated by Guardrails based on the "Approved > *" policies.

URI
tmod:@turbot/aws-iam#/policy/types/groupInlinePolicyStatementsApprovedCompiledRules
Category
Parent
Targets
Schema
{
  "type": "string"
}

AWS > IAM > Group > Inline Policy > Statements > Approved > Rules

An Object Control List (OCL) with a list of filter rules to approve or reject IAM policy statements. Note that the Approved control does not operate directly from this policy, but from the Approved > Compiled Rules. The rules are processed in order, and any built-in Guardrails rules will appear first in the list of compiled rules.
This is the last statement, so all unmatched items will be (approved/rejected) by this statement.

Note: Removing APPROVE * will reject all the unmatched rules.

URI
tmod:@turbot/aws-iam#/policy/types/groupInlinePolicyStatementsApprovedRules
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "# Approve(APPROVE *) / Reject(REJECT *) unmatched rules.\nAPPROVE *",
  "x-schema-form": {
    "type": "textarea"
  }
}

AWS > IAM > Group > Policy Attachments

URI
tmod:@turbot/aws-iam#/policy/types/groupPolicyAttached
Category
Parent
Targets

AWS > IAM > Group > Policy Attachments > Approved

Configure AWS IAM group policy attachments Approved checking. This policy
defines whether to verify the IAM group attached policies are approved
(per Approved > Compiled Rules), as well as the subsequent action to
take on unapproved items.
If set to "Enforce: Delete unapproved", any unapproved attached policy
will be removed.

URI
tmod:@turbot/aws-iam#/policy/types/groupPolicyAttachmentsApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > IAM > Group > Policy Attachments > Approved > Compiled Rules

A read-only Object Control List (OCL) to add or
remove IAM Policy from a IAM group.
This policy is generated by Turbot.

URI
tmod:@turbot/aws-iam#/policy/types/groupPolicyAttachmentsApprovedCompiledRules
Category
Parent
Targets
Schema
{
  "type": "string"
}

AWS > IAM > Group > Policy Attachments > Approved > Rules

An Object Control List (OCL) with a list of filter rules
to approve or reject policies.
Note that the Approved control does not operate directly from this policy,
but from the Approved > Compiled Rules. The rules are processed in order,
and any built-in Guardrails rules will appear first in the list of compiled rules.

URI
tmod:@turbot/aws-iam#/policy/types/groupPolicyAttachmentsApprovedRules
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "# Approve rules\nAPPROVE *",
  "x-schema-form": {
    "type": "textarea"
  }
}

AWS > IAM > Group > Policy Attachments > Required

Configure whether required policies should be attached to a group.
If set to Enforce, policies in Required > Items will be attached to the group.

URI
tmod:@turbot/aws-iam#/policy/types/groupPolicyRequired
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Required > Items",
  "Enforce: Required > Items"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Required > Items",
    "Enforce: Required > Items"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > IAM > Group > Policy Attachments > Required > Compiled Items

A list of IAM policies that must be attached to a group.

This is a read-only policy that is generated by Turbot

URI
tmod:@turbot/aws-iam#/policy/types/groupPolicyRequiredCompiledItems
Category
Parent
Targets
Schema
{
  "type": "array"
}

AWS > IAM > Group > Policy Attachments > Required > Items

A list of IAM policies that must be attached to a group.

URI
tmod:@turbot/aws-iam#/policy/types/groupPolicyRequiredItems
Category
Parent
Targets
Schema
{
  "type": "array",
  "items": {
    "type": "string",
    "minLength": 1,
    "maxLength": 128,
    "pattern": "^[A-Za-z0-9_+=,.@-]+$"
  },
  "default": []
}

AWS > IAM > Group > Usage

Configure the number of AWS IAM groups that can be used for this account and the current consumption against the limit.

You can configure the behavior of the control with this AWS > IAM > Group > Usage policy.

URI
tmod:@turbot/aws-iam#/policy/types/groupUsage
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > IAM > Group > Usage > Limit

Maximum number of items that can be created for this account.

URI
tmod:@turbot/aws-iam#/policy/types/groupUsageLimit
Category
Parent
Targets
Schema
{
  "type": "integer",
  "minimum": 0,
  "default": 300
}

AWS > IAM > Instance Profile > CMDB

Configure whether to record and synchronize details for the AWS IAM instance profile into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/instanceProfileCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Instance Profile > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI
tmod:@turbot/aws-iam#/policy/types/instanceProfileConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > Instance Profile > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/instanceProfileConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > Instance Profile > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource

URI
tmod:@turbot/aws-iam#/policy/types/instanceProfileConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > Login User Names

AWS IAM user login names

URI
tmod:@turbot/aws-iam#/policy/types/loginUserNames
Category
Parent
Targets
Default Template Input
"{\n  profile{\n    profileId\n  }\n}\n"
Default Template
"{% if $.profile.profileId %}- &#39;{{ $.profile.profileId }}&#39;{% else %} [] {% endif %}"
Schema
{
  "type": "array"
}

AWS > IAM > MFA Virtual > Active

Check if the AWS IAM Mfavirtual is active based on AWS > IAM > Mfavirtual > Active > * policies.

URI
tmod:@turbot/aws-iam#/policy/types/mfaVirtualActive
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > IAM > MFA Virtual > Active > Last Modified

Check if AWS mfaVirtual is active based on when it was last modified.

URI
tmod:@turbot/aws-iam#/policy/types/mfaVirtualActiveLastModified
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > MFA Virtual > CMDB

Configure whether to record and synchronize details for the AWS IAM Multi Factor Authentication(MFA) Virtual into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/mfaVirtualCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > OpenID Connect > Active

Determine the action to take when an AWS IAM openid connect, based on the AWS > IAM > OpenID Connect > Active > * policies.

The control determines whether the resource is in active use, and if not,
has the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > OpenID Connect > Active > *), raises an alarm, and takes the defined enforcement
action. Each Active sub-policy can calculate a status of active, inactive
or skipped. Generally, if the resource appears to be Active for any reason
it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered
Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/openIdConnectActive
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > IAM > OpenID Connect > Active > Age

The age after which the AWS IAM openid connect
is no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > OpenID Connect > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/openIdConnectActiveAge
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > OpenID Connect > Active > Last Modified

The number of days since the AWS IAM openid connect
was last modified before it is considered inactive.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > OpenID Connect > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/openIdConnectActiveLastModified
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > OpenID Connect > Approved

Determine the action to take when an AWS IAM openid connect is not approved based on AWS > IAM > OpenID Connect > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/openIdConnectApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > IAM > OpenID Connect > Approved > Custom

Determine whether the AWS IAM openid connect is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS IAM openid connect is not approved, it will be subject to the action specified in the AWS > IAM > OpenID Connect > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI
tmod:@turbot/aws-iam#/policy/types/openIdConnectApprovedCustom
Category
Parent
Targets
Schema
{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > IAM > OpenID Connect > Approved > Usage

Determine whether the AWS IAM openid connect is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS IAM openid connect is not approved, it will be subject to the action specified in the AWS > IAM > OpenID Connect > Approved policy.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/openIdConnectApprovedUsage
Category
Parent
Targets
Valid Value
[
  "Not approved",
  "Approved",
  "Approved if AWS > IAM > Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > IAM > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > IAM > Enabled"
}

AWS > IAM > OpenID Connect > CMDB

Configure whether to record and synchronize details for the AWS IAM openid connect into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/openIdConnectCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > OpenID Connect > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it.

URI
tmod:@turbot/aws-iam#/policy/types/openIdConnectConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > OpenID Connect > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/openIdConnectConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > OpenID Connect > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource.

URI
tmod:@turbot/aws-iam#/policy/types/openIdConnectConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > OpenID Connect > Tags

Determine the action to take when an AWS IAM openid connect tags are not updated based on the AWS > IAM > OpenID Connect > Tags > * policies.

The control ensure AWS IAM openid connect tags include tags defined in AWS > IAM > OpenID Connect > Tags > Template.

Tags not defined in OpenID Connect Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI
tmod:@turbot/aws-iam#/policy/types/openIdConnectTags
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > IAM > OpenID Connect > Tags > Template

The template is used to generate the keys and values for AWS IAM openid connect.

Tags not defined in OpenID Connect Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI
tmod:@turbot/aws-iam#/policy/types/openIdConnectTagsTemplate
Category
Parent
Targets
Default Template Input
[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-iam#/policy/types/iamTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]
Default Template
"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"
Schema

AWS > IAM > OpenID Connect > Usage

Configure the number of AWS IAM openid connects that can be used for this account and the current consumption against the limit.

You can configure the behavior of the control with this AWS > IAM > OpenID Connect > Usage policy.

URI
tmod:@turbot/aws-iam#/policy/types/openIdConnectUsage
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > IAM > OpenID Connect > Usage > Limit

Maximum number of items that can be created for this account.

URI
tmod:@turbot/aws-iam#/policy/types/openIdConnectUsageLimit
Category
Parent
Targets
Schema
{
  "type": "integer",
  "minimum": 0,
  "default": 100
}

AWS > IAM > Permissions

Configure whether permissions policies are in effect for AWS IAM. This setting does
not affect account level permissions (AWS/Admin, AWS/Owner, etc).

Note: The behavior of this policy depends on the value of AWS > Permissions.

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissions
Category
Parent
Targets
Valid Value
[
  "Enabled",
  "Disabled",
  "Enabled if AWS > IAM > Enabled & AWS > IAM > API Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled",
    "Enabled if AWS > IAM > Enabled & AWS > IAM > API Enabled"
  ],
  "example": [
    "Enabled"
  ],
  "default": "Enabled if AWS > IAM > Enabled & AWS > IAM > API Enabled"
}

AWS > IAM > Permissions > Levels

Define the permissions levels that can be used to grant access to an AWS account.
Permissions levels defined will appear in the UI to assign access to Guardrails users.
This policy provides a default for Permissions > Levels in each service,
however you can explicitly override the setting for each service if desired

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissionsLevels
Category
Parent
Targets
Default Template Input
[
  "{\n  item: account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  availableLevels: policyValues(filter:\"policyTypeLevel:self resourceId:{{ $.item.turbot.id }} policyTypeId:'tmod:@turbot/aws-iam#/policy/types/permissionsLevelsDefault'\") {\n    items {\n      value\n    }\n  }\n}\n"
]
Default Template
"{% if $.availableLevels.items[0].value | length == 0 %} [] {% endif %}{% for item in $.availableLevels.items[0].value %}- {{ item }}&#92;n{% endfor %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string",
    "enum": [
      "Metadata",
      "ReadOnly",
      "Operator",
      "Admin",
      "Owner"
    ]
  }
}

AWS > IAM > Permissions > Levels > Modifiers

A map of AWS API to Guardrails Permission Level used to customize Guardrails' standard permissions.
You can add, remove or redefine the mapping of AWS API operations to Guardrails permissions levels here.

Note: Modifiers are cumulative - if you add a permission to the Metadata level, it is also
added to ReadOnly, Operator and Admin. Modifier policies set here apply ONLY to the AWS level"

<br />example:<br /> - &quot;glacier:createvault&quot;: admin<br /> - &quot;glacier:ListVaults&quot;: metadata<br /> - &quot;s3:DeleteBucket&quot;: none<br />

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissionsLevelsModifiers
Category
Parent
Targets
Schema

AWS > IAM > Permissions > Levels > Service User Access Key Administration

Determines which Guardrails permissions level can manage Service User Access Key Administration.

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissionsLevelsServiceUserAccessKeyAdministration
Category
Parent
Targets
Valid Value
[
  "None",
  "Owner"
]
Schema
{
  "type": "string",
  "enum": [
    "None",
    "Owner"
  ],
  "example": [
    "None"
  ],
  "default": "None"
}

AWS > IAM > Permissions > Levels > Service User Administration

Determines which Guardrails permissions level can manage Service User Administration.

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissionsLevelsServiceUserAdministration
Category
Parent
Targets
Valid Value
[
  "None",
  "Owner"
]
Schema
{
  "type": "string",
  "enum": [
    "None",
    "Owner"
  ],
  "example": [
    "None"
  ],
  "default": "None"
}

AWS > IAM > Permissions > Levels > Service User Password Administration

Determines which Guardrails permissions level can manage Service User Password Administration.

