Policy types for @turbot/aws-redshift

Parent

Targets

Valid Value

[
  "Enabled",
  "Disabled",
  "Enabled if AWS > Redshift > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled",
    "Enabled if AWS > Redshift > Enabled"
  ],
  "default": "Enabled"
}

AWS > Redshift > Approved Regions [Default]

A list of AWS regions in which AWS Redshift resources are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy is the default value for all AWS Redshift resources' Approved > Regions policies.

URI

tmod:@turbot/aws-redshift#/policy/types/redshiftApprovedRegionsDefault

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws#/policy/types/approvedRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Redshift > Cluster > Active

Determine the action to take when an AWS Redshift cluster, based on the AWS > Redshift > Cluster > Active > * policies.

The control determines whether the resource is in active use, and if not, has the ability to delete / cleanup the resource. When running an automated compliance environment, it's common to end up with a wide range of alarms that are difficult and time consuming to clear. The Active control brings automated, well-defined control to this process.

The Active control checks the status of all defined Active policies for the resource (AWS > Redshift > Cluster > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Active > Age

The age after which the AWS Redshift cluster is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

The Active control determines whether the resource is in active use, and if not, has the ability to delete / cleanup the resource. When running an automated compliance environment, it's common to end up with a wide range of alarms that are difficult and time consuming to clear. The Active control brings automated, well-defined control to this process.

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterActiveAge

Category

AWS > Redshift > Cluster > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Active > Budget

The impact of the budget state on the active control. This policy allows you to force clusters to inactive based on the current budget state, as reflected in AWS > Account > Budget > State

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterActiveBudget

Category

AWS > Redshift > Cluster > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if Budget > State is Over or higher",
  "Force inactive if Budget > State is Critical or higher",
  "Force inactive if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if Budget > State is Over or higher",
    "Force inactive if Budget > State is Critical or higher",
    "Force inactive if Budget > State is Shutdown"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Active > Last Modified

The number of days since the AWS Redshift cluster was last modified before it is considered inactive.

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterActiveLastModified

Category

AWS > Redshift > Cluster > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Approved

Determine the action to take when an AWS Redshift cluster is not approved based on AWS > Redshift > Cluster > Approved > * policies.

The Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Approved > Budget

The policy allows you to set clusters to unapproved based on the current budget state, as reflected in AWS > Account > Budget > State

This policy will be evaluated by the Approved control. If an AWS Redshift cluster is not matched by the approved list, it will be subject to the action specified in the AWS > Redshift > Cluster > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterApprovedBudget

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Unapproved if Budget > State is Over or higher",
  "Unapproved if Budget > State is Critical or higher",
  "Unapproved if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Unapproved if Budget > State is Over or higher",
    "Unapproved if Budget > State is Critical or higher",
    "Unapproved if Budget > State is Shutdown"
  ],
  "example": [
    "Unapproved if Budget > State is Shutdown"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Approved > Custom

Determine whether the AWS Redshift cluster is allowed to exist. This policy will be evaluated by the Approved control. If an AWS Redshift cluster is not approved, it will be subject to the action specified in the AWS > Redshift > Cluster > Approved policy. See Approved for more information.

Note: The policy value must be a string with a value of Approved, Not approved or Skip, or in the form of YAML objects. The object(s) must contain the key result with its value as Approved or Not approved. A custom title and message can also be added using the keys title and message respectively.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterApprovedCustom

Category

Parent

Targets

Schema

{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Approved > Regions

A list of AWS regions in which AWS Redshift clusters are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS Redshift cluster is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > Redshift > Cluster > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterApprovedRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-redshift#/policy/types/redshiftApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Redshift > Cluster > Approved > Usage

Determine whether the AWS Redshift cluster is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS Redshift cluster is not approved, it will be subject to the action specified in the AWS > Redshift > Cluster > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterApprovedUsage

Category

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > Redshift > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > Redshift > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > Redshift > Enabled"
}

AWS > Redshift > Cluster > Audit Logging

Define the Audit Logging settings required for AWS > Redshift > Cluster.

AWS > Redshift > Cluster provides detailed audit logs information about connection, user and user activity logs in your database. These logs help you to monitor the database for security and troubleshooting purposes, which is a process often referred to as database auditing. The logs are stored in Amazon S3 buckets.

The control changes the audit logging setting of the AWS > Redshift > Cluster and also changes the enable_user_activity_logging parameter of the attached parameter group if sub policy AWS > Redshift > Cluster > Audit Logging > User Activity Logging is set. Also the control triggers reboot if the attached parameter group is modified.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterAuditLogging

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Disabled",
  "Check: Enabled",
  "Check: Enabled to Audit Logging > Bucket",
  "Enforce: Disabled",
  "Enforce: Enabled to Audit Logging > Bucket"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Disabled",
    "Check: Enabled",
    "Check: Enabled to Audit Logging > Bucket",
    "Enforce: Disabled",
    "Enforce: Enabled to Audit Logging > Bucket"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Audit Logging > Bucket

The name of an S3 Bucket to which the cluster audit logs will be delivered.

The S3 Bucket must already exist and the Redshift service must be allowed write access. The bucket can reside in any account but must be in the same region as the cluster. For more information refer here.

example:

  testbucket
  turbotbucket

URI

tmod:@turbot/aws-redshift#/policy/types/clusterAuditLoggingBucket

Category

AWS > Redshift > Cluster > Audit Logging

Parent

Targets

Default Template Input

"{\n  turbotLoggingBucket: policy(uri: \"aws#/policy/types/loggingBucketDefault\")\n}\n"

Default Template

"{% if $.turbotLoggingBucket %}&quot;{{ $.turbotLoggingBucket }}&quot;{% else %}&quot;&quot;{% endif %}"

Schema

{
  "type": "string"
}

AWS > Redshift > Cluster > Audit Logging > Key Prefix

An optional S3 key prefix to which the AWS > Redshift > Cluster audit logs will be written.

The file names of the access logs use the following format: bucket[/prefix]/AWSLogs/AccountID/ServiceName/Region/Year/Month/Day/AccountID_ServiceName_Region_ClusterName_LogType_Timestamp.gz

URI

tmod:@turbot/aws-redshift#/policy/types/clusterAuditLoggingKeyPrefix

Category

AWS > Redshift > Cluster > Audit Logging

Parent

Targets

Schema

{
  "type": "string",
  "pattern": "^.{0,200}$",
  "default": ""
}

AWS > Redshift > Cluster > Audit Logging > User Activity Logging

Define the User Activity Audit Logging settings required for the Cluster.

