Product logo
DocsBlogPricing

Control types for @turbot/aws-rds

AWS > RDS > DB Cluster > Active

Take an action when an AWS RDS db cluster is not active based on the
AWS > RDS > DB Cluster > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > RDS > DB Cluster > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterActive
Parent
Category
Targets

AWS > RDS > DB Cluster > Approved

Take an action when an AWS RDS db cluster is not approved based on AWS > RDS > DB Cluster > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterApproved
Parent
Category
Targets

AWS > RDS > DB Cluster > Backup Retention Period

Raise an alarm if the RDS cluster's backup retention period is not configured to meet policy.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterBackupRetentionPeriod
Parent
Category
Targets

AWS > RDS > DB Cluster > CMDB

Record and synchronize details for the AWS RDS db cluster into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > RDS > DB Cluster > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI
tmod:@turbot/aws-rds#/control/types/dbClusterCmdb
Parent
Category
Targets

AWS > RDS > DB Cluster > Configured

Maintain AWS > RDS > DB Cluster configuration.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterConfigured
Parent
Category
Targets

AWS > RDS > DB Cluster > Copy Tags to Snapshot

Configure Copy Tags to Snapshot settings on an AWS > RDS > DB Cluster.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterCopyTagsToSnapshot
Parent
Category
Targets

AWS > RDS > DB Cluster > Deletion Protection

Configure Deletion Protection settings on an AWS > RDS > DB Cluster.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterDeletionProtection
Parent
Category
Targets

AWS > RDS > DB Cluster > Discovery

Discover all AWS RDS db cluster resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > RDS > DB Cluster > Regions policy, the CMDB control will delete the resource from the CMDB.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterDiscovery
Parent
Category
Targets

AWS > RDS > DB Cluster > Logs Export Configuration

Configure logs export to CloudWatch for an AWS > RDS > DB Cluster as per the AWS > RDS > DB Cluster > Logs Export Configuration > * policies.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterLogsExportConfiguration
Parent
Category
Targets

AWS > RDS > DB Cluster > Schedule

Set a schedule for starting and stopping an AWS RDS db cluster.

Note If both "Schedule" and "Schedule Tag" are set to enforce and the
db cluster has a turbot_custom_schedule tag, then the schedule specified by
the tag will be in effect.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterSchedule
Parent
Category
Targets

AWS > RDS > DB Cluster > Tags

Take an action when an AWS RDS db cluster tags is not updated based on the AWS > RDS > DB Cluster > Tags > * policies.

If the resource is not updated with the tags defined in AWS > RDS > DB Cluster > Tags > Template, this control raises an alarm and takes the defined enforcement action.

See Tags for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterTags
Parent
Category
Targets

AWS > RDS > DB Cluster > Usage

The Usage control determines whether the number of AWS RDS db cluster resources exceeds the configured usage limit for this region.

You can configure the behavior of this control with the AWS > RDS > DB Cluster > Usage policy, and set the limit with the AWS > RDS > DB Cluster > Usage > Limit policy.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterUsage
Parent
Category
Targets

AWS > RDS > DB Cluster Parameter Group > Active

Take an action when an AWS RDS db cluster parameter group is not active based on the
AWS > RDS > DB Cluster Parameter Group > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > RDS > DB Cluster Parameter Group > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterParameterGroupActive
Parent
Category
Targets

AWS > RDS > DB Cluster Parameter Group > Approved

Take an action when an AWS RDS db cluster parameter group is not approved based on AWS > RDS > DB Cluster Parameter Group > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterParameterGroupApproved
Parent
Category
Targets

AWS > RDS > DB Cluster Parameter Group > CMDB

Record and synchronize details for the AWS RDS db cluster parameter group into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > RDS > DB Cluster Parameter Group > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI
tmod:@turbot/aws-rds#/control/types/dbClusterParameterGroupCmdb
Parent
Category
Targets

AWS > RDS > DB Cluster Parameter Group > Configured

Maintain AWS > RDS > DB Cluster Parameter Group configuration.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterParameterGroupConfigured
Parent
Category
Targets

AWS > RDS > DB Cluster Parameter Group > Discovery

Discover all AWS RDS db cluster parameter group resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > RDS > DB Cluster Parameter Group > Regions policy, the CMDB control will delete the resource from the CMDB.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterParameterGroupDiscovery
Parent
Category
Targets

AWS > RDS > DB Cluster Parameter Group > Tags

Take an action when an AWS RDS db cluster parameter group tags is not updated based on the AWS > RDS > DB Cluster Parameter Group > Tags > * policies.

