Record and synchronize details for the AWS X-Ray encryption config into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If region is not in `AWS &gt; X-Ray &gt; Encryption Config &gt; Regions` policy, the CMDB control will delete the resource from the CMDB. (**Note**: Setting CMDB to Skip will also pause these changes.)&#92;n

AWS > X-Ray > Encryption Config

AWS > X-Ray > Encryption Config > CMDB

Discover all AWS X-Ray encryption config resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery) control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n&#92;nNote that Discovery and CMDB controls also use the Regions policy associated with the resource. If the region is not in `AWS &gt; X-Ray &gt; Encryption Config &gt; Regions` policy, the CMDB control will delete the resource from the CMDB.&#92;n

AWS > Region

AWS > X-Ray > Encryption Config > Discovery

encryptionConfig

encryptionConfigAka

xray

xrayAka

aws-xray

A read-only policy generated by Guardrails that lists the APIs that&#92;nshould be added to the guardrails-managed (hard) boundary policy,&#92;nthereby enabling them to be assigned to users and roles.&#92;nThis value will change depending on the value of the value of the&#92;n`AWS &gt; X-Ray &gt; Permissions &gt; Lockdown &gt; API Boundary` policy&#92;n

AWS > Turbot > Permissions > Compiled > API Boundary

AWS > Account

AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-xray

A calculated policy that Guardrails uses to create a compiled list of ALL permissions for AWS X-Ray&#92;nthat is used as input to the control that manages the IAM stack.&#92;n

AWS > Turbot > Permissions > Compiled > Service Permissions

AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-xray

A calculated policy that Guardrails uses to create a compiled list of ALL permissions for AWS X-Ray&#92;nthat is used as input to the stack that manages the Guardrails IAM permissions objects.&#92;n

AWS > Turbot > Permissions > Compiled > Levels

AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-xray

Configure whether to record and synchronize details for the AWS X-Ray encryption config into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If region is not in `AWS &gt; X-Ray &gt; Encryption Config &gt; Regions` policy, the CMDB control will delete the resource from the CMDB.&#92;n&#92;n(**Note**: Setting CMDB to **&quot;Skip&quot;** will also pause these changes.)&#92;n

A list of AWS regions in which AWS X-Ray encryption configs are supported for use.&#92;n&#92;nAny encryption configs in a region not listed here will not be recorded in CMDB.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n

AWS > X-Ray > Encryption Config > Regions

Configure whether the AWS X-Ray API is enabled.&#92;n&#92;n**Note:** Disabling the service disables the API for ALL users and roles, and Guardrails will have no access to the API.&#92;n

AWS > X-Ray

AWS > X-Ray > API Enabled

A list of AWS regions in which AWS X-Ray resources are approved for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all AWS X-Ray resources&#39; Approved &gt; Regions policies.&#92;n

AWS > X-Ray > Approved Regions [Default]

Configure whether the AWS X-Ray service is enabled.&#92;nThis will only affect Guardrails managed User Roles and will allow the Guardrails managed user to access AWS X-Ray service.&#92;n  - `Enabled` policy allows Guardrails managed users to perform all the actions for the service&#92;n  - `Enabled: Metadata Only` policy allows Guardrails managed users to perform only the metadata level actions for the service (like `describe*`, `list*`)&#92;n&#92;n**Note:**&#92;n  - `Disabled` policy disables the service but does NOT disable the API for Guardrails or SuperUsers&#92;n  - All the resource data stored in the Guardrails CMDB is considered to be metadata&#92;n  - For more information related to permissions and grant levels, please check the [documentation](https://turbot.com/guardrails/docs/concepts/iam/permissions)&#92;n

AWS > X-Ray > Enabled

AWS X-Ray CloudWatch Events event sources for the Guardrails Event Handlers.&#92;n

AWS > Turbot > Event Handlers > Events > Rules > Event Sources

AWS > Turbot > Event Handlers > Events > Rules > Event Sources > @turbot/aws-xray

AWS > X-Ray > Permissions > Levels

AWS > X-Ray > Permissions > Lockdown

Configure whether permissions policies are in effect for AWS X-Ray.&#92;n&#92;nThis setting does not affect account level permissions (AWS/Admin, AWS/Owner, etc)&#92;n&#92;n**Note:** The behavior of this policy depends on the value of AWS &gt; Permissions.&#92;n

AWS > X-Ray > Permissions

AWS > X-Ray > Permissions > Levels > Modifiers

Define the permissions levels that can be used to grant access to an AWS account.&#92;nPermissions levels defined will appear in the UI to assign access to Guardrails users.&#92;nThis policy provides a default for Permissions &gt; Levels in each service,&#92;nhowever you can explicitly override the setting for each service if desired&#92;n

A map of AWS API to Guardrails Permission Level used to customize Guardrails&#39; standard permissions.&#92;nYou can add, remove or redefine the mapping of AWS API operations to Guardrails permissions levels here.&#92;n&#92;n**Note:** Modifiers are cumulative - if you add a permission to the Metadata level, it is also added to ReadOnly, Operator and Admin.&#92;nModifier policies set here apply ONLY to the AWS level&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;glacier:createvault&quot;: admin&#92;n  - &quot;glacier:ListVaults&quot;: metadata&#92;n  - &quot;s3:DeleteBucket&quot;: none&#92;n```&#92;n

AWS > X-Ray > Permissions > Lockdown > API Boundary

Configure whether the AWS xray API is enabled for all users and roles in guardrails-managed boundary policies.&#92;n&#92;n**Note:** Disabling the service disables the API for ALL users and roles, and Guardrails will have no access to the API.&#92;n

A list of AWS regions in which AWS X-Ray resources are supported for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all AWS X-Ray resources&#39; Regions policies.&#92;n

AWS > X-Ray > Regions

A template used to generate the keys and values for AWS X-Ray resources.&#92;n&#92;nBy default, all X-Ray resource Tags &gt; Template policies will use this value.&#92;n

Mod: aws-xray

Recommended Version

Resource Types

Controls

IAM Roles

Policies