Enables the user activity logging through the enable_user_activity_logging parameter.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterAuditLoggingUserActivityLogging

Category

AWS > Redshift > Cluster > Audit Logging

Parent

Targets

Valid Value

[
  "Skip",
  "Disabled",
  "Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Disabled",
    "Enabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Backup Retention Period

Ensure the backup retention period is configured to meet policy. Automated snapshots are deleted by AWS at the end of a retention period or when the retention period is set to 0.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterBackupRetentionPeriod

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Backup retention period",
  "Enforce: Backup retention period"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Backup retention period",
    "Enforce: Backup retention period"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Backup Retention Period > Days

The number of days for which the automated snapshots are retained. Automated snapshots are deleted by AWS at the end of a retention period or when the retention period is set to 0.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterBackupRetentionPeriodDays

Category

AWS > Redshift > Cluster > Backup Retention Period

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "maximum": 35,
  "default": 7
}

AWS > Redshift > Cluster > CMDB

Configure whether to record and synchronize details for the AWS Redshift cluster into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Turbot CMDB. All policies and controls in Turbot are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Redshift > Cluster > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-redshift#/policy/types/clusterCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Redshift > Cluster > Encryption at Rest

Define the Encryption at Rest settings required for AWS > Redshift > Cluster.

Encryption at Rest refers specifically to the encryption of data when written to an underlying storage system. This control determines whether the resource is encrypted at rest, and sets encryption to your desired level.

The Encryption at Rest control compares the encryption settings against the encryption policies for the resource (AWS > Redshift > Cluster > Encryption at Rest > *), raises an alarm, and takes the defined enforcement action

URI

tmod:@turbot/aws-redshift#/policy/types/clusterEncryptionAtRest

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: None",
  "Check: None or higher",
  "Check: AWS managed key",
  "Check: AWS managed key or higher",
  "Check: Customer managed key",
  "Check: Encryption at Rest > Customer Managed Key",
  "Enforce: None",
  "Enforce: AWS managed key",
  "Enforce: AWS managed key or higher",
  "Enforce: Customer managed key",
  "Enforce: Encryption at Rest > Customer Managed Key"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: None",
    "Check: None or higher",
    "Check: AWS managed key",
    "Check: AWS managed key or higher",
    "Check: Customer managed key",
    "Check: Encryption at Rest > Customer Managed Key",
    "Enforce: None",
    "Enforce: AWS managed key",
    "Enforce: AWS managed key or higher",
    "Enforce: Customer managed key",
    "Enforce: Encryption at Rest > Customer Managed Key"
  ],
  "example": [
    "Check: None or higher"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Encryption at Rest > Customer Managed Key

Define the KMS key ID for encryption at rest.

Please make sure the key defined in the template has required permissions.

example:
  alias/aws/ebs
  ddc06e04-ce5f-4995-c758-c2b6c510e8fd
  arn:aws:kms:us-east-1:123456789012:key/ddc06e04-ce5f-4995-c758-c2b6c510e8fd
  arn:aws:kms:us-east-1:123456789012:alias/aws/ebs

URI

tmod:@turbot/aws-redshift#/policy/types/clusterEncryptionAtRestCustomerManagedKey

Category

AWS > Redshift > Cluster > Encryption at Rest

Parent

Targets

Resource > Encryption in Transit

Default Template Input

"{\n  defaultKey: policy(uri: \"aws-kms#/policy/types/keyDefaultCustomerManagedKey\")\n}\n"

Default Template

"{{ $.defaultKey }}"

Schema

{
  "anyOf": [
    {
      "type": "string",
      "pattern": "^alias/[a-zA-Z0-9:/_-]{1,249}$"
    },
    {
      "type": "string",
      "pattern": "^[-a-z0-9-]{1,255}$"
    },
    {
      "type": "string",
      "pattern": "^arn:aws(-us-gov|-cn)?:kms:[a-z]{2}(-gov)?-[a-z]+-[0-9]:[0-9]{12}:key/[-a-z0-9-]{1,255}$"
    },
    {
      "type": "string",
      "pattern": "^arn:aws(-us-gov|-cn)?:kms:[a-z]{2}(-gov)?-[a-z]+-[0-9]:[0-9]{12}:alias/[a-zA-Z0-9:/_-]{1,249}$"
    }
  ],
  "tests": [
    {
      "description": "valid - if keyArn",
      "input": "arn:aws:kms:us-east-1:039305405804:key/ddc06e04-ce5f-4995-b758-c2b6c510e8fd"
    },
    {
      "description": "valid - if aliasName",
      "input": "alias/aws/ebs"
    },
    {
      "description": "valid - if keyId",
      "input": "ddc06e04-ce5f-4995-b758-c2b6c510e8fd"
    },
    {
      "description": "valid - if aliasArn",
      "input": "arn:aws:kms:us-east-1:039305405804:alias/aws/ebs"
    }
  ]
}

AWS > Redshift > Cluster > Encryption in Transit

Define the Encryption in Transit settings required for AWS > Redshift > Cluster.

The Encryption in Transit control compares the Encryption in Transit settings against the Encryption in Transit policies for the resource (AWS > Redshift > Cluster > Encryption in Transit), raises an alarm, and takes the defined enforcement action.

The control changes the require_ssl parameter of the attached parameter group. Also the control triggers reboot when the attached parameter group is modified.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterEncryptionInTransit

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Disabled",
  "Check: Enabled",
  "Enforce: Disabled",
  "Enforce: Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Disabled",
    "Check: Enabled",
    "Enforce: Disabled",
    "Enforce: Enabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Parameter Group

Determine whether to check or enforce a specific parameter group for this AWS > Redshift > Cluster.

Use the Parameter Group > Name sub-policy to set which parameter group to configure for this cluster.

When set to Enforce: Set to Parameter Group > Name (Create if missing), this control will create a new parameter group, copy the currently attached parameter group's parameter values over, and then attach the new parameter group. Also the control triggers reboot after attaching a new parameter group.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroup

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Set to Parameter Group > Name",
  "Enforce: Set to Parameter Group > Name",
  "Enforce: Set to Parameter Group > Name (Create if missing)"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Set to Parameter Group > Name",
    "Enforce: Set to Parameter Group > Name",
    "Enforce: Set to Parameter Group > Name (Create if missing)"
  ],
  "example": [
    "Check: Set to Parameter Group > Name"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Parameter Group > Name

The name of a parameter group to use for this cluster.