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissionsLevelsServiceUserPasswordAdministration
Category
Parent
Targets
Valid Value
[
  "None",
  "Owner"
]
Schema
{
  "type": "string",
  "enum": [
    "None",
    "Owner"
  ],
  "example": [
    "None"
  ],
  "default": "None"
}

AWS > IAM > Permissions > Lockdown

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissionsLockdown
Category
Parent
Targets

AWS > IAM > Permissions > Lockdown > API Boundary

Configure whether the AWS IAM API is enabled for all
users and roles in turbot-managed boundary policies.

Note: Disabling the service disables the API for ALL users
and roles, and Guardrails will have no access to the API.

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissionsLockdownApiBoundary
Category
Parent
Targets
Valid Value
[
  "Enabled if AWS > IAM > API Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled if AWS > IAM > API Enabled"
  ],
  "example": [
    "Enabled if AWS > IAM > API Enabled"
  ],
  "default": "Enabled if AWS > IAM > API Enabled"
}

AWS > IAM > Policy > Active

Determine the action to take when an AWS IAM policy, based on the AWS > IAM > Policy > Active > * policies.

The control determines whether the resource is in active use, and if not,
has the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Policy > Active > *), raises an alarm, and takes the defined enforcement
action. Each Active sub-policy can calculate a status of active, inactive
or skipped. Generally, if the resource appears to be Active for any reason
it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered
Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyActive
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > IAM > Policy > Active > Age

The age after which the AWS IAM policy
is no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Policy > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyActiveAge
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Policy > Active > Last Modified

The number of days since the AWS IAM policy
was last modified before it is considered inactive.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Policy > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyActiveLastModified
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Policy > Approved

Determine the action to take when an AWS IAM policy is not approved based on AWS > IAM > Policy > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > IAM > Policy > Approved > Custom

Determine whether the AWS IAM policy is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS IAM policy is not approved, it will be subject to the action specified in the AWS > IAM > Policy > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyApprovedCustom
Category
Parent
Targets
Schema
{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > IAM > Policy > Approved > Turbot

Determine whether IAM Policies that are defined and configured by Guardrails (for example, from the Permissions stack or the Service Roles stack) will always be approved.

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyApprovedTurbot
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Force Approved for Turbot Policies"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Force Approved for Turbot Policies"
  ],
  "default": "Force Approved for Turbot Policies"
}

AWS > IAM > Policy > Approved > Usage

Determine whether the AWS IAM policy is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS IAM policy is not approved, it will be subject to the action specified in the AWS > IAM > Policy > Approved policy.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyApprovedUsage
Category
Parent
Targets
Valid Value
[
  "Not approved",
  "Approved",
  "Approved if AWS > IAM > Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > IAM > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > IAM > Enabled"
}

AWS > IAM > Policy > CMDB

Configure whether to record and synchronize details for the AWS IAM policy into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Policy > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > Policy > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > Policy > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > Policy > Statements

URI
tmod:@turbot/aws-iam#/policy/types/statements
Category
Parent
Targets

AWS > IAM > Policy > Statements > Approved

Configure IAM Policy Statements checking. This policy defines whether to verify the
policy statements are approved, as well as the subsequent action to take on unapproved
statements.

Rules for all Approved policies will be compiled in Approved > Compiled Rules
and then evaluated. If set to "Enforce: Delete unapproved", any unapproved statements
will be removed from the policy.

URI
tmod:@turbot/aws-iam#/policy/types/statementsApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete Unapproved"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete Unapproved"
  ],
  "default": "Skip"
}

AWS > IAM > Policy > Statements > Approved > Administrator Access

If set to "Disabled", IAM Policy statements that allow any action ('') on any resource ('') will be unapproved.

URI
tmod:@turbot/aws-iam#/policy/types/statementsApprovedAdminAccess
Category
Parent
Targets
Valid Value
[
  "Enabled: Allow Administrator Access ('*:*') policies",
  "Disabled: Disallow Administrator Access ('*:*') policies"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled: Allow Administrator Access ('*:*') policies",
    "Disabled: Disallow Administrator Access ('*:*') policies"
  ],
  "default": "Enabled: Allow Administrator Access ('*:*') policies"
}

AWS > IAM > Policy > Statements > Approved > Compiled Rules

A read-only Object Control List (OCL) to approved or reject policy statements for an IAM policy. This policy is generated by Turbot based on the "Approved > *" policies.

URI
tmod:@turbot/aws-iam#/policy/types/statementsApprovedCompiledRules
Category
Parent
Targets
Schema
{
  "type": "string"
}

AWS > IAM > Policy > Statements > Approved > Rules

An Object Control List (OCL) with a list of filter rules to approve or reject IAM policy statements. Note that the Approved control does not operate directly from this policy, but from the Approved > Compiled Rules. The rules are processed in order, and any built-in Guardrails rules will appear first in the list of compiled rules.
This is the last statement, so all unmatched items will be (approved/rejected) by this statement.

Note: Removing APPROVE * will reject all the unmatched rules.

URI
tmod:@turbot/aws-iam#/policy/types/statementsApprovedRules
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "# Approve unmatched rules\nAPPROVE *",
  "x-schema-form": {
    "type": "textarea"
  }
}

AWS > IAM > Policy > Statements > Approved > Turbot

If Enabled, All IAM Policy statements for policies that are defined and configured by Guardrails (for example, from the permissions stack of the Service Roles stack) will be approved.

URI
tmod:@turbot/aws-iam#/policy/types/statementsApprovedTurbot
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Force Approved for Turbot Policies"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Force Approved for Turbot Policies"
  ],
  "default": "Force Approved for Turbot Policies"
}

AWS > IAM > Role > Active

Determine the action to take when an AWS IAM role, based on the AWS > IAM > Role > Active > * policies.

The control determines whether the resource is in active use, and if not,
has the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Role > Active > *), raises an alarm, and takes the defined enforcement
action. Each Active sub-policy can calculate a status of active, inactive
or skipped. Generally, if the resource appears to be Active for any reason
it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered
Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/roleActive
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning",
  "Enforce: Quarantine inactive with 1 day warning",
  "Enforce: Quarantine inactive with 3 days warning",
  "Enforce: Quarantine inactive with 7 days warning",
  "Enforce: Quarantine inactive with 14 days warning",
  "Enforce: Quarantine inactive with 30 days warning",
  "Enforce: Quarantine inactive with 60 days warning",
  "Enforce: Quarantine inactive with 90 days warning",
  "Enforce: Quarantine inactive with 180 days warning",
  "Enforce: Quarantine inactive with 365 days warning"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning",
    "Enforce: Quarantine inactive with 1 day warning",
    "Enforce: Quarantine inactive with 3 days warning",
    "Enforce: Quarantine inactive with 7 days warning",
    "Enforce: Quarantine inactive with 14 days warning",
    "Enforce: Quarantine inactive with 30 days warning",
    "Enforce: Quarantine inactive with 60 days warning",
    "Enforce: Quarantine inactive with 90 days warning",
    "Enforce: Quarantine inactive with 180 days warning",
    "Enforce: Quarantine inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Active > Age

The age after which the AWS IAM role
is no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Role > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/roleActiveAge
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Active > Last Modified

The number of days since the AWS IAM role
was last modified before it is considered inactive.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Role > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/roleActiveLastModified
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Active > Quarantine Policy Name

The quarantine policy name which will be used for the inline policy to be attached to the AWS > IAM > Role.

Quarantine Inline Policy:
<br />{<br /> &quot;Version&quot;: &quot;2012-10-17&quot;,<br /> &quot;Statement&quot;: [<br /> {<br /> &quot;Sid&quot;: &quot;DenyAll&quot;,<br /> &quot;Effect&quot;: &quot;Deny&quot;,<br /> &quot;Action&quot;: &quot;*&quot;,<br /> &quot;Resource&quot;: &quot;*&quot;<br /> }<br /> ]<br />}<br />

URI
tmod:@turbot/aws-iam#/policy/types/roleActiveQuarantinePolicyName
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "quarantine_inline_policy"
}

AWS > IAM > Role > Active > Recently Used

The number of days since the AWS IAM role was last used before it is considered inactive.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Role > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.
See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/roleActiveRecentlyUsed
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if recently used <= 1 day",
  "Active if recently used <= 3 days",
  "Active if recently used <= 7 days",
  "Active if recently used <= 14 days",
  "Active if recently used <= 30 days",
  "Active if recently used <= 60 days",
  "Active if recently used <= 90 days",
  "Active if recently used <= 180 days",
  "Active if recently used <= 365 days",
  "Force active if recently used <= 1 day",
  "Force active if recently used <= 3 days",
  "Force active if recently used <= 7 days",
  "Force active if recently used <= 14 days",
  "Force active if recently used <= 30 days",
  "Force active if recently used <= 60 days",
  "Force active if recently used <= 90 days",
  "Force active if recently used <= 180 days",
  "Force active if recently used <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if recently used <= 1 day",
    "Active if recently used <= 3 days",
    "Active if recently used <= 7 days",
    "Active if recently used <= 14 days",
    "Active if recently used <= 30 days",
    "Active if recently used <= 60 days",
    "Active if recently used <= 90 days",
    "Active if recently used <= 180 days",
    "Active if recently used <= 365 days",
    "Force active if recently used <= 1 day",
    "Force active if recently used <= 3 days",
    "Force active if recently used <= 7 days",
    "Force active if recently used <= 14 days",
    "Force active if recently used <= 30 days",
    "Force active if recently used <= 60 days",
    "Force active if recently used <= 90 days",
    "Force active if recently used <= 180 days",
    "Force active if recently used <= 365 days"
  ],
  "example": [
    "Active if recently used <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Approved

Determine the action to take when an AWS IAM role is not approved based on AWS > IAM > Role > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/roleApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved",
  "Enforce: Delete unapproved if new",
  "Enforce: Quarantine unapproved"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved",
    "Enforce: Delete unapproved if new",
    "Enforce: Quarantine unapproved"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Approved > Custom

Determine whether the AWS IAM role is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS IAM role is not approved, it will be subject to the action specified in the AWS > IAM > Role > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI
tmod:@turbot/aws-iam#/policy/types/roleApprovedCustom
Category
Parent
Targets
Schema
{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > IAM > Role > Approved > Quarantine Policy Name

The quarantine policy name which will be used for the inline policy to be attached to the AWS > IAM > Role.

Quarantine Inline Policy:
<br />{<br /> &quot;Version&quot;: &quot;2012-10-17&quot;,<br /> &quot;Statement&quot;: [<br /> {<br /> &quot;Sid&quot;: &quot;DenyAll&quot;,<br /> &quot;Effect&quot;: &quot;Deny&quot;,<br /> &quot;Action&quot;: &quot;*&quot;,<br /> &quot;Resource&quot;: &quot;*&quot;<br /> }<br /> ]<br />}<br />

URI
tmod:@turbot/aws-iam#/policy/types/roleApprovedQuarantinePolicyName
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "quarantine_inline_policy"
}

AWS > IAM > Role > Approved > Turbot

Determine whether IAM Policies that are defined and configured by Turbot (for example, from the Permissions stack or the Service Roles stack) will always be approved.

URI
tmod:@turbot/aws-iam#/policy/types/roleApprovedTurbot
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Force Approved for Turbot Role"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Force Approved for Turbot Role"
  ],
  "default": "Force Approved for Turbot Role"
}

AWS > IAM > Role > Approved > Usage

Determine whether the AWS IAM role is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS IAM role is not approved, it will be subject to the action specified in the AWS > IAM > Role > Approved policy.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/roleApprovedUsage
Category
Parent
Targets
Valid Value
[
  "Not approved",
  "Approved",
  "Approved if AWS > IAM > Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > IAM > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > IAM > Enabled"
}

AWS > IAM > Role > Boundary

Configure which boundary policy to apply to the IAM role .
This must be the name of an existing AWS IAM Boundary policy.
AWS Boundary Policies are used to enforce Turbot Guardrails for
enabling/disabling API Services and Regions.