If the resource is not updated with the tags defined in AWS > RDS > DB Cluster Parameter Group > Tags > Template, this control raises an alarm and takes the defined enforcement action.

See Tags for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterParameterGroupTags
Parent
Category
Targets

AWS > RDS > DB Cluster Parameter Group > Usage

The Usage control determines whether the number of AWS RDS db cluster parameter group resources exceeds the configured usage limit for this region.

You can configure the behavior of this control with the AWS > RDS > DB Cluster Parameter Group > Usage policy, and set the limit with the AWS > RDS > DB Cluster Parameter Group > Usage > Limit policy.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterParameterGroupUsage
Parent
Category
Targets

AWS > RDS > DB Cluster Snapshot [Manual] > Active

Take an action when an AWS RDS db cluster snapshot [manual] is not active based on the
AWS > RDS > DB Cluster Snapshot [Manual] > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > RDS > DB Cluster Snapshot [Manual] > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterSnapshotManualActive
Parent
Category
Targets

AWS > RDS > DB Cluster Snapshot [Manual] > Approved

Take an action when an AWS RDS db cluster snapshot [manual] is not approved based on AWS > RDS > DB Cluster Snapshot [Manual] > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterSnapshotManualApproved
Parent
Category
Targets

AWS > RDS > DB Cluster Snapshot [Manual] > CMDB

Record and synchronize details for the AWS RDS db cluster snapshot [manual] into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > RDS > DB Cluster Snapshot [Manual] > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI
tmod:@turbot/aws-rds#/control/types/dbClusterSnapshotManualCmdb
Parent
Category
Targets

AWS > RDS > DB Cluster Snapshot [Manual] > Configured

Maintain AWS > RDS > DB Cluster Snapshot [Manual] configuration.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterSnapshotManualConfigured
Parent
Category
Targets

AWS > RDS > DB Cluster Snapshot [Manual] > Discovery

Discover all AWS RDS db cluster snapshot [manual] resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > RDS > DB Cluster Snapshot [Manual] > Regions policy, the CMDB control will delete the resource from the CMDB.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterSnapshotManualDiscovery
Parent
Category
Targets

AWS > RDS > DB Cluster Snapshot [Manual] > Tags

Take an action when an AWS RDS db cluster snapshot [manual] tags is not updated based on the AWS > RDS > DB Cluster Snapshot [Manual] > Tags > * policies.

If the resource is not updated with the tags defined in AWS > RDS > DB Cluster Snapshot [Manual] > Tags > Template, this control raises an alarm and takes the defined enforcement action.

See Tags for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterSnapshotManualTags
Parent
Category
Targets

AWS > RDS > DB Cluster Snapshot [Manual] > Trusted Access

Manage trusted access for AWS RDS DB Cluster Snapshot [Manual]s.

AWS allows RDS DB Cluster Snapshot [Manual]s to be shared with specific AWS accounts.
This control allows you to configure whether such sharing is allowed, and to which accounts.

If set to Enforce, access to non-trusted accounts will be removed.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterSnapshotManualTrustedAccess
Parent
Category
Targets

AWS > RDS > DB Cluster Snapshot [Manual] > Usage

The Usage control determines whether the number of AWS RDS db cluster snapshot [manual] resources exceeds the configured usage limit for this region.

You can configure the behavior of this control with the AWS > RDS > DB Cluster Snapshot [Manual] > Usage policy, and set the limit with the AWS > RDS > DB Cluster Snapshot [Manual] > Usage > Limit policy.