If the parent Parameter Group policy is set to Enforce: Set to Parameter Group > Name (Create if missing), a new parameter group with this name will be created if it does not already exist, then the currently attached parameter group's parameter values will be copied over.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupName

Category

AWS > Redshift > Cluster > Parameter Group

Parent

Targets

Default Template Input

"{\n  item: cluster { ClusterIdentifier }\n}\n"

Default Template

"turbot-{{ $.item.ClusterIdentifier }}"

Schema

{
  "type": "string",
  "pattern": "^[a-z](?:-?[a-z0-9.]+){0,254}$"
}

AWS > Redshift > Cluster > Publicly Accessible

Ensure the Redshift cluster is not publicly accessible.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterPubliclyAccessible

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Cluster is not publicly accessible",
  "Enforce: Cluster is not publicly accessible"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Cluster is not publicly accessible",
    "Enforce: Cluster is not publicly accessible"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Regions

A list of AWS regions in which AWS Redshift clusters are supported for use.

Any clusters in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-redshift#/policy/types/redshiftRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Redshift > Cluster > Schedule

Set a schedule for starting and stopping an AWS Redshift cluster.

Note If both "Schedule" and "Schedule Tag" are set to enforce and the cluster has a turbot_custom_schedule tag, then the schedule specified by the tag will be in effect.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSchedule

Category

Resource > Schedule

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Business hours (8:00am - 6:00pm on weekdays)",
  "Enforce: Extended business hours (7:00am - 11:00pm on weekdays)",
  "Enforce: Stop for night (stop at 10:00pm every day)",
  "Enforce: Stop for weekend (stop at 10:00pm on Friday)"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Business hours (8:00am - 6:00pm on weekdays)",
    "Enforce: Extended business hours (7:00am - 11:00pm on weekdays)",
    "Enforce: Stop for night (stop at 10:00pm every day)",
    "Enforce: Stop for weekend (stop at 10:00pm on Friday)"
  ],
  "example": [
    "Enforce: Business hours (8:00am - 6:00pm on weekdays)"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Schedule Tag

Allow setting a schedule for starting and stopping an Redshift cluster via the turbot_custom_schedule tag. If the schedule is invalid, no actions will be taken against the cluster.

Note If both "Schedule" and "Schedule Tag" are set to enforce and the cluster has a turbot_custom_schedule, then the schedule specified by the tag will be in effect.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterScheduleTag

Category

Resource > Schedule

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Schedule per turbot_custom_schedule tag"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Schedule per turbot_custom_schedule tag"
  ],
  "example": [
    "Enforce: Schedule per turbot_custom_schedule tag"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Tags

Determine the action to take when an AWS Redshift cluster tags are not updated based on the AWS > Redshift > Cluster > Tags > * policies.

The control ensure AWS Redshift cluster tags include tags defined in AWS > Redshift > Cluster > Tags > Template.

Tags not defined in Cluster Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterTags

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Tags > Template

The template is used to generate the keys and values for AWS Redshift cluster.

Tags not defined in Cluster Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterTagsTemplate

Category

AWS > Redshift > Cluster > Tags

Parent

Targets

Default Template Input

[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-redshift#/policy/types/redshiftTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > Redshift > Cluster > Usage

Configure the number of AWS Redshift clusters that can be used for this region and the current consumption against the limit.

You can configure the behavior of the control with this AWS > Redshift > Cluster > Usage policy.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster > Usage > Limit

Maximum number of items that can be created for this region.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterUsageLimit

Category

AWS > Redshift > Cluster > Usage

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 100
}

AWS > Redshift > Cluster Parameter Group > Active

Determine the action to take when an AWS Redshift cluster parameter group, based on the AWS > Redshift > Cluster Parameter Group > Active > * policies.

The Active control checks the status of all defined Active policies for the resource (AWS > Redshift > Cluster Parameter Group > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Parameter Group > Active > Age

The age after which the AWS Redshift cluster parameter group is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupActiveAge

Category

AWS > Redshift > Cluster Parameter Group > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Parameter Group > Active > Budget

The impact of the budget state on the active control. This policy allows you to force clusterParameterGroups to inactive based on the current budget state, as reflected in AWS > Account > Budget > State

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupActiveBudget

Category

AWS > Redshift > Cluster Parameter Group > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if Budget > State is Over or higher",
  "Force inactive if Budget > State is Critical or higher",
  "Force inactive if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if Budget > State is Over or higher",
    "Force inactive if Budget > State is Critical or higher",
    "Force inactive if Budget > State is Shutdown"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Parameter Group > Active > Last Modified

The number of days since the AWS Redshift cluster parameter group was last modified before it is considered inactive.

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupActiveLastModified

Category

AWS > Redshift > Cluster Parameter Group > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Parameter Group > Approved

Determine the action to take when an AWS Redshift cluster parameter group is not approved based on AWS > Redshift > Cluster Parameter Group > Approved > * policies.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Parameter Group > Approved > Budget

The policy allows you to set cluster parameter groups to unapproved based on the current budget state, as reflected in AWS > Account > Budget > State

This policy will be evaluated by the Approved control. If an AWS Redshift cluster parameter group is not matched by the approved list, it will be subject to the action specified in the AWS > Redshift > Cluster Parameter Group > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupApprovedBudget

Category

AWS > Redshift > Cluster Parameter Group > Approved

Parent

Targets

Valid Value

[
  "Skip",
  "Unapproved if Budget > State is Over or higher",
  "Unapproved if Budget > State is Critical or higher",
  "Unapproved if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Unapproved if Budget > State is Over or higher",
    "Unapproved if Budget > State is Critical or higher",
    "Unapproved if Budget > State is Shutdown"
  ],
  "example": [
    "Unapproved if Budget > State is Shutdown"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Parameter Group > Approved > Custom

Determine whether the AWS Redshift cluster parameter group is allowed to exist. This policy will be evaluated by the Approved control. If an AWS Redshift cluster parameter group is not approved, it will be subject to the action specified in the AWS > Redshift > Cluster Parameter Group > Approved policy. See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupApprovedCustom

Category

AWS > Redshift > Cluster Parameter Group > Approved

Parent

Targets

Schema

{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Parameter Group > Approved > Regions

A list of AWS regions in which AWS Redshift cluster parameter groups are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS Redshift cluster parameter group is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > Redshift > Cluster Parameter Group > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupApprovedRegions

Category

AWS > Redshift > Cluster Parameter Group > Approved

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-redshift#/policy/types/redshiftApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Redshift > Cluster Parameter Group > Approved > Usage

Determine whether the AWS Redshift cluster parameter group is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS Redshift cluster parameter group is not approved, it will be subject to the action specified in the AWS > Redshift > Cluster Parameter Group > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupApprovedUsage

Category

AWS > Redshift > Cluster Parameter Group > Approved

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > Redshift > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > Redshift > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > Redshift > Enabled"
}

AWS > Redshift > Cluster Parameter Group > CMDB

Configure whether to record and synchronize details for the AWS Redshift cluster parameter group into the CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Redshift > Cluster Parameter Group > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Redshift > Cluster Parameter Group > Regions

A list of AWS regions in which AWS Redshift cluster parameter groups are supported for use.