If set to Check or Enforce per AWS > Turbot > Permissions,
the boundary will be enforced if Turbot > Permissions are enforced, checked
if Turbot > Permissions are checked, and skipped if Turbot Permissions
are none or skip

URI
tmod:@turbot/aws-iam#/policy/types/roleBoundary
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: No Boundary",
  "Check: Boundary > Policy",
  "Enforce: No Boundary",
  "Enforce: Boundary > Policy",
  "Check or Enforce per `AWS > Turbot > Permissions`"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: No Boundary",
    "Check: Boundary > Policy",
    "Enforce: No Boundary",
    "Enforce: Boundary > Policy",
    "Check or Enforce per `AWS > Turbot > Permissions`"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Boundary > Policy

Configure which boundary policy to apply to the IAM role.
This must be the name of an existing AWS IAM Boundary policy.
AWS Boundary Policies are used to enforce Turbot Guardrails for
enabling/disabling API Services and Regions.

URI
tmod:@turbot/aws-iam#/policy/types/roleBoundaryPolicy
Category
Parent
Targets
Default Template Input
"{\n  prefix: policy(uri:\"#/policy/types/turbotRoleNamePrefix\")\n}\n"
Default Template
"{{$.prefix}}boundary"
Schema

AWS > IAM > Role > CMDB

Configure whether to record and synchronize details for the AWS IAM role into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/roleCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Role > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI
tmod:@turbot/aws-iam#/policy/types/roleConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > Role > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/roleConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > Role > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource

URI
tmod:@turbot/aws-iam#/policy/types/roleConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > Role > Inline Policy > Approved

Determine the action to take when an AWS IAM role inline policy is not approved based on AWS > IAM > Role > Inline Policy > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/roleInlinePolicyApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved",
  "Enforce: Delete unapproved if new"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Inline Policy > Approved > Custom

Determine whether the AWS IAM role inline policy is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS IAM role inline policy is not approved, it will be subject to the action specified in the AWS > IAM > Role > Inline Policy > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI
tmod:@turbot/aws-iam#/policy/types/roleInlinePolicyApprovedCustom
Category
Parent
Targets
Schema
{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > IAM > Role > Inline Policy > Approved > Usage

Determine whether the AWS IAM role inline policy is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS IAM role inline policy is not approved, it will be subject to the action specified in the AWS > IAM > Role > Inline Policy > Approved policy.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/roleInlinePolicyApprovedUsage
Category
Parent
Targets
Valid Value
[
  "Not approved",
  "Approved",
  "Approved if AWS > IAM > Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > IAM > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > IAM > Enabled"
}

AWS > IAM > Role > Inline Policy > CMDB

Configure whether to record and synchronize details for the AWS IAM role inline policy into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/roleInlinePolicyCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Role > Inline Policy > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI
tmod:@turbot/aws-iam#/policy/types/roleInlinePolicyConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > Role > Inline Policy > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/roleInlinePolicyConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > Role > Inline Policy > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource

URI
tmod:@turbot/aws-iam#/policy/types/roleInlinePolicyConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > Role > Inline Policy > Statements

URI
tmod:@turbot/aws-iam#/policy/types/inlinePolicyStatements
Category
Parent
Targets

AWS > IAM > Role > Inline Policy > Statements > Approved

Configure IAM Policy Statements checking. This policy defines whether to verify the
policy statements are approved, as well as the subsequent action to take on unapproved
statements.
Rules for all Approved policies will be compiled in Approved > Compiled Rules
and then evaluated. If set to "Enforce: Delete unapproved", any unapproved statements
will be removed from the policy.

URI
tmod:@turbot/aws-iam#/policy/types/roleInlinePolicyStatementsApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete Unapproved"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete Unapproved"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Inline Policy > Statements > Approved > Administrator Access

If set to "Disabled", IAM Role Inline Policy statements that allow any action ('') on any resource ('') will be unapproved.

URI
tmod:@turbot/aws-iam#/policy/types/roleInlinePolicyStatementsApprovedAdminAccess
Category
Parent
Targets
Valid Value
[
  "Enabled: Allow Administrator Access ('*:*') policies",
  "Disabled: Disallow Administrator Access ('*:*') policies"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled: Allow Administrator Access ('*:*') policies",
    "Disabled: Disallow Administrator Access ('*:*') policies"
  ],
  "default": "Enabled: Allow Administrator Access ('*:*') policies"
}

AWS > IAM > Role > Inline Policy > Statements > Approved > Compiled Rules

A read-only Object Control List (OCL) to approved or reject inline policy statements for an IAM Role. This policy is generated by Guardrails based on the "Approved > *" policies.

URI
tmod:@turbot/aws-iam#/policy/types/roleInlinePolicyStatementsApprovedCompiledRules
Category
Parent
Targets
Schema
{
  "type": "string"
}

AWS > IAM > Role > Inline Policy > Statements > Approved > Rules

An Object Control List (OCL) with a list of filter rules to approve or reject IAM role inline policy statements. Note that the Approved control does not operate directly from this policy, but from the Approved > Compiled Rules. The rules are processed in order, and any built-in Guardrails rules will appear first in the list of compiled rules.
This is the last statement, so all unmatched items will be (approved/rejected) by this statement.

Note: Removing APPROVE * will reject all the unmatched rules.

URI
tmod:@turbot/aws-iam#/policy/types/roleInlinePolicyStatementsApprovedRules
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "# Approve(APPROVE *) / Reject(REJECT *) unmatched rules.\nAPPROVE *",
  "x-schema-form": {
    "type": "textarea"
  }
}

AWS > IAM > Role > Policy

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicy
Category
Parent
Targets

AWS > IAM > Role > Policy > Trusted Access

Take an action when AWS IAM role policy is not trusted based on the
AWS > IAM > Role > Policy > Trusted Access > * policies.

The Trusted Access control evaluates the role policy against the list of allowed
members in each of the Trusted Access sub-policies (Trusted Access > Accounts,
Trusted Access > Services etc.), this control raises an alarm and takes the
defined enforcement action.

The account that owns the role will always be trusted, even if its account ID is
not included in the Trusted Accounts policy.

If set to Enforce: Revoke untrusted access, access to non-trusted
members will be removed.

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyTrustedAccess
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Trusted Access",
  "Enforce: Revoke untrusted access"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Trusted Access",
    "Enforce: Revoke untrusted access"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Policy > Trusted Access > Accounts

List of AWS Account IDs that are trusted for cross-account access in the
AWS IAM role policy.

Note that Trusted Access > Accounts and Trusted Access &gt;<br />Organizations are evaluated independently. To have access, an AWS
principal must be allowed in Trusted Access > Accounts AND be a
member of an Organization that is allowed in Trusted Access &gt;<br />Organizations.

<br />example:<br /> - &quot;123456789012&quot;<br />
Note: Setting the policy to an Empty array will remove all accounts.

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyTrustedAccounts
Category
Parent
Targets
Default Template Input
"{\n  accounts: policy(uri: \"tmod:@turbot/aws-iam#/policy/types/iamPolicyTrustedAccounts\")\n}\n"
Default Template
"{% if $.accounts | length == 0 %}[]{% endif %}{% for item in $.accounts %}- &#39;{{ item }}&#39;&#92;n{% endfor %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string",
    "pattern": "(?:^\\d{12}$|^\\*$)"
  }
}

AWS > IAM > Role > Policy > Trusted Access > Identity Providers

List of Identity Providers that are trusted for cross-account access in the
AWS IAM role policy.

<br />example:<br /> - www.google.com<br /> - www.facebook.com<br />
Note: Setting the policy to an Empty array will remove all identity providers.

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyTrustedIdentityProviders
Category
Parent
Targets
Default Template Input
"{\n  identityProviders: policy(uri: \"tmod:@turbot/aws-iam#/policy/types/iamPolicyTrustedIdentityProviders\")\n}\n"
Default Template
"{% if $.identityProviders | length == 0 %}[]{% endif %}{% for item in $.identityProviders %}- &#39;{{ item }}&#39;&#92;n{% endfor %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > Role > Policy > Trusted Access > Organization Restrictions

List of AWS Organization IDs that are trusted for cross-account access in
the AWS IAM role policy, or '*' to skip the Organization Restriction.

Note that Trusted Access > Accounts and Trusted Access &gt;<br />Organizations are evaluated independently. To have access, an AWS
principal must be allowed in Trusted Access > Accounts AND be a
member of an Organization that is allowed in Trusted Access &gt;<br />Organizations.

Note: Trusted Access > Organization Restrictions are ONLY
applied to AWS principals. Services and Federated principals do
NOT contain the aws:PrincipalOrgId condition key, and thus
cannot be validated against the Organization.

<br />example:<br /> - &quot;o-333333333&quot;<br /> - &quot;o-c3a5y4wd52&quot;<br />

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyTrustedOrganizations
Category
Parent
Targets
Default Template Input
"{\n  organizations: policy(uri: \"tmod:@turbot/aws-iam#/policy/types/iamPolicyTrustedOrganizations\")\n}\n"
Default Template
"{% if $.organizations | length == 0 %}[]{% endif %}{% for item in $.organizations %}- &#39;{{ item }}&#39;&#92;n{% endfor %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string",
    "pattern": "(?:^o-[a-z0-9]{10,32}$|^\\*$)"
  }
}

AWS > IAM > Role > Policy > Trusted Access > Services

List of AWS Services that are trusted for access in the AWS IAM role policy.

<br />example:<br /> - sns.amazonaws.com<br /> - ec2.amazonaws.com<br />

Note: Setting the policy to an Empty array will remove all services.

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyTrustedServices
Category
Parent
Targets
Default Template Input
"{\n  services: policy(uri: \"tmod:@turbot/aws-iam#/policy/types/iamPolicyTrustedServices\")\n}\n"
Default Template
"{% if $.services | length == 0 %}[]{% endif %}{% for item in $.services %}- &#39;{{ item }}&#39;&#92;n{% endfor %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string",
    "pattern": "(?:^\\S*\\.amazonaws\\.com$|^\\*$)"
  }
}

AWS > IAM > Role > Policy Attachments

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyAttached
Category
Parent
Targets

AWS > IAM > Role > Policy Attachments > Approved

Configure AWS IAM role policy attachments Approved checking. This policy
defines whether to verify the IAM role attached policies are approved
(per Approved > Compiled Rules), as well as the subsequent action to
take on unapproved items.
If set to "Enforce: Delete unapproved", any unapproved attached policy
will be removed.

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyAttachmentsApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Policy Attachments > Approved > Compiled Rules

A read-only Object Control List (OCL) to add or
remove IAM Policy from a IAM role.
This policy is generated by Turbot.

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyAttachmentsApprovedCompiledRules
Category
Parent
Targets
Schema
{
  "type": "string"
}

AWS > IAM > Role > Policy Attachments > Approved > Rules

An Object Control List (OCL) with a list of filter rules
to approve or reject policies.
Note that the Approved control does not operate directly from this policy,
but from the Approved > Compiled Rules. The rules are processed in order,
and any built-in Guardrails rules will appear first in the list of compiled rules.

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyAttachmentsApprovedRules
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "# Approve rules\nAPPROVE *",
  "x-schema-form": {
    "type": "textarea"
  }
}

AWS > IAM > Role > Policy Attachments > Required

Configure whether required policies should be attached to a role.
If set to Enforce, policies in Required > Items will be attached to the role.

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyRequired
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Required > Items",
  "Enforce: Required > Items"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Required > Items",
    "Enforce: Required > Items"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Policy Attachments > Required > Compiled Items

A list of IAM policies that must be attached to a role.
This is a read-only policy that is generated by Turbot

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyRequiredCompiledItems
Category
Parent
Targets
Schema
{
  "type": "array"
}

AWS > IAM > Role > Policy Attachments > Required > Items

A list of IAM policies that must be attached to a role.

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyRequiredItems
Category
Parent
Targets
Schema
{
  "type": "array",
  "items": {
    "type": "string",
    "minLength": 1,
    "maxLength": 128,
    "pattern": "^[A-Za-z0-9_+=,.@-]+$"
  },
  "default": []
}

AWS > IAM > Role > Policy Attachments > Required > Turbot Lockdown

Configure whether Role has Guardrails Lockdown Policies attached.

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyRequiredLockdown
Category
Parent
Targets
Valid Value
[
  "Enabled",
  "Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled"
  ],
  "example": [
    "Enabled"
  ]
}

AWS > IAM > Role > Role Policy Attachments > Active

Check if the AWS IAM Rolepolicyattachment is active based on AWS > IAM > Rolepolicyattachment > Active > * policies.