URI
tmod:@turbot/aws-rds#/control/types/dbClusterSnapshotManualUsage
Parent
Category
Targets

AWS > RDS > DB Instance > Active

Take an action when an AWS RDS db instance is not active based on the
AWS > RDS > DB Instance > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > RDS > DB Instance > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbInstanceActive
Parent
Category
Targets

AWS > RDS > DB Instance > Approved

Take an action when an AWS RDS db instance is not approved based on AWS > RDS > DB Instance > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

See Approved for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbInstanceApproved
Parent
Category
Targets

AWS > RDS > DB Instance > Auto Minor Version Upgrade

Configure Auto Minor Version Upgrade settings on an AWS > RDS > DB Instance.

URI
tmod:@turbot/aws-rds#/control/types/dbInstanceAutoMinorVersionUpgrade
Parent
Category
Targets

AWS > RDS > DB Instance > Backup Retention Period

Raise an alarm if the RDS instance's backup retention period is not configured to meet policy.

URI
tmod:@turbot/aws-rds#/control/types/dbInstanceBackupRetentionPeriod
Parent
Category
Targets

AWS > RDS > DB Instance > CMDB

Record and synchronize details for the AWS RDS db instance into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > RDS > DB Instance > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI
tmod:@turbot/aws-rds#/control/types/dbInstanceCmdb
Parent
Category
Targets

AWS > RDS > DB Instance > Configured

Maintain AWS > RDS > DB Instance configuration.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it.

URI
tmod:@turbot/aws-rds#/control/types/dbInstanceConfigured
Parent
Category
Targets

AWS > RDS > DB Instance > Copy Tags to Snapshot

Configure Copy Tags to Snapshot settings on an AWS > RDS > DB Instance.

URI
tmod:@turbot/aws-rds#/control/types/dbInstanceCopyTagsToSnapshot
Parent
Category
Targets

AWS > RDS > DB Instance > Deletion Protection

Configure Deletion Protection settings on an AWS > RDS > DB Instance.

URI
tmod:@turbot/aws-rds#/control/types/dbInstanceDeletionProtection
Parent
Category
Targets

AWS > RDS > DB Instance > Discovery

Discover all AWS RDS db instance resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > RDS > DB Instance > Regions policy, the CMDB control will delete the resource from the CMDB.

URI
tmod:@turbot/aws-rds#/control/types/dbInstanceDiscovery
Parent
Category
Targets

AWS > RDS > DB Instance > Logs Export Configuration

Configure logs export to CloudWatch for an AWS > RDS > DB Instance as per the AWS > RDS > DB Instance > Logs Export Configuration > * policies.

URI
tmod:@turbot/aws-rds#/control/types/dbInstanceLogsExportConfiguration
Parent
Category
Targets

AWS > RDS > DB Instance > Multi-AZ

Configure Multi-AZ deployment settings on an AWS > RDS > DB Instance.

URI
tmod:@turbot/aws-rds#/control/types/dbInstanceMultiAz
Parent
Category
Targets

AWS > RDS > DB Instance > Parameter Group

Determine whether to check or enforce a specific Parameter Group for this DB Instance.

Use the Parameter Group > Name sub-policy to set which Parameter Group to configure for this instance.

URI
tmod:@turbot/aws-rds#/control/types/dbInstanceParameterGroup
Parent
Category
Targets

AWS > RDS > DB Instance > Performance Insights

Configure performance insights settings for an AWS > RDS > DB Instance as per the AWS > RDS > DB Instance > Performance Insights > * policies.

URI
tmod:@turbot/aws-rds#/control/types/dbInstancePerformanceInsights
Parent
Category
Targets

AWS > RDS > DB Instance > Publicly Accessible

Ensure the RDS instance is not publicly accessible.

URI
tmod:@turbot/aws-rds#/control/types/dbInstancePubliclyAccessible
Parent
Category
Targets

AWS > RDS > DB Instance > Schedule

Set a schedule for starting and stopping an AWS RDS db instance.

Note If both "Schedule" and "Schedule Tag" are set to enforce and the
db instance has a turbot_custom_schedule tag, then the schedule specified by
the tag will be in effect.