Any cluster parameter groups in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-redshift#/policy/types/redshiftRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Redshift > Cluster Parameter Group > Tags

Determine the action to take when an AWS Redshift cluster parameter group tags are not updated based on the AWS > Redshift > Cluster Parameter Group > Tags > * policies.

The control ensure AWS Redshift cluster parameter group tags include tags defined in AWS > Redshift > Cluster Parameter Group > Tags > Template.

Tags not defined in Cluster Parameter Group Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupTags

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Parameter Group > Tags > Template

The template is used to generate the keys and values for AWS Redshift cluster parameter group.

Tags not defined in Cluster Parameter Group Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupTagsTemplate

Category

AWS > Redshift > Cluster Parameter Group > Tags

Parent

Targets

Default Template Input

[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-redshift#/policy/types/redshiftTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > Redshift > Cluster Parameter Group > Usage

Configure the number of AWS Redshift cluster parameter groups that can be used for this region and the current consumption against the limit.

You can configure the behavior of the control with this AWS > Redshift > Cluster Parameter Group > Usage policy.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Parameter Group > Usage > Limit

Maximum number of items that can be created for this region.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterParameterGroupUsageLimit

Category

AWS > Redshift > Cluster Parameter Group > Usage

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 20
}

AWS > Redshift > Cluster Subnet Group > Active

Determine the action to take when an AWS Redshift cluster subnet group, based on the AWS > Redshift > Cluster Subnet Group > Active > * policies.

The Active control checks the status of all defined Active policies for the resource (AWS > Redshift > Cluster Subnet Group > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSubnetGroupActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Subnet Group > Active > Age

The age after which the AWS Redshift cluster subnet group is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSubnetGroupActiveAge

Category

AWS > Redshift > Cluster Subnet Group > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Subnet Group > Active > Last Modified

The number of days since the AWS Redshift cluster subnet group was last modified before it is considered inactive.

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSubnetGroupActiveLastModified

Category

AWS > Redshift > Cluster Subnet Group > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Subnet Group > Approved

Determine the action to take when an AWS Redshift cluster subnet group is not approved based on AWS > Redshift > Cluster Subnet Group > Approved > * policies.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSubnetGroupApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Subnet Group > Approved > Custom

Determine whether the AWS Redshift cluster subnet group is allowed to exist. This policy will be evaluated by the Approved control. If an AWS Redshift cluster subnet group is not approved, it will be subject to the action specified in the AWS > Redshift > Cluster Subnet Group > Approved policy. See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSubnetGroupApprovedCustom

Category

AWS > Redshift > Cluster Subnet Group > Approved

Parent

Targets

Schema

{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Subnet Group > Approved > Regions

A list of AWS regions in which AWS Redshift cluster subnet groups are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS Redshift cluster subnet group is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > Redshift > Cluster Subnet Group > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSubnetGroupApprovedRegions

Category

AWS > Redshift > Cluster Subnet Group > Approved

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-redshift#/policy/types/redshiftApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Redshift > Cluster Subnet Group > Approved > Usage

Determine whether the AWS Redshift cluster subnet group is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS Redshift cluster subnet group is not approved, it will be subject to the action specified in the AWS > Redshift > Cluster Subnet Group > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSubnetGroupApprovedUsage

Category

AWS > Redshift > Cluster Subnet Group > Approved

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > Redshift > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > Redshift > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > Redshift > Enabled"
}

AWS > Redshift > Cluster Subnet Group > CMDB

Configure whether to record and synchronize details for the AWS Redshift cluster subnet group into the CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Redshift > Cluster Subnet Group > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSubnetGroupCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Redshift > Cluster Subnet Group > Regions

A list of AWS regions in which AWS Redshift cluster subnet groups are supported for use.

Any cluster subnet groups in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSubnetGroupRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-redshift#/policy/types/redshiftRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Redshift > Cluster Subnet Group > Tags

Determine the action to take when an AWS Redshift cluster subnet group tags are not updated based on the AWS > Redshift > Cluster Subnet Group > Tags > * policies.

The control ensure AWS Redshift cluster subnet group tags include tags defined in AWS > Redshift > Cluster Subnet Group > Tags > Template.

Tags not defined in Cluster Subnet Group Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSubnetGroupTags

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Subnet Group > Tags > Template

The template is used to generate the keys and values for AWS Redshift cluster subnet group.

Tags not defined in Cluster Subnet Group Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSubnetGroupTagsTemplate

Category

AWS > Redshift > Cluster Subnet Group > Tags

Parent

Targets

Default Template Input

[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-redshift#/policy/types/redshiftTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > Redshift > Cluster Subnet Group > Usage

Configure the number of AWS Redshift cluster subnet groups that can be used for this region and the current consumption against the limit.

You can configure the behavior of the control with this AWS > Redshift > Cluster Subnet Group > Usage policy.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSubnetGroupUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > Redshift > Cluster Subnet Group > Usage > Limit

Maximum number of items that can be created for this region.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSubnetGroupUsageLimit

Category

AWS > Redshift > Cluster Subnet Group > Usage

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 20
}

AWS > Redshift > Enabled

Configure whether the AWS Redshift service is enabled. This will only affect Turbot managed User Roles and will allow the Turbot managed user to access AWS Redshift service.

Enabled policy allows Turbot managed users to perform all the actions for the service
Enabled: Metadata Only policy allows Turbot managed users to perform only the metadata level actions for the service (like describe*, list*)

Note:

Disabled policy disables the service but does NOT disable the API for Turbot or SuperUsers
All the resource data stored in the Turbot CMDB is considered to be metadata
For more information related to permissions and grant levels, please check the documentation

URI

tmod:@turbot/aws-redshift#/policy/types/redshiftEnabled

Category

Parent

Targets

Valid Value

[
  "Enabled",
  "Enabled: Metadata Only",
  "Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled",
    "Enabled: Metadata Only",
    "Disabled"
  ],
  "example": [
    "Enabled"
  ],
  "default": "Disabled"
}

AWS > Redshift > Manual Cluster Snapshot > Active

Determine the action to take when an AWS Redshift manual cluster snapshot, based on the AWS > Redshift > Manual Cluster Snapshot > Active > * policies.