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyAttachmentActive
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Role Policy Attachments > Active > Last Modified

Check if AWS rolePolicyAttachment is active based on when it was last modified.

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyAttachmentActiveLastModified
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Role Policy Attachments > CMDB

Configure whether to record and synchronize details for the AWS IAM role policy attachments into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyAttachmentCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Role > Role Policy Attachments > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyAttachmentConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > Role > Role Policy Attachments > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyAttachmentConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > Role > Role Policy Attachments > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource

URI
tmod:@turbot/aws-iam#/policy/types/rolePolicyAttachmentConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > Role > Tags

Determine the action to take when an AWS IAM role tags are not updated based on the AWS > IAM > Role > Tags > * policies.

The control ensure AWS IAM role tags include tags defined in AWS > IAM > Role > Tags > Template.

Tags not defined in Role Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI
tmod:@turbot/aws-iam#/policy/types/roleTags
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Tags > Template

The template is used to generate the keys and values for AWS IAM role.

Tags not defined in Role Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI
tmod:@turbot/aws-iam#/policy/types/roleTagsTemplate
Category
Parent
Targets
Default Template Input
[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-iam#/policy/types/iamTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]
Default Template
"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"
Schema

AWS > IAM > Role > Trust Relationship Statements

URI
tmod:@turbot/aws-iam#/policy/types/trustRelationshipStatements
Category
Parent
Targets

AWS > IAM > Role > Trust Relationship Statements > Approved

Configure IAM Role trust relationship policy statements checking. This policy defines whether
to verify the role trust relationship policy statements are approved, as well as the
subsequent action to take on unapproved statements. Rules for all Approved
policies will be compiled in Approved > Compiled Rules and then
evaluated.
If set to Enforce: Delete unapproved, any unapproved rules will be
revoked from the security group.

URI
tmod:@turbot/aws-iam#/policy/types/trustRelationshipStatementsApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Trust Relationship Statements > Approved > Compiled Rules

A read-only Object Control List (OCL) to approved or reject role trust policy statements.
This policy is generated by Turbot.

URI
tmod:@turbot/aws-iam#/policy/types/trustRelationshipStatementsApprovedCompiledRules
Category
Parent
Targets
Schema
{
  "type": "string"
}

AWS > IAM > Role > Trust Relationship Statements > Approved > Rules

An Object Control List (OCL) with a list of filter rules
to approve or reject role trust policy statements.
Note that the Approved control does not operate directly from this policy,
but from the Approved > Compiled Rules. The rules are processed in order,
and any built-in Guardrails rules will appear first in the list of compiled
rules.

URI
tmod:@turbot/aws-iam#/policy/types/trustRelationshipStatementsApprovedRules
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "# Approve unmatched rules\nAPPROVE *",
  "x-schema-form": {
    "type": "textarea"
  }
}

AWS > IAM > Role > Trust Relationship Statements > Approved > Trusted Accounts [Deprecated]

Defines the AWS Accounts that can be allowed to assume the role.
Examples:
- "arn:aws:iam::560741234067:root"
- 492552618977
- 123456789012

Note: This policy has been deprecated in v5.8.0 and will be removed in v6.0.0. It has been replaced by the AWS > IAM > Role > Policy > Trusted Access > Accounts policy.

URI
tmod:@turbot/aws-iam#/policy/types/trustRelationshipStatementsApprovedTrustedAwsAccounts
Category
Parent
Targets
Default Template Input
"{\n  account {\n    Id\n  }\n}\n"
Default Template
"- {{ $.account.Id }}"
Schema
{
  "type": "array",
  "items": {
    "anyOf": [
      {
        "type": "string",
        "pattern": "^arn:aws(-us-gov|-cn)?:iam::[0-9]{1,12}:[A-Za-z0-9_+=,.@-]{1,64}$"
      },
      {
        "type": "string",
        "pattern": "^cloudfront$"
      },
      {
        "type": "integer"
      },
      {
        "type": "string",
        "pattern": "^[0-9]{12}$",
        "tests": [
          {
            "description": "valid int - 123456789012",
            "input": 123456789012
          },
          {
            "description": "valid string - 123456789012",
            "input": "123456789012"
          },
          {
            "description": "valid - leading zeros",
            "input": "001234567890"
          },
          {
            "description": "invalid - contains char",
            "input": "a123456789012",
            "expected": false
          },
          {
            "description": "invalid - too short",
            "input": 12345678901,
            "expected": false
          },
          {
            "description": "invalid - too long",
            "input": 1234567890123,
            "expected": false
          }
        ],
        ".turbot": {
          "uri": "tmod:@turbot/aws#/definitions/accountId",
          "modUri": "tmod:@turbot/aws"
        }
      }
    ]
  }
}

AWS > IAM > Role > Trust Relationship Statements > Approved > Trusted Identity Providers [Deprecated]

Defines the Identity Providers that can be allowed to assume the role.
Examples:
- www.amazon.com
- arn:aws:iam::013122550996:saml-provider/idp1

Note: This policy has been deprecated in v5.8.0 and will be removed in v6.0.0. It has been replaced by the AWS > IAM > Role > Policy > Trusted Access > Identity Providers policy.

URI
tmod:@turbot/aws-iam#/policy/types/trustRelationshipStatementsApprovedTrustedIdentityProvider
Category
Parent
Targets
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  },
  "default": []
}

AWS > IAM > Role > Trust Relationship Statements > Approved > Trusted Services [Deprecated]

Defines the AWS Services that can be allowed to assume the role.
Examples:
- cloudtrail.amazonaws.com
- cloudwatch.amazonaws.com

Note: This policy has been deprecated in v5.8.0 and will be removed in v6.0.0. It has been replaced by the AWS > IAM > Role > Policy > Trusted Access > Services policy.

URI
tmod:@turbot/aws-iam#/policy/types/trustRelationshipStatementsApprovedTrustedAwsServices
Category
Parent
Targets
Schema
{
  "type": "array",
  "items": {
    "type": "string",
    "pattern": "(^\\S+\\.amazonaws\\.com$)"
  },
  "default": []
}

AWS > IAM > Role > Usage

Configure the number of AWS IAM roles that can be used for this account and the current consumption against the limit.

You can configure the behavior of the control with this AWS > IAM > Role > Usage policy.

URI
tmod:@turbot/aws-iam#/policy/types/roleUsage
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > IAM > Role > Usage > Limit

Maximum number of items that can be created for this account.

URI
tmod:@turbot/aws-iam#/policy/types/roleUsageLimit
Category
Parent
Targets
Schema
{
  "type": "integer",
  "minimum": 0,
  "default": 1000
}

AWS > IAM > Root > Approved

Determine the action to take when an AWS IAM root is not approved based on AWS > IAM > Root > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/rootApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > IAM > Root > Approved > Custom

Determine whether the AWS IAM root is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS IAM root is not approved, it will be subject to the action specified in the AWS > IAM > Root > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI
tmod:@turbot/aws-iam#/policy/types/rootApprovedCustom
Category
Parent
Targets
Schema
{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > IAM > Root > Approved > Usage

Determine whether the AWS IAM root is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS IAM root is not approved, it will be subject to the action specified in the AWS > IAM > Root > Approved policy.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/rootApprovedUsage
Category
Parent
Targets
Valid Value
[
  "Not approved",
  "Approved",
  "Approved if AWS > IAM > Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > IAM > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > IAM > Enabled"
}

AWS > IAM > Root > CMDB

Configure whether to record and synchronize details for the AWS IAM root account into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/rootCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Root > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI
tmod:@turbot/aws-iam#/policy/types/rootConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > Root > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/rootConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > Root > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource

URI
tmod:@turbot/aws-iam#/policy/types/rootConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > Server Certificate > Active

Determine the action to take when an AWS IAM server certificate, based on the AWS > IAM > Server Certificate > Active > * policies.

The control determines whether the resource is in active use, and if not,
has the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Server Certificate > Active > *), raises an alarm, and takes the defined enforcement
action. Each Active sub-policy can calculate a status of active, inactive
or skipped. Generally, if the resource appears to be Active for any reason
it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered
Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/serverCertificateActive
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > IAM > Server Certificate > Active > Age

The age after which the AWS IAM server certificate
is no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Server Certificate > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/serverCertificateActiveAge
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Server Certificate > Active > Last Modified

The number of days since the AWS IAM server certificate
was last modified before it is considered inactive.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > Server Certificate > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/serverCertificateActiveLastModified
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > Server Certificate > Approved

Determine the action to take when an AWS IAM server certificate is not approved based on AWS > IAM > Server Certificate > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/serverCertificateApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > IAM > Server Certificate > Approved > Custom

Determine whether the AWS IAM server certificate is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS IAM server certificate is not approved, it will be subject to the action specified in the AWS > IAM > Server Certificate > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI
tmod:@turbot/aws-iam#/policy/types/serverCertificateApprovedCustom
Category
Parent
Targets
Schema
{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > IAM > Server Certificate > Approved > Usage

Determine whether the AWS IAM server certificate is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS IAM server certificate is not approved, it will be subject to the action specified in the AWS > IAM > Server Certificate > Approved policy.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/serverCertificateApprovedUsage
Category
Parent
Targets
Valid Value
[
  "Not approved",
  "Approved",
  "Approved if AWS > IAM > Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > IAM > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > IAM > Enabled"
}

AWS > IAM > Server Certificate > CMDB

Configure whether to record and synchronize details for the AWS IAM server certificates into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/serverCertificateCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > Server Certificate > Tags

Determine the action to take when an AWS IAM server certificate tags are not updated based on the AWS > IAM > Server Certificate > Tags > * policies.

The control ensure AWS IAM server certificate tags include tags defined in AWS > IAM > Server Certificate > Tags > Template.

Tags not defined in Server Certificate Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI
tmod:@turbot/aws-iam#/policy/types/serverCertificateTags
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > IAM > Server Certificate > Tags > Template

The template is used to generate the keys and values for AWS IAM server certificate.

Tags not defined in Server Certificate Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI
tmod:@turbot/aws-iam#/policy/types/serverCertificateTagsTemplate
Category
Parent
Targets
Default Template Input
[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-iam#/policy/types/iamTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]
Default Template
"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"
Schema

AWS > IAM > Server Certificate > Usage

Configure the number of AWS IAM server certificates that can be used for this account and the current consumption against the limit.

You can configure the behavior of the control with this AWS > IAM > Server Certificate > Usage policy.

URI
tmod:@turbot/aws-iam#/policy/types/serverCertificateUsage
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > IAM > Server Certificate > Usage > Limit

Maximum number of items that can be created for this account.

URI
tmod:@turbot/aws-iam#/policy/types/serverCertificateUsageLimit
Category
Parent
Targets
Schema
{
  "type": "integer",
  "minimum": 0,
  "default": 20
}

AWS > IAM > Stack

Configure a custom stack on AWS, per the custom Stack > Source.

A Guardrails Stack is a set of resources configured by Guardrails, as specified
via Terraform source. Stacks are responsible for the creation and deletion
of multiple resources. Once created, stack resources are responsible for
configuring themselves from the stack source via their Configured control.

URI
tmod:@turbot/aws-iam#/policy/types/iamStack
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Configured",
  "Enforce: Configured"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Configured",
    "Enforce: Configured"
  ],
  "default": "Skip"
}

AWS > IAM > Stack > Secret Variables

Terraform secret variables in Terraform HCL that will be used as
inputs to the stack as a .tfvars file.

A Guardrails Stack is a set of resources configured by Guardrails,
as specified via Terraform source. Stacks are responsible
for the creation and deletion of multiple resources. Once created,
stack resources are responsible for configuring themselves from
the stack source via their Configured control.

URI
tmod:@turbot/aws-iam#/policy/types/iamStackSecretVariables
Category
Parent
Targets
Schema
{
  "type": "string",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > Stack > Source

The Terraform HCL source used to configure this stack.

A Guardrails Stack is a set of resources configured by Guardrails, as specified
via Terraform source. Stacks are responsible for the creation and deletion
of multiple resources. Once created, stack resources are responsible for
configuring themselves from the stack source via their Configured control.

URI
tmod:@turbot/aws-iam#/policy/types/iamStackSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > Stack > Terraform Version

The Version of Terraform to use for this stack.
Specify an npm-style semver string to
determine which version of the Terraform container
Guardrails will use to run this stack.