URI
tmod:@turbot/aws-rds#/control/types/instanceSchedule
Parent
Category
Targets

AWS > RDS > DB Instance > Tags

Take an action when an AWS RDS db instance tags is not updated based on the AWS > RDS > DB Instance > Tags > * policies.

If the resource is not updated with the tags defined in AWS > RDS > DB Instance > Tags > Template, this control raises an alarm and takes the defined enforcement action.

See Tags for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbInstanceTags
Parent
Category
Targets

AWS > RDS > DB Instance > Usage

The Usage control determines whether the number of AWS RDS db instance resources exceeds the configured usage limit for this region.

You can configure the behavior of this control with the AWS > RDS > DB Instance > Usage policy, and set the limit with the AWS > RDS > DB Instance > Usage > Limit policy.

URI
tmod:@turbot/aws-rds#/control/types/dbInstanceUsage
Parent
Category
Targets

AWS > RDS > DB Parameter Group > Active

Take an action when an AWS RDS db parameter group is not active based on the
AWS > RDS > DB Parameter Group > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > RDS > DB Parameter Group > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbParameterGroupActive
Parent
Category
Targets

AWS > RDS > DB Parameter Group > Approved

Take an action when an AWS RDS db parameter group is not approved based on AWS > RDS > DB Parameter Group > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbParameterGroupApproved
Parent
Category
Targets

AWS > RDS > DB Parameter Group > CMDB

Record and synchronize details for the AWS RDS db parameter group into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > RDS > DB Parameter Group > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI
tmod:@turbot/aws-rds#/control/types/dbParameterGroupCmdb
Parent
Category
Targets

AWS > RDS > DB Parameter Group > Configured

Maintain AWS > RDS > DB Parameter Group configuration.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it.

URI
tmod:@turbot/aws-rds#/control/types/dbParameterGroupConfigured
Parent
Category
Targets

AWS > RDS > DB Parameter Group > Discovery

Discover all AWS RDS db parameter group resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > RDS > DB Parameter Group > Regions policy, the CMDB control will delete the resource from the CMDB.

URI
tmod:@turbot/aws-rds#/control/types/dbParameterGroupDiscovery
Parent
Category
Targets

AWS > RDS > DB Parameter Group > Tags

Take an action when an AWS RDS db parameter group tags is not updated based on the AWS > RDS > DB Parameter Group > Tags > * policies.

If the resource is not updated with the tags defined in AWS > RDS > DB Parameter Group > Tags > Template, this control raises an alarm and takes the defined enforcement action.

See Tags for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbParameterGroupTags
Parent
Category
Targets

AWS > RDS > DB Parameter Group > Usage

The Usage control determines whether the number of AWS RDS db parameter group resources exceeds the configured usage limit for this region.

You can configure the behavior of this control with the AWS > RDS > DB Parameter Group > Usage policy, and set the limit with the AWS > RDS > DB Parameter Group > Usage > Limit policy.

URI
tmod:@turbot/aws-rds#/control/types/dbParameterGroupUsage
Parent
Category
Targets

AWS > RDS > DB Snapshot [Manual] > Active

Take an action when an AWS RDS db snapshot [manual] is not active based on the
AWS > RDS > DB Snapshot [Manual] > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > RDS > DB Snapshot [Manual] > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbSnapshotManualActive
Parent
Category
Targets

AWS > RDS > DB Snapshot [Manual] > Approved

Take an action when an AWS RDS db snapshot [manual] is not approved based on AWS > RDS > DB Snapshot [Manual] > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbSnapshotManualApproved
Parent
Category
Targets

AWS > RDS > DB Snapshot [Manual] > CMDB

Record and synchronize details for the AWS RDS db snapshot [manual] into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > RDS > DB Snapshot [Manual] > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI
tmod:@turbot/aws-rds#/control/types/dbSnapshotManualCmdb
Parent
Category
Targets

AWS > RDS > DB Snapshot [Manual] > Configured

Maintain AWS > RDS > DB Snapshot [Manual] configuration.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it.

URI
tmod:@turbot/aws-rds#/control/types/dbSnapshotManualConfigured
Parent
Category
Targets

AWS > RDS > DB Snapshot [Manual] > Discovery

Discover all AWS RDS db snapshot [manual] resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > RDS > DB Snapshot [Manual] > Regions policy, the CMDB control will delete the resource from the CMDB.