The Active control checks the status of all defined Active policies for the resource (AWS > Redshift > Manual Cluster Snapshot > Active > *), raises an alarm, and takes the defined enforcement action. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally, if the resource appears to be Active for any reason it will be considered Active. Note the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered Unapproved.

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualActive

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Active",
  "Enforce: Delete inactive with 1 day warning",
  "Enforce: Delete inactive with 3 days warning",
  "Enforce: Delete inactive with 7 days warning",
  "Enforce: Delete inactive with 14 days warning",
  "Enforce: Delete inactive with 30 days warning",
  "Enforce: Delete inactive with 60 days warning",
  "Enforce: Delete inactive with 90 days warning",
  "Enforce: Delete inactive with 180 days warning",
  "Enforce: Delete inactive with 365 days warning"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Active",
    "Enforce: Delete inactive with 1 day warning",
    "Enforce: Delete inactive with 3 days warning",
    "Enforce: Delete inactive with 7 days warning",
    "Enforce: Delete inactive with 14 days warning",
    "Enforce: Delete inactive with 30 days warning",
    "Enforce: Delete inactive with 60 days warning",
    "Enforce: Delete inactive with 90 days warning",
    "Enforce: Delete inactive with 180 days warning",
    "Enforce: Delete inactive with 365 days warning"
  ],
  "example": [
    "Check: Active"
  ],
  "default": "Skip"
}

AWS > Redshift > Manual Cluster Snapshot > Active > Age

The age after which the AWS Redshift manual cluster snapshot is no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualActiveAge

Category

AWS > Redshift > Manual Cluster Snapshot > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if age > 1 day",
  "Force inactive if age > 3 days",
  "Force inactive if age > 7 days",
  "Force inactive if age > 14 days",
  "Force inactive if age > 30 days",
  "Force inactive if age > 60 days",
  "Force inactive if age > 90 days",
  "Force inactive if age > 180 days",
  "Force inactive if age > 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if age > 1 day",
    "Force inactive if age > 3 days",
    "Force inactive if age > 7 days",
    "Force inactive if age > 14 days",
    "Force inactive if age > 30 days",
    "Force inactive if age > 60 days",
    "Force inactive if age > 90 days",
    "Force inactive if age > 180 days",
    "Force inactive if age > 365 days"
  ],
  "example": [
    "Force inactive if age > 90 days"
  ],
  "default": "Skip"
}

AWS > Redshift > Manual Cluster Snapshot > Active > Budget

The impact of the budget state on the active control. This policy allows you to force clusterSnapshotManuals to inactive based on the current budget state, as reflected in AWS > Account > Budget > State

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualActiveBudget

Category

AWS > Redshift > Manual Cluster Snapshot > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Force inactive if Budget > State is Over or higher",
  "Force inactive if Budget > State is Critical or higher",
  "Force inactive if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Force inactive if Budget > State is Over or higher",
    "Force inactive if Budget > State is Critical or higher",
    "Force inactive if Budget > State is Shutdown"
  ],
  "example": [
    "Skip"
  ],
  "default": "Skip"
}

AWS > Redshift > Manual Cluster Snapshot > Active > Last Modified

The number of days since the AWS Redshift manual cluster snapshot was last modified before it is considered inactive.

See Active for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualActiveLastModified

Category

AWS > Redshift > Manual Cluster Snapshot > Active

Parent

Targets

Valid Value

[
  "Skip",
  "Active if last modified <= 1 day",
  "Active if last modified <= 3 days",
  "Active if last modified <= 7 days",
  "Active if last modified <= 14 days",
  "Active if last modified <= 30 days",
  "Active if last modified <= 60 days",
  "Active if last modified <= 90 days",
  "Active if last modified <= 180 days",
  "Active if last modified <= 365 days",
  "Force active if last modified <= 1 day",
  "Force active if last modified <= 3 days",
  "Force active if last modified <= 7 days",
  "Force active if last modified <= 14 days",
  "Force active if last modified <= 30 days",
  "Force active if last modified <= 60 days",
  "Force active if last modified <= 90 days",
  "Force active if last modified <= 180 days",
  "Force active if last modified <= 365 days"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Active if last modified <= 1 day",
    "Active if last modified <= 3 days",
    "Active if last modified <= 7 days",
    "Active if last modified <= 14 days",
    "Active if last modified <= 30 days",
    "Active if last modified <= 60 days",
    "Active if last modified <= 90 days",
    "Active if last modified <= 180 days",
    "Active if last modified <= 365 days",
    "Force active if last modified <= 1 day",
    "Force active if last modified <= 3 days",
    "Force active if last modified <= 7 days",
    "Force active if last modified <= 14 days",
    "Force active if last modified <= 30 days",
    "Force active if last modified <= 60 days",
    "Force active if last modified <= 90 days",
    "Force active if last modified <= 180 days",
    "Force active if last modified <= 365 days"
  ],
  "example": [
    "Active if last modified <= 90 days"
  ],
  "default": "Skip"
}

AWS > Redshift > Manual Cluster Snapshot > Approved

Determine the action to take when an AWS Redshift manual cluster snapshot is not approved based on AWS > Redshift > Manual Cluster Snapshot > Approved > * policies.

For any enforcement actions that specify if new, e.g., Enforce: Delete unapproved if new, this control will only take the enforcement actions for resources created within the last 60 minutes.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualApproved

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Approved",
  "Enforce: Delete unapproved if new"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Approved",
    "Enforce: Delete unapproved if new"
  ],
  "example": [
    "Check: Approved"
  ],
  "default": "Skip"
}

AWS > Redshift > Manual Cluster Snapshot > Approved > Budget

The policy allows you to set manual cluster snapshots to unapproved based on the current budget state, as reflected in AWS > Account > Budget > State

This policy will be evaluated by the Approved control. If an AWS Redshift manual cluster snapshot is not matched by the approved list, it will be subject to the action specified in the AWS > Redshift > Manual Cluster Snapshot > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualApprovedBudget

Category

AWS > Redshift > Manual Cluster Snapshot > Approved

Parent

Targets

Valid Value

[
  "Skip",
  "Unapproved if Budget > State is Over or higher",
  "Unapproved if Budget > State is Critical or higher",
  "Unapproved if Budget > State is Shutdown"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Unapproved if Budget > State is Over or higher",
    "Unapproved if Budget > State is Critical or higher",
    "Unapproved if Budget > State is Shutdown"
  ],
  "example": [
    "Unapproved if Budget > State is Shutdown"
  ],
  "default": "Skip"
}