A Guardrails Stack is a set of resources configured by Guardrails,
as specified via Terraform source. Stacks are responsible
for the creation and deletion of multiple resources. Once created,
stack resources are responsible for configuring themselves from
the stack source via their Configured control.

URI
tmod:@turbot/aws-iam#/policy/types/iamStackTerraformVersion
Category
Parent
Targets
Default Template Input
"{\n  terraformVersion: policy(uri:\"tmod:@turbot/turbot#/policy/types/stackTerraformVersion\")\n}\n"
Default Template
"{% if $.terraformVersion %}&quot;{{$.terraformVersion}}&quot;{% else %}&quot;&quot;{% endif %}"
Schema
{
  "type": "string"
}

AWS > IAM > Stack > Variables

Terraform variables in Terraform HCL that will be used as
inputs to the stack as a .tfvars file.

A Guardrails Stack is a set of resources configured by Guardrails,
as specified via Terraform source. Stacks are responsible
for the creation and deletion of multiple resources. Once created,
stack resources are responsible for configuring themselves from
the stack source via their Configured control.

URI
tmod:@turbot/aws-iam#/policy/types/iamStackVariables
Category
Parent
Targets
Schema
{
  "type": "string",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > Tags Template [Default]

A template used to generate the keys and values for AWS IAM resources.

By default, all IAM resource Tags > Template policies will use this value.

URI
tmod:@turbot/aws-iam#/policy/types/iamTagsTemplate
Category
Parent
Targets
Default Template Input
"{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws#/policy/types/defaultTagsTemplate\") {\n    value\n  }\n}\n"
Default Template
"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"
Schema

AWS > IAM > Trusted Accounts [Default]

List of AWS Accounts that are trusted for access in the AWS IAM policy.

This policy is used by the Trusted Access
control to determine which members of type "account" are allowed
to be granted access. You may use the '*' and '?' wildcard characters.

<br />example:<br /> - &quot;013122550996&quot;<br /> - &quot;560741234067&quot;<br />

Note: Setting the policy to Empty array will remove all accounts.

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyTrustedAccounts
Category
Parent
Targets
Default Template Input
"{\n  trustedAccounts: policyValue(uri:\"tmod:@turbot/aws#/policy/types/trustedAccounts\") {\n    value\n  }\n}\n"
Default Template
"{% if $.trustedAccounts.value | length == 0 %}[]{% else %}{% for item in $.trustedAccounts.value %}- &#39;{{ item }}&#39;&#92;n{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string",
    "pattern": "^[0-9]{12}|^\\*$"
  }
}

AWS > IAM > Trusted Identity Providers [Default]

List of AWS Identity Providers that are trusted for access in the AWS IAM policy.

This policy is used by the Trusted Access
control to determine which members of type "identity provider" are allowed
to be granted access. You may use the '*' and '?' wildcard characters.

<br />example:<br /> - &quot;www.amazon.com&quot;<br /> - &quot;graph.facebook.com&quot;<br />

Note: Setting the policy to Empty array will remove all identity providers.

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyTrustedIdentityProviders
Category
Parent
Targets
Default Template Input
"{\n  trustedIdentityProviders: policyValue(uri:\"tmod:@turbot/aws#/policy/types/trustedIdentityProviders\") {\n    value\n  }\n}\n"
Default Template
"{% if $.trustedIdentityProviders.value | length == 0 %}[]{% else %}{% for item in $.trustedIdentityProviders.value %}- &#39;{{ item }}&#39;&#92;n{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > Trusted Organizations [Default]

List of AWS Organizations that are trusted for access in the AWS IAM policy.

This policy is used by the Trusted Access
control to determine which members of type "organization" are allowed
to be granted access. You may use the '*' and '?' wildcard characters.

<br />example:<br /> - &quot;o-333333333&quot;<br /> - &quot;o-c3a5y4wd52&quot;<br />

Note: Trusted Access > Organization Restrictions are ONLY
applied to AWS principals. Services and Federated principals do
NOT contain the aws:PrincipalOrgId condition key, and thus
cannot be validated against the Organization.

Setting the policy to Empty array will remove all organizations.

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyTrustedOrganizations
Category
Parent
Targets
Default Template Input
"{\n  trustedOrganizations: policyValue(uri:\"tmod:@turbot/aws#/policy/types/trustedOrganizations\") {\n    value\n  }\n}\n"
Default Template
"{% if $.trustedOrganizations.value | length == 0 %}[]{% else %}{% for item in $.trustedOrganizations.value %}- &#39;{{ item }}&#39;&#92;n{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string",
    "pattern": "(?:^o-[a-z0-9]{10,32}$|^\\*$)"
  }
}

AWS > IAM > Trusted Services [Default]

List of AWS Services that are trusted for access in the AWS IAM policy.

This policy is used by the Trusted Access
control to determine which members of type "service" are allowed
to be granted access. You may use the '*' and '?' wildcard characters.

<br />example:<br /> - &quot;sns.amazonaws.com&quot;<br /> - &quot;ec2.amazonaws.com&quot;<br />

Note: Setting the policy to Empty array will remove all services.

URI
tmod:@turbot/aws-iam#/policy/types/iamPolicyTrustedServices
Category
Parent
Targets
Default Template Input
"{\n  trustedServices: policyValue(uri:\"tmod:@turbot/aws#/policy/types/trustedServices\") {\n    value\n  }\n}\n"
Default Template
"{% if $.trustedServices.value | length == 0 %}[]{% else %}{% for item in $.trustedServices.value %}- &#39;{{ item }}&#39;&#92;n{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string",
    "pattern": "(?:^\\S*\\.amazonaws\\.com$|^\\*$)"
  }
}

AWS > IAM > User > Active

Determine the action to take when an AWS IAM user, based on the AWS > IAM > User > Active > * policies.

The control determines whether the resource is in active use, and if not,
has the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > User > Active > *), raises an alarm, and takes the defined enforcement
action. Each Active sub-policy can calculate a status of active, inactive
or skipped. Generally, if the resource appears to be Active for any reason
it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered
Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/userActive
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > IAM > User > Active > Age

The age after which the AWS IAM user
is no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > User > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/userActiveAge
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > User > Active > Last Modified

The number of days since the AWS IAM user
was last modified before it is considered inactive.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > User > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/userActiveLastModified
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > User > Active > Recently Used

The number of days since the AWS IAM user was last used before it is considered inactive.

The Active
control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated
compliance environment, it's common to end up with a wide range of alarms
that are difficult and time consuming to clear. The Active control brings
automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > IAM > User > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.
Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.
See Active for more information.

URI
tmod:@turbot/aws-iam#/policy/types/userActiveRecentlyUsed
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if recently used <= 1 day",
  "Active if recently used <= 3 days",
  "Active if recently used <= 7 days",
  "Active if recently used <= 14 days",
  "Active if recently used <= 30 days",
  "Active if recently used <= 60 days",
  "Active if recently used <= 90 days",
  "Active if recently used <= 180 days",
  "Active if recently used <= 365 days",
  "Force active if recently used <= 1 day",
  "Force active if recently used <= 3 days",
  "Force active if recently used <= 7 days",
  "Force active if recently used <= 14 days",
  "Force active if recently used <= 30 days",
  "Force active if recently used <= 60 days",
  "Force active if recently used <= 90 days",
  "Force active if recently used <= 180 days",
  "Force active if recently used <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if recently used <= 1 day",
    "Active if recently used <= 3 days",
    "Active if recently used <= 7 days",
    "Active if recently used <= 14 days",
    "Active if recently used <= 30 days",
    "Active if recently used <= 60 days",
    "Active if recently used <= 90 days",
    "Active if recently used <= 180 days",
    "Active if recently used <= 365 days",
    "Force active if recently used <= 1 day",
    "Force active if recently used <= 3 days",
    "Force active if recently used <= 7 days",
    "Force active if recently used <= 14 days",
    "Force active if recently used <= 30 days",
    "Force active if recently used <= 60 days",
    "Force active if recently used <= 90 days",
    "Force active if recently used <= 180 days",
    "Force active if recently used <= 365 days"
  ],
  "example": [
    "Active if recently used <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > User > Approved

Determine the action to take when an AWS IAM user is not approved based on AWS > IAM > User > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/userApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved",
  "Enforce: Delete unapproved if new"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > IAM > User > Approved > Custom

Determine whether the AWS IAM user is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS IAM user is not approved, it will be subject to the action specified in the AWS > IAM > User > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI
tmod:@turbot/aws-iam#/policy/types/userApprovedCustom
Category
Parent
Targets
Schema
{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > IAM > User > Approved > Turbot

Determine whether IAM Policies that are defined and configured by Guardrails (for example, from the Permissions stack or the Service Roles stack) will always be approved.

URI
tmod:@turbot/aws-iam#/policy/types/userApprovedTurbot
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Force Approved for Turbot User"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Force Approved for Turbot User"
  ],
  "default": "Force Approved for Turbot User"
}

AWS > IAM > User > Approved > Usage

Determine whether the AWS IAM user is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS IAM user is not approved, it will be subject to the action specified in the AWS > IAM > User > Approved policy.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/userApprovedUsage
Category
Parent
Targets
Valid Value
[
  "Not approved",
  "Approved",
  "Approved if AWS > IAM > Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > IAM > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > IAM > Enabled"
}

AWS > IAM > User > Boundary

Configure which boundary policy to apply to the IAM user .
This must be the name of an existing AWS IAM Boundary policy.
AWS Boundary Policies are used to enforce Turbot Guardrails for
enabling/disabling API Services and Regions.

If set to Check or Enforce per AWS > Turbot > Permissions,
the boundary will be enforced if Turbot > Permissions are enforced, checked
if Turbot > Permissions are checked, and skipped if Guardrails Permissions
are none or skip

URI
tmod:@turbot/aws-iam#/policy/types/userBoundary
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: No Boundary",
  "Check: Boundary > Policy",
  "Enforce: No Boundary",
  "Enforce: Boundary > Policy",
  "Check or Enforce per `AWS > Turbot > Permissions`"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: No Boundary",
    "Check: Boundary > Policy",
    "Enforce: No Boundary",
    "Enforce: Boundary > Policy",
    "Check or Enforce per `AWS > Turbot > Permissions`"
  ],
  "default": "Skip"
}

AWS > IAM > User > Boundary > Policy

Configure which boundary policy to apply to the IAM user.
This must be the name of an existing AWS IAM Boundary policy.

AWS Boundary Policies are used to enforce Turbot Guardrails for
enabling/disabling API Services and Regions.

URI
tmod:@turbot/aws-iam#/policy/types/userBoundaryPolicy
Category
Parent
Targets
Default Template Input
"{\n  prefix: policy(uri:\"#/policy/types/turbotNamePrefixDefault\")\n}\n"
Default Template
"{{$.prefix}}boundary"
Schema

AWS > IAM > User > CMDB

Configure whether to record and synchronize details for the AWS IAM user into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Turbot CMDB.
All policies and controls in Turbot are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/userCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > User > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI
tmod:@turbot/aws-iam#/policy/types/userConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > User > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/userConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > User > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource

URI
tmod:@turbot/aws-iam#/policy/types/userConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > User > Group Memberships > CMDB

Configure whether to record and synchronize details for the AWS IAM user group memberships into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/userGroupMembershipsCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > User > Group Memberships > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI
tmod:@turbot/aws-iam#/policy/types/userGroupMembershipsConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > User > Group Memberships > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/userGroupMembershipsConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > User > Group Memberships > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource

URI
tmod:@turbot/aws-iam#/policy/types/userGroupMembershipsConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > IAM > User > Inline Policy > Approved

Determine the action to take when an AWS IAM user inline policy is not approved based on AWS > IAM > User > Inline Policy > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/userInlinePolicyApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved",
  "Enforce: Delete unapproved if new"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > IAM > User > Inline Policy > Approved > Custom

Determine whether the AWS IAM user inline policy is allowed to exist.
This policy will be evaluated by the Approved control. If an AWS IAM user inline policy is not approved, it will be subject to the action specified in the AWS > IAM > User > Inline Policy > Approved policy.
See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI
tmod:@turbot/aws-iam#/policy/types/userInlinePolicyApprovedCustom
Category
Parent
Targets
Schema
{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > IAM > User > Inline Policy > Approved > Usage

Determine whether the AWS IAM user inline policy is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS IAM user inline policy is not approved, it will be subject to the action specified in the AWS > IAM > User > Inline Policy > Approved policy.