URI
tmod:@turbot/aws-rds#/control/types/dbSnapshotManualDiscovery
Parent
Category
Targets

AWS > RDS > DB Snapshot [Manual] > Tags

Take an action when an AWS RDS db snapshot [manual] tags is not updated based on the AWS > RDS > DB Snapshot [Manual] > Tags > * policies.

If the resource is not updated with the tags defined in AWS > RDS > DB Snapshot [Manual] > Tags > Template, this control raises an alarm and takes the defined enforcement action.

See Tags for more information.

URI
tmod:@turbot/aws-rds#/control/types/dbSnapshotManualTags
Parent
Category
Targets

AWS > RDS > DB Snapshot [Manual] > Trusted Access

Manage trusted access for AWS RDS DB Snapshot [Manual]s.

AWS allows RDS DB Snapshot [Manual]s to be shared with specific AWS accounts.
This control allows you to configure whether such sharing is allowed, and to which accounts.

If set to Enforce, access to non-trusted accounts will be removed.

URI
tmod:@turbot/aws-rds#/control/types/dbSnapshotManualTrustedAccess
Parent
Category
Targets

AWS > RDS > DB Snapshot [Manual] > Usage

The Usage control determines whether the number of AWS RDS db snapshot [manual] resources exceeds the configured usage limit for this region.

You can configure the behavior of this control with the AWS > RDS > DB Snapshot [Manual] > Usage policy, and set the limit with the AWS > RDS > DB Snapshot [Manual] > Usage > Limit policy.

URI
tmod:@turbot/aws-rds#/control/types/dbSnapshotManualUsage
Parent
Category
Targets

AWS > RDS > Global Cluster > Active

Take an action when an AWS RDS global cluster is not active based on the
AWS > RDS > Global Cluster > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > RDS > Global Cluster > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-rds#/control/types/globalClusterActive
Parent
Category
Targets

AWS > RDS > Global Cluster > Approved

Take an action when an AWS RDS global cluster is not approved based on AWS > RDS > Global Cluster > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-rds#/control/types/globalClusterApproved
Parent
Category
Targets

AWS > RDS > Global Cluster > CMDB

Record and synchronize details for the AWS RDS global cluster into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

URI
tmod:@turbot/aws-rds#/control/types/globalClusterCmdb
Parent
Category
Targets

AWS > RDS > Global Cluster > Discovery

Discover all AWS RDS global cluster resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

URI
tmod:@turbot/aws-rds#/control/types/globalClusterDiscovery
Parent
Category
Targets

AWS > RDS > Option Group > Active

Take an action when an AWS RDS option group is not active based on the
AWS > RDS > Option Group > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > RDS > Option Group > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-rds#/control/types/optionGroupActive
Parent
Category
Targets

AWS > RDS > Option Group > Approved

Take an action when an AWS RDS option group is not approved based on AWS > RDS > Option Group > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-rds#/control/types/optionGroupApproved
Parent
Category
Targets

AWS > RDS > Option Group > CMDB

Record and synchronize details for the AWS RDS option group into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > RDS > Option Group > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI
tmod:@turbot/aws-rds#/control/types/optionGroupCmdb
Parent
Category
Targets

AWS > RDS > Option Group > Configured

Maintain AWS > RDS > Option Group configuration.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it.

URI
tmod:@turbot/aws-rds#/control/types/optionGroupConfigured
Parent
Category
Targets

AWS > RDS > Option Group > Discovery

Discover all AWS RDS option group resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > RDS > Option Group > Regions policy, the CMDB control will delete the resource from the CMDB.

URI
tmod:@turbot/aws-rds#/control/types/optionGroupDiscovery
Parent
Category
Targets

AWS > RDS > Option Group > Tags

Take an action when an AWS RDS option group tags is not updated based on the AWS > RDS > Option Group > Tags > * policies.

If the resource is not updated with the tags defined in AWS > RDS > Option Group > Tags > Template, this control raises an alarm and takes the defined enforcement action.