AWS > Redshift > Manual Cluster Snapshot > Approved > Custom

Determine whether the AWS Redshift manual cluster snapshot is allowed to exist. This policy will be evaluated by the Approved control. If an AWS Redshift manual cluster snapshot is not approved, it will be subject to the action specified in the AWS > Redshift > Manual Cluster Snapshot > Approved policy. See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualApprovedCustom

Category

AWS > Redshift > Manual Cluster Snapshot > Approved

Parent

Targets

Schema

{
  "example": [
    "Approved",
    "Not approved",
    "Skip",
    {
      "result": "Approved"
    },
    {
      "title": "string",
      "result": "Not approved"
    },
    {
      "title": "string",
      "result": "Approved",
      "message": "string"
    },
    [
      {
        "title": "string",
        "result": "Approved",
        "message": "string"
      },
      {
        "title": "string",
        "result": "Not approved",
        "message": "string"
      }
    ]
  ],
  "anyOf": [
    {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,32}$"
          },
          "message": {
            "type": "string",
            "pattern": "^[\\W\\w]{1,128}$"
          },
          "result": {
            "type": "string",
            "pattern": "^(Approved|Not approved|Skip)$"
          }
        },
        "required": [
          "result"
        ],
        "additionalProperties": false
      }
    },
    {
      "type": "object",
      "properties": {
        "title": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,32}$"
        },
        "message": {
          "type": "string",
          "pattern": "^[\\W\\w]{1,128}$"
        },
        "result": {
          "type": "string",
          "pattern": "^(Approved|Not approved|Skip)$"
        }
      },
      "required": [
        "result"
      ],
      "additionalProperties": false
    },
    {
      "type": "string",
      "pattern": "^(Approved|Not approved|Skip)$"
    }
  ],
  "default": "Skip"
}

AWS > Redshift > Manual Cluster Snapshot > Approved > Encryption at Rest

Define the Encryption at Rest settings required for AWS > Redshift > Manual Cluster Snapshot.

The Encryption at Rest control compares the encryption settings against the encryption policies for the resource (AWS > Redshift > Manual Cluster Snapshot > Encryption at Rest > *), raises an alarm, and takes the defined enforcement action

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualEncryptionAtRest

Category

AWS > Redshift > Manual Cluster Snapshot > Approved

Parent

Targets

Valid Value

[
  "None",
  "None or higher",
  "AWS managed key",
  "AWS managed key or higher",
  "Customer managed key",
  "Encryption at Rest > Customer Managed Key"
]

Schema

{
  "type": "string",
  "enum": [
    "None",
    "None or higher",
    "AWS managed key",
    "AWS managed key or higher",
    "Customer managed key",
    "Encryption at Rest > Customer Managed Key"
  ],
  "example": [
    "None or higher"
  ],
  "default": "None or higher"
}

AWS > Redshift > Manual Cluster Snapshot > Approved > Encryption at Rest > Customer Managed Key

Define the KMS key ID for encryption at rest.

Please make sure the key defined in the template has required permissions.

example:
  alias/aws/ebs
  ddc06e04-ce5f-4995-c758-c2b6c510e8fd
  arn:aws:kms:us-east-1:123456789012:key/ddc06e04-ce5f-4995-c758-c2b6c510e8fd
  arn:aws:kms:us-east-1:123456789012:alias/aws/ebs

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualEncryptionAtRestCustomerManagedKey

Category

AWS > Redshift > Manual Cluster Snapshot > Approved > Encryption at Rest

Parent

Targets

Default Template Input

"{\n  defaultKey: policy(uri: \"aws-kms#/policy/types/keyDefaultCustomerManagedKey\")\n}\n"

Default Template

"{{ $.defaultKey }}"

Schema

{
  "anyOf": [
    {
      "type": "string",
      "pattern": "^alias/[a-zA-Z0-9:/_-]{1,249}$"
    },
    {
      "type": "string",
      "pattern": "^[-a-z0-9-]{1,255}$"
    },
    {
      "type": "string",
      "pattern": "^arn:aws(-us-gov|-cn)?:kms:[a-z]{2}(-gov)?-[a-z]+-[0-9]:[0-9]{12}:key/[-a-z0-9-]{1,255}$"
    },
    {
      "type": "string",
      "pattern": "^arn:aws(-us-gov|-cn)?:kms:[a-z]{2}(-gov)?-[a-z]+-[0-9]:[0-9]{12}:alias/[a-zA-Z0-9:/_-]{1,249}$"
    }
  ],
  "tests": [
    {
      "description": "valid - if keyArn",
      "input": "arn:aws:kms:us-east-1:039305405804:key/ddc06e04-ce5f-4995-b758-c2b6c510e8fd"
    },
    {
      "description": "valid - if aliasName",
      "input": "alias/aws/ebs"
    },
    {
      "description": "valid - if keyId",
      "input": "ddc06e04-ce5f-4995-b758-c2b6c510e8fd"
    },
    {
      "description": "valid - if aliasArn",
      "input": "arn:aws:kms:us-east-1:039305405804:alias/aws/ebs"
    }
  ]
}

AWS > Redshift > Manual Cluster Snapshot > Approved > Regions

A list of AWS regions in which AWS Redshift manual cluster snapshots are approved for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy will be evaluated by the Approved control. If an AWS Redshift manual cluster snapshot is created in a region that is not in the approved list, it will be subject to the action specified in the AWS > Redshift > Manual Cluster Snapshot > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualApprovedRegions

Category

AWS > Redshift > Manual Cluster Snapshot > Approved

Parent

Targets

Default Template Input

"{\n  regions: policy(uri: \"tmod:@turbot/aws-redshift#/policy/types/redshiftApprovedRegionsDefault\")\n}\n"

Default Template

"{% if $.regions | length == 0 %} [] {% endif %}{% for item in $.regions %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Redshift > Manual Cluster Snapshot > Approved > Usage

Determine whether the AWS Redshift manual cluster snapshot is allowed to exist.

This policy will be evaluated by the Approved control. If an AWS Redshift manual cluster snapshot is not approved, it will be subject to the action specified in the AWS > Redshift > Manual Cluster Snapshot > Approved policy.