See Approved for more information.

URI
tmod:@turbot/aws-iam#/policy/types/userInlinePolicyApprovedUsage
Category
Parent
Targets
Valid Value
[
  "Not approved",
  "Approved",
  "Approved if AWS > IAM > Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > IAM > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > IAM > Enabled"
}

AWS > IAM > User > Inline Policy > CMDB

Configure whether to record and synchronize details for the AWS IAM user inline policy into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/userInlinePolicyCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > User > Inline Policy > Statements

URI
tmod:@turbot/aws-iam#/policy/types/userInlinePolicyStatements
Category
Parent
Targets

AWS > IAM > User > Inline Policy > Statements > Approved

Configure IAM Policy Statements checking. This policy defines whether to verify the
policy statements are approved, as well as the subsequent action to take on unapproved
statements.

Rules for all Approved policies will be compiled in Approved > Compiled Rules
and then evaluated. If set to "Enforce: Delete unapproved", any unapproved statements
will be removed from the policy.

URI
tmod:@turbot/aws-iam#/policy/types/userInlinePolicyStatementsApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete Unapproved"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete Unapproved"
  ],
  "default": "Skip"
}

AWS > IAM > User > Inline Policy > Statements > Approved > Administrator Access

If set to "Disabled", IAM User Inline Policy statements that allow any action ('') on any resource ('') will be unapproved.

URI
tmod:@turbot/aws-iam#/policy/types/userInlinePolicyStatementsApprovedAdminAccess
Category
Parent
Targets
Valid Value
[
  "Enabled: Allow Administrator Access ('*:*') policies",
  "Disabled: Disallow Administrator Access ('*:*') policies"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled: Allow Administrator Access ('*:*') policies",
    "Disabled: Disallow Administrator Access ('*:*') policies"
  ],
  "default": "Enabled: Allow Administrator Access ('*:*') policies"
}

AWS > IAM > User > Inline Policy > Statements > Approved > Compiled Rules

A read-only Object Control List (OCL) to approved or reject inline policy statements for an IAM User. This policy is generated by Guardrails based on the "Approved > *" policies.

URI
tmod:@turbot/aws-iam#/policy/types/userInlinePolicyStatementsApprovedCompiledRules
Category
Parent
Targets
Schema
{
  "type": "string"
}

AWS > IAM > User > Inline Policy > Statements > Approved > Rules

An Object Control List (OCL) with a list of filter rules to approve or reject IAM policy statements. Note that the Approved control does not operate directly from this policy, but from the Approved > Compiled Rules. The rules are processed in order, and any built-in Guardrails rules will appear first in the list of compiled rules.
This is the last statement, so all unmatched items will be (approved/rejected) by this statement.

Note: Removing APPROVE * will reject all the unmatched rules.

URI
tmod:@turbot/aws-iam#/policy/types/userInlinePolicyStatementsApprovedRules
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "# Approve(APPROVE *) / Reject(REJECT *) unmatched rules\nAPPROVE *",
  "x-schema-form": {
    "type": "textarea"
  }
}

AWS > IAM > User > Login Profile

Configure whether to remove Login Profile for a user. If set to Enforce: Delete login profile, the Login Profile for the User will be deleted.

URI
tmod:@turbot/aws-iam#/policy/types/userLoginProfile
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Login profile enabled",
  "Enforce: Delete login profile"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Login profile enabled",
    "Enforce: Delete login profile"
  ],
  "example": [
    "Check: Login profile enabled"
  ],
  "default": "Skip"
}

AWS > IAM > User > Policy Attachments

URI
tmod:@turbot/aws-iam#/policy/types/userPolicyAttached
Category
Parent
Targets

AWS > IAM > User > Policy Attachments > Approved

Configure AWS IAM user policy attachments Approved checking. This policy
defines whether to verify the IAM user attached policies are approved
(per Approved > Compiled Rules), as well as the subsequent action to
take on unapproved items.
If set to "Enforce: Delete unapproved", any unapproved attached policy
will be removed.

URI
tmod:@turbot/aws-iam#/policy/types/userPolicyAttachmentsApproved
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > IAM > User > Policy Attachments > Approved > Compiled Rules

A read-only Object Control List (OCL) to add or
remove IAM Policy from a IAM user.
This policy is generated by Turbot.

URI
tmod:@turbot/aws-iam#/policy/types/userPolicyAttachmentsApprovedCompiledRules
Category
Parent
Targets
Schema
{
  "type": "string"
}

AWS > IAM > User > Policy Attachments > Approved > Rules

An Object Control List (OCL) with a list of filter rules
to approve or reject policies.
Note that the Approved control does not operate directly from this policy,
but from the Approved > Compiled Rules. The rules are processed in order,
and any built-in Guardrails rules will appear first in the list of compiled rules.

URI
tmod:@turbot/aws-iam#/policy/types/userPolicyAttachmentsApprovedRules
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "# Approve rules\nAPPROVE *",
  "x-schema-form": {
    "type": "textarea"
  }
}

AWS > IAM > User > Policy Attachments > Required

Configure whether required policies should be attached to a user.
If set to Enforce, policies in Required > Items will be attached to the user.

URI
tmod:@turbot/aws-iam#/policy/types/userPolicyRequired
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Required > Items",
  "Enforce: Required > Items"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Required > Items",
    "Enforce: Required > Items"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > IAM > User > Policy Attachments > Required > Compiled Items

A list of IAM policies that must be attached to a user.

This is a read-only policy that is generated by Turbot

URI
tmod:@turbot/aws-iam#/policy/types/userPolicyRequiredCompiledItems
Category
Parent
Targets
Schema
{
  "type": "array"
}

AWS > IAM > User > Policy Attachments > Required > Items

A list of IAM policies that must be attached to a user.

URI
tmod:@turbot/aws-iam#/policy/types/userPolicyRequiredItems
Category
Parent
Targets
Schema
{
  "type": "array",
  "items": {
    "type": "string",
    "minLength": 1,
    "maxLength": 128,
    "pattern": "^[A-Za-z0-9_+=,.@-]+$"
  },
  "default": []
}

AWS > IAM > User > Policy Attachments > Required > Turbot Lockdown

Configure whether User has Guardrails Lockdown Policies attached.

URI
tmod:@turbot/aws-iam#/policy/types/userPolicyRequiredLockdown
Category
Parent
Targets
Valid Value
[
  "Enabled",
  "Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled"
  ],
  "example": [
    "Enabled"
  ]
}

AWS > IAM > User > Tags

Determine the action to take when an AWS IAM user tags are not updated based on the AWS > IAM > User > Tags > * policies.

The control ensure AWS IAM user tags include tags defined in AWS > IAM > User > Tags > Template.

Tags not defined in User Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI
tmod:@turbot/aws-iam#/policy/types/userTags
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > IAM > User > Tags > Template

The template is used to generate the keys and values for AWS IAM user.

Tags not defined in User Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI
tmod:@turbot/aws-iam#/policy/types/userTagsTemplate
Category
Parent
Targets
Default Template Input
[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-iam#/policy/types/iamTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]
Default Template
"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"
Schema

AWS > IAM > User > Turbot Access Key

The access key ID of the Guardrails managed access key for the user.

URI
tmod:@turbot/aws-iam#/policy/types/userTurbotAccessKey
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": ""
}

AWS > IAM > User > Turbot Access Key > Rotation

Configure how frequently the Guardrails managed access key is rotated.

URI
tmod:@turbot/aws-iam#/policy/types/userTurbotAccessKeyRotation
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: 1 day",
  "Enforce: 3 days",
  "Enforce: 7 days",
  "Enforce: 14 days",
  "Enforce: 30 days",
  "Enforce: 60 days",
  "Enforce: 90 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: 1 day",
    "Enforce: 3 days",
    "Enforce: 7 days",
    "Enforce: 14 days",
    "Enforce: 30 days",
    "Enforce: 60 days",
    "Enforce: 90 days"
  ],
  "default": "Enforce: 30 days"
}

AWS > IAM > User > Turbot Secret Access Key

The secret access key of the Guardrails managed access key for the user.

URI
tmod:@turbot/aws-iam#/policy/types/userTurbotSecretAccessKey
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": ""
}

AWS > IAM > User > Usage

Configure the number of AWS IAM users that can be used for this account and the current consumption against the limit.

You can configure the behavior of the control with this AWS > IAM > User > Usage policy.

URI
tmod:@turbot/aws-iam#/policy/types/userUsage
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > IAM > User > Usage > Limit

Maximum number of items that can be created for this account.

URI
tmod:@turbot/aws-iam#/policy/types/userUsageLimit
Category
Parent
Targets
Schema
{
  "type": "integer",
  "minimum": 0,
  "default": 5000
}

AWS > IAM > User > User Policy Attachments > Active

Check if the AWS IAM Userpolicyattachment is active based on AWS > IAM > Userpolicyattachment > Active > * policies.

URI
tmod:@turbot/aws-iam#/policy/types/userPolicyAttachmentActive
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > IAM > User > User Policy Attachments > Active > Last Modified

Check if AWS userPolicyAttachment is active based on when it was last modified.

URI
tmod:@turbot/aws-iam#/policy/types/userPolicyAttachmentActiveLastModified
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > IAM > User > User Policy Attachments > CMDB

Configure whether to record and synchronize details for the AWS IAM user policy attachment into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-iam#/policy/types/userPolicyAttachmentCmdb
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > IAM > User > User Policy Attachments > Configured

Determine how to configure this resource.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it

URI
tmod:@turbot/aws-iam#/policy/types/userPolicyAttachmentConfigured
Category
Parent
Targets
Valid Value
[
  "Skip (unless claimed by a stack)",
  "Check: Per Configured > Source (unless claimed by a stack)",
  "Enforce: Per Configured > Source (unless claimed by a stack)"
]
Schema
{
  "enum": [
    "Skip (unless claimed by a stack)",
    "Check: Per Configured > Source (unless claimed by a stack)",
    "Enforce: Per Configured > Source (unless claimed by a stack)"
  ],
  "default": "Skip (unless claimed by a stack)"
}

AWS > IAM > User > User Policy Attachments > Configured > Claim Precedence

An ordered list of who is allowed to claim a resource.
A stack cannot claim a resource if it is already claimed by another
stack at a higher level of precedence.

URI
tmod:@turbot/aws-iam#/policy/types/userPolicyAttachmentConfiguredPrecedence
Category
Parent
Targets
Default Template Input
"{\n  defaultPrecedence: policy(uri:\"tmod:@turbot/turbot#/policy/types/claimPrecedenceDefault\")\n}\n"
Default Template
"{%- if $.defaultPrecedence | length == 0 %}[]{%- else %}{% for item in $.defaultPrecedence %}- &#39;{{ item }}&#39;{% endfor %}{% endif %}"
Schema
{
  "type": "array",
  "items": {
    "type": "string"
  }
}

AWS > IAM > User > User Policy Attachments > Configured > Source

A HCL or JSON format Terraform configuration source used to configure this resource

URI
tmod:@turbot/aws-iam#/policy/types/userPolicyAttachmentConfiguredSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > Turbot > Event Handlers > Events > Rules > Custom Event Patterns > @turbot/aws-iam

The CloudWatch Events event pattern used by the AWS IAM module to specify
which events to forward to the Guardrails Event Handlers.

URI
tmod:@turbot/aws-iam#/policy/types/iamCustomEventPatterns
Category
Parent
Targets
Schema
{
  "type": "array",
  "items": {
    "type": "object"
  }
}

AWS > Turbot > IAM

URI
tmod:@turbot/aws-iam#/policy/types/iamTurbot
Category
Parent
Targets

AWS > Turbot > IAM > Managed

This policy determines the permission mode used by Guardrails. There are 3 possible configurations:

None: Guardrails will not manage any AWS IAM permissions. This setting is for organizations that want to maintain complete control over AWS IAM.

Policy-Only Mode: Guardrails policies are created in AWS IAM, but no management of roles or users will occur. This option helps automate policy creation across a wide number of accounts while keeping control in the hands of the organization.

Role Mode: Guardrails will create policies and roles within the AWS account. This allows administrators to assign AWS permissions in Guardrails. Users federate into AWS and will assume the role that is assigned to their profile in Guardrails.