See Tags for more information.

URI
tmod:@turbot/aws-rds#/control/types/optionGroupTags
Parent
Category
Targets

AWS > RDS > Option Group > Usage

The Usage control determines whether the number of AWS RDS option group resources exceeds the configured usage limit for this region.

You can configure the behavior of this control with the AWS > RDS > Option Group > Usage policy, and set the limit with the AWS > RDS > Option Group > Usage > Limit policy.

URI
tmod:@turbot/aws-rds#/control/types/optionGroupUsage
Parent
Category
Targets

AWS > RDS > Stack

Configure a custom stack on AWS, per the custom Stack > Source.

A Guardrails Stack is a set of resources configured by Guardrails, as specified
via Terraform source. Stacks are responsible for the creation and deletion
of multiple resources. Once created, stack resources are responsible for
configuring themselves from the stack source via their Configured control.

URI
tmod:@turbot/aws-rds#/control/types/rdsStack
Parent
Category
Targets

AWS > RDS > Subnet Group > Active

Take an action when an AWS RDS subnet group is not active based on the
AWS > RDS > Subnet Group > Active > * policies.

The Active control determines whether the resource is in active use, and if not, has
the ability to delete / cleanup the resource. When running an automated compliance
environment, it's common to end up with a wide range of alarms that are difficult
and time consuming to clear. The Active control brings automated, well-defined
control to this process.

The Active control checks the status of all defined Active policies for the
resource (AWS > RDS > Subnet Group > Active > *),
raises an alarm, and takes the defined enforcement action. Each Active
sub-policy can calculate a status of active, inactive or skipped. Generally,
if the resource appears to be Active for any reason it will be considered Active.

Note the contrast with Approved, where if the resource appears to be Unapproved
for any reason it will be considered Unapproved.

See Active for more information.

URI
tmod:@turbot/aws-rds#/control/types/subnetGroupActive
Parent
Category
Targets

AWS > RDS > Subnet Group > Approved

Take an action when an AWS RDS subnet group is not approved based on AWS > RDS > Subnet Group > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI
tmod:@turbot/aws-rds#/control/types/subnetGroupApproved
Parent
Category
Targets

AWS > RDS > Subnet Group > CMDB

Record and synchronize details for the AWS RDS subnet group into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > RDS > Subnet Group > Regions policy, the CMDB control will delete the resource from the CMDB. (Note: Setting CMDB to Skip will also pause these changes.)

URI
tmod:@turbot/aws-rds#/control/types/subnetGroupCmdb
Parent
Category
Targets

AWS > RDS > Subnet Group > Configured

Maintain AWS > RDS > Subnet Group configuration.

Note: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored
and inherit from the stack that owns it.

URI
tmod:@turbot/aws-rds#/control/types/subnetGroupConfigured
Parent
Category
Targets

AWS > RDS > Subnet Group > Discovery

Discover all AWS RDS subnet group resources and add them to the CMDB.

The Discovery control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the CMDB control.

Note that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in AWS > RDS > Subnet Group > Regions policy, the CMDB control will delete the resource from the CMDB.

URI
tmod:@turbot/aws-rds#/control/types/subnetGroupDiscovery
Parent
Category
Targets

AWS > RDS > Subnet Group > Tags

Take an action when an AWS RDS subnet group tags is not updated based on the AWS > RDS > Subnet Group > Tags > * policies.

If the resource is not updated with the tags defined in AWS > RDS > Subnet Group > Tags > Template, this control raises an alarm and takes the defined enforcement action.

See Tags for more information.

URI
tmod:@turbot/aws-rds#/control/types/subnetGroupTags
Parent
Category
Targets

AWS > RDS > Subnet Group > Usage

The Usage control determines whether the number of AWS RDS subnet group resources exceeds the configured usage limit for this region.

You can configure the behavior of this control with the AWS > RDS > Subnet Group > Usage policy, and set the limit with the AWS > RDS > Subnet Group > Usage > Limit policy.

URI
tmod:@turbot/aws-rds#/control/types/subnetGroupUsage
Parent
Category
Targets