See Approved for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualApprovedUsage

Category

AWS > Redshift > Manual Cluster Snapshot > Approved

Parent

Targets

Valid Value

[
  "Not approved",
  "Approved",
  "Approved if AWS > Redshift > Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Not approved",
    "Approved",
    "Approved if AWS > Redshift > Enabled"
  ],
  "example": [
    "Not approved"
  ],
  "default": "Approved if AWS > Redshift > Enabled"
}

AWS > Redshift > Manual Cluster Snapshot > CMDB

Configure whether to record and synchronize details for the AWS Redshift manual cluster snapshot into the CMDB.

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in AWS > Redshift > Manual Cluster Snapshot > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualCmdb

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

AWS > Redshift > Manual Cluster Snapshot > Regions

A list of AWS regions in which AWS Redshift manual cluster snapshots are supported for use.

Any manual cluster snapshots in a region not listed here will not be recorded in CMDB.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualRegions

Category

Parent

Targets

Default Template Input

"{\n  regions: policyValue(uri:\"tmod:@turbot/aws-redshift#/policy/types/redshiftRegionsDefault\") {\n    value\n  }\n}\n"

Default Template

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

AWS > Redshift > Manual Cluster Snapshot > Tags

Determine the action to take when an AWS Redshift manual cluster snapshot tags are not updated based on the AWS > Redshift > Manual Cluster Snapshot > Tags > * policies.

The control ensure AWS Redshift manual cluster snapshot tags include tags defined in AWS > Redshift > Manual Cluster Snapshot > Tags > Template.

Tags not defined in Manual Cluster Snapshot Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualTags

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Tags are correct",
  "Enforce: Set tags"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Tags are correct",
    "Enforce: Set tags"
  ],
  "example": [
    "Check: Tags are correct"
  ],
  "default": "Skip"
}

AWS > Redshift > Manual Cluster Snapshot > Tags > Template

The template is used to generate the keys and values for AWS Redshift manual cluster snapshot.

Tags not defined in Manual Cluster Snapshot Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualTagsTemplate

Category

AWS > Redshift > Manual Cluster Snapshot > Tags

Parent

Targets

Default Template Input

[
  "{\n  account {\n    turbot {\n      id\n    }\n  }\n}\n",
  "{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws-redshift#/policy/types/redshiftTagsTemplate\" resourceId: \"{{ $.account.turbot.id }}\") {\n    value\n  }\n}\n"
]

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

AWS > Redshift > Manual Cluster Snapshot > Trusted Access

Manage trusted access for AWS Redshift Manual Cluster Snapshots.

AWS allows Redshift Manual Cluster Snapshots to be shared with specific AWS accounts. This policy allows you to configure whether such sharing is allowed, and to which accounts.

If set to Enforce, access to non-trusted accounts will be removed.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualTrustedAccess

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Trusted Access > Accounts",
  "Enforce: Trusted Access > Accounts"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Trusted Access > Accounts",
    "Enforce: Trusted Access > Accounts"
  ],
  "example": [
    "Check: Trusted Access > Accounts"
  ],
  "default": "Skip"
}

AWS > Redshift > Manual Cluster Snapshot > Trusted Access > Accounts

A list of AWS account IDs that are allowed to have access

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualTrustedAccessAccounts

Category

AWS > Redshift > Manual Cluster Snapshot > Trusted Access

Parent

Targets

Default Template Input

"{\n  accounts: policy(uri: \"tmod:@turbot/aws-redshift#/policy/types/redshiftTrustedAccounts\")\n}\n"

Default Template

"{% if $.accounts | length == 0 %}[]{% endif %}{% for item in $.accounts %}- &#39;{{ item }}&#39;\n{% endfor %}"

Schema

{
  "type": "array",
  "items": {
    "type": "string",
    "pattern": "(?:^[0-9]{12}$|^\\*$)"
  }
}

AWS > Redshift > Manual Cluster Snapshot > Usage

Configure the number of AWS Redshift manual cluster snapshots that can be used for this region and the current consumption against the limit.

You can configure the behavior of the control with this AWS > Redshift > Manual Cluster Snapshot > Usage policy.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualUsage

Category

Parent

Targets

Valid Value

[
  "Skip",
  "Check: Usage <= 85% of Limit",
  "Check: Usage <= 100% of Limit"
]

Schema

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Usage <= 85% of Limit",
    "Check: Usage <= 100% of Limit"
  ],
  "example": [
    "Check: Usage <= 85% of Limit"
  ],
  "default": "Skip"
}

AWS > Redshift > Manual Cluster Snapshot > Usage > Limit

Maximum number of items that can be created for this region.

URI

tmod:@turbot/aws-redshift#/policy/types/clusterSnapshotManualUsageLimit

Category

AWS > Redshift > Manual Cluster Snapshot > Usage

Parent

Targets

Schema

{
  "type": "integer",
  "minimum": 0,
  "default": 20
}

AWS > Redshift > Permissions

Configure whether permissions policies are in effect for AWS Redshift.

This setting does not affect account level permissions (AWS/Admin, AWS/Owner, etc)

Note: The behavior of this policy depends on the value of AWS > Permissions.

URI

tmod:@turbot/aws-redshift#/policy/types/redshiftPermissions

Category

Parent

Targets

Valid Value

[
  "Enabled",
  "Disabled",
  "Enabled if AWS > Redshift > Enabled & AWS > Redshift > API Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled",
    "Enabled if AWS > Redshift > Enabled & AWS > Redshift > API Enabled"
  ],
  "example": [
    "Enabled"
  ],
  "default": "Enabled if AWS > Redshift > Enabled & AWS > Redshift > API Enabled"
}

AWS > Redshift > Permissions > Levels

Define the permissions levels that can be used to grant access to an AWS account. Permissions levels defined will appear in the UI to assign access to Turbot users. This policy provides a default for Permissions > Levels in each service, however you can explicitly override the setting for each service if desired

URI

tmod:@turbot/aws-redshift#/policy/types/redshiftPermissionsLevels

Category

AWS > Redshift > Permissions

Parent

Targets

Default Template Input

[
  "{\n  item: account {\n    turbot{\n      id\n    }\n  }\n}\n",
  "{\n  availableLevels: policyValues(filter:\"policyTypeLevel:self resourceId:{{ $.item.turbot.id }} policyTypeId:'tmod:@turbot/aws-iam#/policy/types/permissionsLevelsDefault'\") {\n    items {\n      value\n    }\n  }\n}\n"
]

Default Template

"{% if $.availableLevels.items[0].value | length == 0 %} [] {% endif %}{% for item in $.availableLevels.items[0].value %}- {{ item }}\n{% endfor %}"

Schema

{
  "type": "array",
  "items": {
    "type": "string",
    "enum": [
      "Metadata",
      "ReadOnly",
      "Operator",
      "Admin",
      "Owner"
    ]
  }
}

AWS > Redshift > Permissions > Levels > Modifiers

A map of AWS API to Turbot Permission Level used to customize Turbot's standard permissions. You can add, remove or redefine the mapping of AWS API operations to Turbot permissions levels here.

