Azure > Turbot

Azure > Subscription

Azure > Turbot > IAM

This control fetches the object IDs for primary login names, per Azure &gt; IAM &gt; Login Names policy, to be used in the Azure &gt; Turbot &gt; Permissions &gt; Source policy.&#92;n

Azure > IAM

Azure > IAM > Primary Object ID

Take an action when an Azure IAM role assignment is not active based on the&#92;n`Azure &gt; IAM &gt; Role Assignment &gt; Active &gt; * policies`.&#92;n&#92;nThe Active control determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated compliance&#92;nenvironment, it&#39;s common to end up with a wide range of alarms that are difficult&#92;nand time consuming to clear. The Active control brings automated, well-defined&#92;ncontrol to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`Azure &gt; IAM &gt; Role Assignment &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n&#92;n**Note:** In contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

Azure > IAM > Role Assignment

Azure > IAM > Role Assignment > Active

Azure > IAM > Role Assignment > Active > Age

Azure > IAM > Role Assignment > Active > Last Modified

Take an action when an Azure IAM role assignment is not approved based on `Azure &gt; IAM &gt; Role Assignment &gt; Approved &gt; * policies`.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Azure > IAM > Role Assignment > Approved

Azure > IAM > Role Assignment > Approved > Custom

Azure > IAM > Role Assignment > Approved > Usage

Record and synchronize details for the Azure IAM role assignment into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

Azure > IAM > Role Assignment > CMDB

Maintain Azure &gt; IAM &gt; Role Assignment configuration.&#92;n&#92;n**Note**: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored&#92;nand inherit from the stack that owns it.&#92;n

Azure > IAM > Role Assignment > Configured

Azure > IAM > Role Assignment > Configured > Claim Precedence

Azure > IAM > Role Assignment > Configured > Source

Discover all Azure IAM role assignment resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery) control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

Azure > IAM > Role Assignment > Discovery

Take an action when an Azure IAM role definition is not active based on the&#92;n`Azure &gt; IAM &gt; Role Definition &gt; Active &gt; * policies`.&#92;n&#92;nThe Active control determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated compliance&#92;nenvironment, it&#39;s common to end up with a wide range of alarms that are difficult&#92;nand time consuming to clear. The Active control brings automated, well-defined&#92;ncontrol to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`Azure &gt; IAM &gt; Role Definition &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n&#92;n**Note:** In contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

Azure > IAM > Role Definition

Azure > IAM > Role Definition > Active

Azure > IAM > Role Definition > Active > Age

Azure > IAM > Role Definition > Active > Last Modified

Take an action when an Azure IAM role definition is not approved based on `Azure &gt; IAM &gt; Role Definition &gt; Approved &gt; * policies`.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Azure > IAM > Role Definition > Approved

Azure > IAM > Role Definition > Approved > Custom

Azure > IAM > Role Definition > Approved > Usage

Record and synchronize details for the Azure IAM role definition into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

Azure > IAM > Role Definition > CMDB

Maintain Azure &gt; IAM &gt; Role Definition configuration.&#92;n&#92;n**Note**: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored&#92;nand inherit from the stack that owns it.&#92;n

Azure > IAM > Role Definition > Configured

Azure > IAM > Role Definition > Configured > Claim Precedence

Azure > IAM > Role Definition > Configured > Source

Discover all Azure IAM role definition resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery) control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

Azure > IAM > Role Definition > Discovery

Invalid - Levels includes a non #/permission/levels/* path

Invalid - Types includes a non #/permission/types/* path

azureLevelDefinition

Internal format for Guardrails Levels registrations.

azureLevelDefinitionList

azureModifier

azureModifierLevelReference

azureModifierList

azurePermissionLevelReference

invalid - should not end with multiple **

azurePermissionReference

azurePermissionTypeReference

Internal format for Guardrails Rights registrations.