Role Mode with strict Turbot-managed policies: Ensures Turbot-managed policies can be attached to roles, blocking custom policy attachments for stricter security control.

User Mode: Guardrails will create policies, roles, groups and users within the AWS account. Access granted at the folder level ABOVE the accounts will always leverage roles. Guardrails users granted access only at the folder level will NOT have a corresponding IAM User. If a user is granted any access explicitly on the account, an IAM user will be created for them.

User Mode with strict Turbot-managed policies and groups: Restricts roles, users, and groups to only Turbot-managed policies and groups, ensuring a secure and controlled environment by disallowing custom attachments.

URI
tmod:@turbot/aws-iam#/policy/types/iamTurbotManaged
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: None",
  "Check: Policy-Only Mode",
  "Check: Role Mode",
  "Check: Role Mode with strict Turbot-managed policies",
  "Check: User Mode",
  "Check: User Mode with strict Turbot-managed policies and groups",
  "Enforce: None",
  "Enforce: Policy-Only Mode",
  "Enforce: Role Mode",
  "Enforce: Role Mode with strict Turbot-managed policies",
  "Enforce: User Mode",
  "Enforce: User Mode with strict Turbot-managed policies and groups"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: None",
    "Check: Policy-Only Mode",
    "Check: Role Mode",
    "Check: Role Mode with strict Turbot-managed policies",
    "Check: User Mode",
    "Check: User Mode with strict Turbot-managed policies and groups",
    "Enforce: None",
    "Enforce: Policy-Only Mode",
    "Enforce: Role Mode",
    "Enforce: Role Mode with strict Turbot-managed policies",
    "Enforce: User Mode",
    "Enforce: User Mode with strict Turbot-managed policies and groups"
  ],
  "example": [
    "Enforce: None"
  ],
  "default": "Skip"
}

AWS > Turbot > Permissions

This policy determines the permission mode used by Guardrails. There are 3 possible configurations:

None: Guardrails will not manage any AWS IAM permissions. This setting is for organizations that want to maintain complete control over AWS IAM.

Policy-Only Mode: Guardrails policies are created in AWS IAM, but no management of roles or users will occur. This option helps automate policy creation across a wide number of accounts while keeping control in the hands of the organization.

Role Mode: Guardrails will create policies and roles within the AWS account. This allows administrators to assign AWS permissions in Guardrails. Users federate into AWS and will assume the role that is assigned to their profile in Guardrails.

User Mode: Guardrails will create policies, roles and users within the AWS account. Access granted at the folder level ABOVE the accounts will always leverage roles. Guardrails users granted access only at the folder level will NOT have a corresponding IAM User. If a user is granted any access explicitly on the account, an IAM user will be created for them

URI
tmod:@turbot/aws-iam#/policy/types/permissions
Category
Parent
Targets
Valid Value
[
  "Skip",
  "Check: None",
  "Check: Policy-Only Mode",
  "Check: Role Mode",
  "Check: User Mode",
  "Enforce: None",
  "Enforce: Policy-Only Mode",
  "Enforce: Role Mode",
  "Enforce: User Mode"
]
Schema
{
  "type": "string",
  "enum": [
    "Skip",
    "Check: None",
    "Check: Policy-Only Mode",
    "Check: Role Mode",
    "Check: User Mode",
    "Enforce: None",
    "Enforce: Policy-Only Mode",
    "Enforce: Role Mode",
    "Enforce: User Mode"
  ],
  "example": [
    "Enforce: None"
  ],
  "default": "Skip"
}

AWS > Turbot > Permissions > Compiled

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissionsCompiled
Category
Parent
Targets

AWS > Turbot > Permissions > Compiled > API Boundary

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissionsCompiledLevelsApiBoundary
Category
Parent
Targets
Schema
{
  "type": "array"
}

AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-iam

A read-only policy generated by Guardrails that lists the APIs that
should be added to the turbot-managed (hard) boundary policy,
thereby enabling them to be assigned to users and roles.

This value will change depending on the value of the value of the
AWS > IAM > Permissions > Lockdown > API Boundary policy

URI
tmod:@turbot/aws-iam#/policy/types/awsCompiledApiBoundary
Category
Parent
Targets
Schema
{
  "type": "array"
}

AWS > Turbot > Permissions > Compiled > Account Permissions

A calculated policy that Guardrails uses to create a single list of ALL permissions for all provider level permissions (AWS/Admin, AWS/Operator, etc) that is used as input to the control that manages the IAM stack

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissionsCompiledAccountPermissions
Category
Parent
Targets
Schema

AWS > Turbot > Permissions > Compiled > Allow Statements

A calculated policy that Guardrails uses to create a compiled list of ALL custom "Allow" policy statements for AWS API Gateway that is used as input to the stack that manages the Guardrails IAM permissions objects.

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissionsCompiledAllowStatements
Category
Parent
Targets
Schema
{
  "type": "array"
}

AWS > Turbot > Permissions > Compiled > Levels

A calculated policy that Guardrails uses to create a single list of ALL permissions levels for all services that is used as input to the stack that manages the Guardrails IAM permissions objects.

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissionsCompiledLevels
Category
Parent
Targets
Schema

AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-iam

A calculated policy that Guardrails uses to create a compiled list of
ALL permissions for AWS IAM that is used as input to the stack that
manages the Guardrails IAM permissions objects.

URI
tmod:@turbot/aws-iam#/policy/types/awsLevelsCompiled
Category
Parent
Targets
Schema

AWS > Turbot > Permissions > Compiled > Lockdown Statements

A calculated policy that Guardrails uses to create a single list of ALL lockdown policy statements for all services that is used as input to the stack that manages the Guardrails IAM permissions objects.

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissionsCompiledLockdownStatements
Category
Parent
Targets
Schema
{
  "type": "array"
}

AWS > Turbot > Permissions > Compiled > Lockdown Statements > @turbot/aws-iam

A calculated policy that Guardrails uses to create a compiled list of ALL
lockdown policy statements for AWS IAM that is used as input to the stack
that manages the Guardrails IAM permissions objects.

URI
tmod:@turbot/aws-iam#/policy/types/awsCompiledLockdownStatements
Category
Parent
Targets
Schema
{
  "type": "array"
}

AWS > Turbot > Permissions > Compiled > Service Permissions

A calculated policy that Guardrails uses to create a single list of ALL permissions for all services that is used as input to the control that manages the IAM stack.

URI
tmod:@turbot/aws-iam#/policy/types/iamPermissionsCompiledServicePermissions
Category
Parent
Targets
Schema
{
  "type": "array"
}

AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-iam

A calculated policy that Guardrails uses to create a compiled list of ALL permissions
for AWS IAM that is used as input to the control that manages the IAM stack.

URI
tmod:@turbot/aws-iam#/policy/types/awsCompiledServicePermissions
Category
Parent
Targets
Schema

AWS > Turbot > Permissions > Custom Group Levels [Account]

An ordered list of custom levels used to customize Turbot's permissions. Levels in this policy will appear in the Turbot console as grantable to Turbot users as AWS/Group/{group name}. When granted access, Turbot will attach the Group to the IAM user via the AWS > Turbot > IAM stack. Note that the IAM groups must already exist in the AWS Account, and Turbot must have the ability to attach users to these groups.

URI
tmod:@turbot/aws-iam#/policy/types/permissionsCustomGroupLevelsAccount
Category
Parent
Targets
Schema
{
  "type": "array",
  "default": [],
  "example": [
    [
      "my_custom_backup_group",
      "my_custom_infosec_group"
    ]
  ]
}

AWS > Turbot > Permissions > Custom Role Levels [Account]

An ordered list of custom levels used to customize Turbot's permissions. Levels in this policy will appear in the Guardrails console as grantable to Guardrails users as AWS/Role/{role name}. When granted access, Guardrails will allow the user to assume the associated IAM role. Note that the IAM roles must already exist in the AWS Account, and Guardrails must have the ability to assume the roles.

URI
tmod:@turbot/aws-iam#/policy/types/permissionsCustomLevelsAccount
Category
Parent
Targets
Schema
{
  "type": "array",
  "default": [],
  "example": [
    [
      "my_custom_backup_role",
      "my_custom_infosec_role"
    ]
  ]
}

AWS > Turbot > Permissions > Custom Role Levels [Folder]

An ordered list of custom levels used to customize Guardrails' permissions. Levels in this policy will appear in the Guardrails console as grantable to Guardrails users as AWS/Role/{role name} at a folder level. When granted access, Guardrails will allow the user to assume the associated IAM role. Note that the IAM roles must already exist in the AWS Account, and Guardrails must have the ability to assume the roles.

URI
tmod:@turbot/aws-iam#/policy/types/permissionsCustomLevelsFolder
Category
Parent
Targets
Schema
{
  "type": "array",
  "default": [],
  "example": [
    [
      "my_custom_backup_role",
      "my_custom_infosec_role"
    ]
  ]
}

AWS > Turbot > Permissions > Group

Configures Guardrails IAM Groups, depending on AWS > Permissions.

URI
tmod:@turbot/aws-iam#/policy/types/turbotGroup
Category
Parent
Targets

AWS > Turbot > Permissions > Group > Name Path

The value to be used in resource path names for standard Guardrails IAM Groups. The path should start and end with a slash (/).

URI
tmod:@turbot/aws-iam#/policy/types/turbotGroupNamePath
Category
Parent
Targets
Default Template Input
"{\n  prefixPath: policy(uri: \"#/policy/types/turbotNamePathDefault\")\n}\n"
Default Template
"&#39;{{ $.prefixPath }}&#39;"
Schema
{
  "type": "string",
  "pattern": "^/.*/$"
}

AWS > Turbot > Permissions > Group > Name Prefix

A prefix to be used in resource names for standard Guardrails IAM Groups.

URI
tmod:@turbot/aws-iam#/policy/types/turbotGroupNamePrefix
Category
Parent
Targets
Default Template Input
"{\n  prefixName: policy(uri: \"#/policy/types/turbotNamePrefixDefault\")\n}\n"
Default Template
"&#39;{{ $.prefixName }}&#39;"
Schema
{
  "type": "string"
}

AWS > Turbot > Permissions > Levels

Define the permissions levels that can be used to grant access to an AWS account. Permissions levels defined will appear in the UI to assign access to Guardrails users.

URI
tmod:@turbot/aws-iam#/policy/types/permissionsLevels
Category
Parent
Targets
Schema
{
  "type": "array",
  "items": {
    "type": "string",
    "enum": [
      "AWS/User",
      "AWS/Metadata",
      "AWS/ReadOnly",
      "AWS/Operator",
      "AWS/Admin",
      "AWS/Owner",
      "AWS/SuperUser"
    ]
  },
  "default": [
    "AWS/User",
    "AWS/Metadata",
    "AWS/ReadOnly",
    "AWS/Operator",
    "AWS/Admin",
    "AWS/Owner",
    "AWS/SuperUser"
  ]
}

AWS > Turbot > Permissions > Levels > Modifiers

A map of AWS API to Guardrails Permission Level used to customize Guardrails' standard permissions. You can add, remove or redefine the mapping of AWS API operations to Guardrails permissions levels here. Note: Modifiers are cumulative - if you add a permission to the Metadata level, it is also added to ReadOnly, Operator and Admin. Modifier policies set here apply ONLY to the AWS level

URI
tmod:@turbot/aws-iam#/policy/types/permissionsLevelsModifiers
Category
Parent
Targets
Schema
{
  "type": "array",
  "default": [],
  "example": [
    [
      {
        "datasync:ListLocations": "Metadata"
      },
      {
        "datasync:CreateLocationEfs": "Admin"
      }
    ]
  ]
}

AWS > Turbot > Permissions > Levels [Default]

Define the permissions levels that can be used to grant access to an AWS account. Permissions levels defined will appear in the UI to assign access to Guardrails users. This policy provides a default for Permissions > Levels in each service, however you can explicitly override the setting for each service if desired

URI
tmod:@turbot/aws-iam#/policy/types/permissionsLevelsDefault
Category
Parent
Targets
Schema
{
  "type": "array",
  "items": {
    "type": "string",
    "enum": [
      "Metadata",
      "ReadOnly",
      "Operator",
      "Admin",
      "Owner"
    ]
  },
  "default": []
}

AWS > Turbot > Permissions > Lockdown

URI
tmod:@turbot/aws-iam#/policy/types/permissionsLockdown
Category
Parent
Targets

AWS > Turbot > Permissions > Lockdown > API Boundary

A list of APIs that should be allowed in the Guardrails
boundary policy.