Note: Modifiers are cumulative - if you add a permission to the Metadata level, it is also added to ReadOnly, Operator and Admin. Modifier policies set here apply ONLY to the AWS level

example:
  - &quot;glacier:createvault&quot;: admin
  - &quot;glacier:ListVaults&quot;: metadata
  - &quot;s3:DeleteBucket&quot;: none

URI

tmod:@turbot/aws-redshift#/policy/types/redshiftPermissionsLevelsModifiers

Category

AWS > Redshift > Permissions > Levels

Parent

Targets

aws-iam#/definitions/awsModifierList

Schema

AWS > Redshift > Permissions > Lockdown

URI

tmod:@turbot/aws-redshift#/policy/types/redshiftPermissionsLockdown

Category

AWS > Redshift > Permissions

Parent

Targets

AWS > Redshift > Permissions > Lockdown > API Boundary

Configure whether the AWS redshift API is enabled for all users and roles in turbot-managed boundary policies.

Note: Disabling the service disables the API for ALL users and roles, and Turbot will have no access to the API.

URI

tmod:@turbot/aws-redshift#/policy/types/redshiftPermissionsLockdownApiBoundary

Category

AWS > Redshift > Permissions > Lockdown

Parent

Targets

Valid Value

[
  "Enabled if AWS > Redshift > API Enabled"
]

Schema

{
  "type": "string",
  "enum": [
    "Enabled if AWS > Redshift > API Enabled"
  ],
  "example": [
    "Enabled if AWS > Redshift > API Enabled"
  ],
  "default": "Enabled if AWS > Redshift > API Enabled"
}

AWS > Redshift > Regions

A list of AWS regions in which AWS Redshift resources are supported for use.

The expected format is an array of regions names. You may use the '*' and '?' wildcard characters.

This policy is the default value for all AWS Redshift resources' Regions policies.

URI

tmod:@turbot/aws-redshift#/policy/types/redshiftRegionsDefault

Category

Parent

Targets

Schema

{
  "allOf": [
    {
      "$ref": "aws#/definitions/regionNameMatcherList"
    },
    {
      "default": [
        "af-south-1",
        "ap-east-1",
        "ap-northeast-1",
        "ap-northeast-2",
        "ap-northeast-3",
        "ap-south-1",
        "ap-southeast-1",
        "ap-southeast-2",
        "ca-central-1",
        "cn-north-1",
        "cn-northwest-1",
        "eu-central-1",
        "eu-north-1",
        "eu-south-1",
        "eu-west-1",
        "eu-west-2",
        "eu-west-3",
        "me-south-1",
        "sa-east-1",
        "us-east-1",
        "us-east-2",
        "us-gov-east-1",
        "us-gov-west-1",
        "us-west-1",
        "us-west-2"
      ]
    }
  ]
}

AWS > Redshift > Tags Template [Default]

A template used to generate the keys and values for AWS Redshift resources.

By default, all Redshift resource Tags > Template policies will use this value.

URI

tmod:@turbot/aws-redshift#/policy/types/redshiftTagsTemplate

Category

Parent

Targets

Default Template Input

"{\n  defaultTags: policyValue(uri:\"tmod:@turbot/aws#/policy/types/defaultTagsTemplate\") {\n    value\n  }\n}\n"

Default Template

"{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}"

Schema

Security > Trusted Access

AWS > Redshift > Trusted Accounts [Default]

List of AWS Accounts that are trusted for access in the AWS Redshift policy.

This policy is used by the Trusted Access control to determine which members of type "account" are allowed to be granted access. You may use the '*' and '?' wildcard characters.

example:
  - &quot;013122550996&quot;
  - &quot;560741234067&quot;

Note: Setting the policy to Empty array will remove all accounts.

URI

tmod:@turbot/aws-redshift#/policy/types/redshiftTrustedAccounts

Category

Parent

Targets

AWS > Turbot > Event Handlers > Events > Rules > Event Sources

Default Template Input

"{\n  trustedAccounts: policyValue(uri:\"tmod:@turbot/aws#/policy/types/trustedAccounts\") {\n    value\n  }\n}\n"

Default Template

"{% if $.trustedAccounts.value | length == 0 %}[]{% else %}{% for item in $.trustedAccounts.value %}- &#39;{{ item }}&#39;\n{% endfor %}{% endif %}"

Schema

{
  "type": "array",
  "items": {
    "type": "string",
    "pattern": "^[0-9]{12}|^\\*$"
  }
}

AWS > Turbot > Event Handlers > Events > Rules > Event Sources > @turbot/aws-redshift

AWS Redshift CloudWatch Events event sources for the Turbot Event Handlers.

URI

tmod:@turbot/aws-redshift#/policy/types/redshiftEventSources

Category

Resource > Configured

Parent

Targets

Schema

{
  "type": "array",
  "items": {
    "type": "string"
  },
  "default": [
    "aws.redshift"
  ]
}

AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-redshift

A read-only policy generated by Turbot that lists the APIs that should be added to the turbot-managed (hard) boundary policy, thereby enabling them to be assigned to users and roles. This value will change depending on the value of the value of the AWS > Redshift > Permissions > Lockdown > API Boundary policy

URI

tmod:@turbot/aws-redshift#/policy/types/awsCompiledApiBoundary

Category

AWS > Turbot > Permissions > Compiled > API Boundary

Parent

Targets

Schema

{
  "type": "array"
}

AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-redshift

A calculated policy that Turbot uses to create a compiled list of ALL permissions for AWS Redshift that is used as input to the stack that manages the Turbot IAM permissions objects.

URI

tmod:@turbot/aws-redshift#/policy/types/awsLevelsCompiled

Category

AWS > Turbot > Permissions > Compiled > Levels

Parent

Targets

aws-iam#/definitions/awsLevelDefinitionList

Schema

AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-redshift

A calculated policy that Turbot uses to create a compiled list of ALL permissions for AWS Redshift that is used as input to the control that manages the IAM stack.

URI

tmod:@turbot/aws-redshift#/policy/types/awsCompiledServicePermissions

Category

AWS > Turbot > Permissions > Compiled > Service Permissions

Parent

Targets