This is represented as a list of apis and their
scope (regional or global).

For example:

<br /> - api: &#39;s3:*&#39;<br /> regionScope: regional<br /> - api: &#39;iam:*&#39;<br /> regionScope: global<br />

Note: That APIs can be enabled or disabled via the
relevant AWS > {Service} > API Enabled policies.
An API will be allowed in the boundary if it is
EITHER enabled via AWS > {Service} > API Enabled
OR added to the AWS > Turbot > Permissions &gt;<br />Lockdown > API Boundary policy.

URI
tmod:@turbot/aws-iam#/policy/types/permissionsLockdownApiBoundary
Category
Parent
Targets
Schema

AWS > Turbot > Permissions > Lockdown > Region Boundary

Define a list of regions to which API calls can be made. Any API to any region that does not appear in this list will be explicitly denied. The '*' wildcard may be used in these values.

Note that this policy disables the region for ALL users and roles,
and Guardrails will have no access to any regions that do not appear in
the list.

Global services (such as IAM) are not subject to the Region Boundary

URI
tmod:@turbot/aws-iam#/policy/types/permissionsLockdownRegionBoundary
Category
Parent
Targets
Schema
{
  "type": "array",
  "items": {
    "type": "string",
    "pattern": "^[-a-z0-9?*]+$"
  },
  "default": [
    "*"
  ]
}

AWS > Turbot > Permissions > Lockdown > Regions

Define a list of regions to which API calls can be made. Any API to any region that does not appear in this list will be explicitly denied. The '*' wildcard may be used in these values.

URI
tmod:@turbot/aws-iam#/policy/types/permissionsLockdownRegions
Category
Parent
Targets
Default Template Input
"{\n  regions: policyValue(uri:\"tmod:@turbot/aws#/policy/types/approvedRegionsDefault\") {\n    value\n  }\n}\n"
Default Template
"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;{{ &#39;&#92;n&#39; }}{% endfor %}"
Schema

AWS > Turbot > Permissions > Name Path [Default]

Provides a default value to be used in resource path names for standard Guardrails IAM objects. The path should start and end with a slash (/) This policy can be referenced other policies (User > Name Path, Role > Name Path, Groups > Name Path, Policy > Name Path) to set a single, consistent default

URI
tmod:@turbot/aws-iam#/policy/types/turbotNamePathDefault
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "/turbot/",
  "example": "/turbot/"
}

AWS > Turbot > Permissions > Name Prefix [Default]

Provides a default prefix to be used in resource names for standard Guardrails IAM objects. This policy can be referenced other policies (User > Name Prefix, Role > Name Prefix, Group > Name Prefix, Policy > Name Prefix) to set a single, consistent default

URI
tmod:@turbot/aws-iam#/policy/types/turbotNamePrefixDefault
Category
Parent
Targets
Schema
{
  "type": "string",
  "default": "",
  "example": "turbot-"
}

AWS > Turbot > Permissions > Policy

Configures Guardrails IAM Policies, depending on AWS > Permissions.

URI
tmod:@turbot/aws-iam#/policy/types/turbotPolicy
Category
Parent
Targets

AWS > Turbot > Permissions > Policy > Name Path

The value to be used in resource path names for standard Guardrails IAM Policies. The path should start and end with a slash (/).

URI
tmod:@turbot/aws-iam#/policy/types/turbotPolicyNamePath
Category
Parent
Targets
Default Template Input
"{\n  prefixPath: policy(uri: \"#/policy/types/turbotNamePathDefault\")\n}\n"
Default Template
"&#39;{{ $.prefixPath }}&#39;"
Schema
{
  "type": "string",
  "pattern": "^/.*/$"
}

AWS > Turbot > Permissions > Policy > Name Prefix

A prefix to be used in resource names for standard Guardrails IAM Policies.

URI
tmod:@turbot/aws-iam#/policy/types/turbotPolicyNamePrefix
Category
Parent
Targets
Default Template Input
"{\n  prefixName: policy(uri: \"#/policy/types/turbotNamePrefixDefault\")\n}\n"
Default Template
"&#39;{{ $.prefixName }}&#39;"
Schema
{
  "type": "string"
}

AWS > Turbot > Permissions > Role

Configures Guardrails IAM Roles, depending on AWS > Permissions.

URI
tmod:@turbot/aws-iam#/policy/types/turbotRole
Category
Parent
Targets

AWS > Turbot > Permissions > Role > Name Path

The value to be used in resource path names for standard Guardrails IAM Roles. The path should start and end with a slash (/).

URI
tmod:@turbot/aws-iam#/policy/types/turbotRoleNamePath
Category
Parent
Targets
Default Template Input
"{\n  prefixPath: policy(uri: \"#/policy/types/turbotNamePathDefault\")\n}\n"
Default Template
"&#39;{{ $.prefixPath }}&#39;"
Schema
{
  "type": "string",
  "pattern": "^/.*/$"
}

AWS > Turbot > Permissions > Role > Name Prefix

A prefix to be used in resource names for standard Guardrails IAM Roles.

URI
tmod:@turbot/aws-iam#/policy/types/turbotRoleNamePrefix
Category
Parent
Targets
Default Template Input
"{\n  prefixName: policy(uri: \"#/policy/types/turbotNamePrefixDefault\")\n}\n"
Default Template
"&#39;{{ $.prefixName }}&#39;"
Schema
{
  "type": "string"
}

AWS > Turbot > Permissions > Role > Session Timeout

The session timeout in minutes when roles access the AWS console or obtain
temporary AWS security credentials through Guardrails, e.g., if a user john has
the AWS/Admin permission in the Permission Tab,
then he can log into an AWS account via Guardrails with
a temporary federated role with AWS/Admin rights only for the time set
in the policy.

URI
tmod:@turbot/aws-iam#/policy/types/turbotRoleSessionTimeout
Category
Parent
Targets
Schema
{
  "type": "integer",
  "minimum": 15,
  "maximum": 60,
  "default": 60
}

AWS > Turbot > Permissions > Role > Tags

Ensure AWS IAM Role tags for Guardrails role include tags defined in Role Tags.

URI
tmod:@turbot/aws-iam#/policy/types/turbotRoleTags
Category
Parent
Targets
Default Template Input
null
Default Template
"[]"
Schema

AWS > Turbot > Permissions > Source

A HCL format configuration template to create Guardrails permissions policies.

This policy is read-only, as source is generated by Guardrails.

URI
tmod:@turbot/aws-iam#/policy/types/iamTurbotSource
Category
Parent
Targets
Schema
{
  "type": "string",
  "x-schema-form": {
    "type": "code",
    "language": "hcl"
  }
}

AWS > Turbot > Permissions > Superuser Boundary

Configure whether Guardrails should apply the Boundary
Policy to AWS/Superuser.

By default, the boundary is applied to all users,
however you can disable the boundary for superusers
by setting this policy to No Boundary

URI
tmod:@turbot/aws-iam#/policy/types/permissionsSuperuserBoundary
Category
Parent
Targets
Valid Value
[
  "No Boundary",
  "Turbot Boundary"
]
Schema
{
  "type": "string",
  "enum": [
    "No Boundary",
    "Turbot Boundary"
  ],
  "default": "Turbot Boundary"
}

AWS > Turbot > Permissions > Tags Default

Provides a default prefix to be used in resource names for standard Guardrails IAM objects. This policy can be referenced other policies (User > Name Prefix, Role > Name Prefix, Group > Name Prefix, Policy > Name Prefix) to set a single, consistent default

URI
tmod:@turbot/aws-iam#/policy/types/turbotTagsDefault
Category
Parent
Targets
Schema

AWS > Turbot > Permissions > Terraform Version

The Version of Terraform to use for this stack.
Specify an npm-style semver string to
determine which version of the Terraform container
Guardrails will use to run this stack.
A Guardrails Stack is a set of resources configured by Turbot,
as specified via Terraform source. Stacks are responsible
for the creation and deletion of multiple resources. Once created,
stack resources are responsible for configuring themselves from
the stack source via their Configured control.

URI
tmod:@turbot/aws-iam#/policy/types/permissionsTerraformVersion
Category
Parent
Targets
Schema
{
  "type": "string"
}

AWS > Turbot > Permissions > User

URI
tmod:@turbot/aws-iam#/policy/types/turbotUser
Category
Parent
Targets

AWS > Turbot > Permissions > User > Access Keys Enabled

If enabled, Guardrails IAM users will be allowed to manage their IAM user access
keys from the Guardrails console.

URI
tmod:@turbot/aws-iam#/policy/types/turbotUserAccessKeysEnabled
Category
Parent
Targets
Valid Value
[
  "Disabled",
  "Enabled"
]
Schema
{
  "type": "string",
  "enum": [
    "Disabled",
    "Enabled"
  ],
  "example": [
    "Disabled"
  ],
  "default": "Disabled"
}

AWS > Turbot > Permissions > User > Group Membership Mode

Configure the group membership mode for the AWS > Turbot > IAM stack.
In Exclusive mode, the AWS > Turbot > IAM stack will manage the users group memberships exactly - groups added outside of Guardrails will be removed. In Non-Exclusive mode, the AWS > Turbot > IAM stack will only manage the Guardrails groups that it creates - it will not remove groups added outside of Turbot.

URI
tmod:@turbot/aws-iam#/policy/types/turbotUserGroupMembershipMode
Category
Parent
Targets
Valid Value
[
  "Exclusive",
  "Non-Exclusive"
]
Schema
{
  "type": "string",
  "enum": [
    "Exclusive",
    "Non-Exclusive"
  ],
  "example": [
    "Exclusive"
  ],
  "default": "Exclusive"
}

AWS > Turbot > Permissions > User > Name Path

The value to be used in resource path names for standard Guardrails IAM Users. The path should start and end with a slash (/).

URI
tmod:@turbot/aws-iam#/policy/types/turbotUserNamePath
Category
Parent
Targets
Default Template Input
"{\n  prefixPath: policy(uri: \"#/policy/types/turbotNamePathDefault\")\n}\n"
Default Template
"&#39;{{ $.prefixPath }}&#39;"
Schema
{
  "type": "string",
  "pattern": "^/.*/$"
}

AWS > Turbot > Permissions > User > Session Timeout

The session timeout in minutes when users access the AWS console or obtain
temporary AWS security credentials through Turbot, e.g., if a user john has
the AWS/Admin permission in the Permission Tab,
then he can log into an AWS account via Guardrails only for time set in the policy.

URI
tmod:@turbot/aws-iam#/policy/types/turbotUserSessionTimeout
Category
Parent
Targets
Schema
{
  "type": "integer",
  "minimum": 15,
  "maximum": 2160,
  "default": 60
}

AWS > Turbot > Permissions > User > Tags

Ensure AWS IAM Role tags for Guardrails role include tags defined in User Tags.

URI
tmod:@turbot/aws-iam#/policy/types/turbotUserTags
Category
Parent
Targets
Default Template Input
null
Default Template
"[]"
Schema

AWS > Turbot > Permissions > User Boundary

Configure whether Guardrails should apply the Boundary
Policy to users.

By default, the boundary is applied to all users,
however you can disable the boundary for users
by setting this policy to No Boundary

URI
tmod:@turbot/aws-iam#/policy/types/permissionsUserBoundary
Category
Parent
Targets
Valid Value
[
  "No Boundary",
  "Turbot Boundary"
]
Schema
{
  "type": "string",
  "enum": [
    "No Boundary",
    "Turbot Boundary"
  ],
  "default": "Turbot Boundary"
}

Turbot > IAM > Permissions > Compiled > Levels > AWS

A list of AWS permissions that Guardrails may use to grant permissions on an account.

URI
tmod:@turbot/aws-iam#/policy/types/turbotPermissionsCompiledLevelsAws
Category
Parent
Targets
Schema
{
  "type": "array"
}

Turbot > IAM > Permissions > Compiled > Levels > AWS [Turbot]

A list of AWS permissions that Guardrails may use to grant permissions on folders that have aws accounts as children.

URI
tmod:@turbot/aws-iam#/policy/types/turbotPermissionsCompiledLevels
Category
Parent
Targets
Schema