azureRightDefinition

azureRightDefinitionList

iamAka

roleAka

b3ce4fa8-c8d0-4adc-85f9-a2aa7b1a7387

roleAssignment

invalid - subscription id should not contain special character

invalid - subscription id should not contain underscore

roleAssignmentAka

roleAssignmentId

invalid - pattern should not contain special character

invalid - should not start with uppercase

roleAssignmentName

roleAssignmentServiceNow

516239f1-63e1-4d78-a4de-a74fb236a071

invalid - missing required property roleName

roleDefinition

roleDefinitionId

roleDefinitionServiceNow

roleName

Internal format for Guardrails Azure Levels registrations.

turbotAzureLevelDefinitionList

azure-iam

A calculated policy that Guardrails uses to create a compiled list of ALL&#92;npermissions for Azure IAM that is used as input to the control that manages&#92;nthe IAM stack.&#92;n

Azure > Turbot > Permissions > Compiled > Service Permissions

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-iam

A calculated policy that Guardrails uses to create a compiled list of ALL&#92;npermission levels for Azure IAM that is used as input to the&#92;nstack that manages the Guardrails IAM permissions objects.&#92;n

Azure > Turbot > Permissions > Compiled > Levels

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-iam

Azure > IAM > Enabled

Azure > IAM > Permissions > Levels

Configure whether permissions policies are in effect for Azure IAM&#92;nThis setting does not affect Subscription level permissions (Azure/Admin, Azure/Owner, etc)&#92;n

Azure > IAM > Permissions

Azure > Turbot > Permissions > Compiled > Subscription Permissions

Azure > Turbot > Permissions

Azure > Turbot > Permissions > Compiled

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-aks

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-apimanagement

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-applicationgateway

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-applicationinsights

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-appservice

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-automation

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-compute

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-containerregistry

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-cosmosdb

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-databricks

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-datafactory

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-dns

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-firewall

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-frontdoorservice

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-keyvault

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-loadbalancer

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-loganalytics

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-managedidentity

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-monitor

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-mysql

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-network

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-networkwatcher

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-postgresql

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-recoveryservice

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-relay

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-searchmanagement

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-securitycenter

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-servicebus

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-signalr

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-sql

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-sqlvirtualmachine

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-storage

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-synapseanalytics

A calculated policy that Guardrails uses to create a single list of ALL permissions levels for all services that is used as input to the stack that manages the Guardrails IAM permissions objects.

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-aks

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-apimanagement

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-applicationgateway

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-applicationinsights

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-appservice

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-automation

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-compute

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-containerregistry

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-cosmosdb

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-databricks

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-datafactory

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-dns

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-firewall

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-frontdoorservice

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-keyvault

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-loadbalancer

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-loganalytics

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-managedidentity

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-monitor

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-mysql

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-network

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-networkwatcher

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-postgresql

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-recoveryservice

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-relay

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-searchmanagement

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-securitycenter

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-servicebus

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-signalr

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-sql

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-sqlvirtualmachine

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-storage

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-synapseanalytics

A calculated policy that Guardrails uses to create a single list of ALL permissions for all services that is used as input to the control that manages the IAM stack.

A calculated policy that Guardrails uses to create a single list of ALL permissions for all provider level permissions (Azure/Admin, Azure/Operator, etc) that is used as input to the control that manages the IAM stack

Azure > IAM > Permissions > Levels > Modifiers

Define the permissions levels that can be used to grant access to Storage an&#92;nAzure Subscription.  Permissions levels defined will appear in the UI to assign&#92;naccess to Guardrails users.&#92;n

A map of Azure API to Guardrails Permission Level used to customize Guardrails&#39;&#92;nstandard permissions. You can add, remove or redefine the mapping of&#92;nAzure API operations to Guardrails permissions levels here.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;Microsoft.IAM/IAM/delete&quot;: operator&#92;n  - &quot;Microsoft.IAM/IAM/write&quot;: admin&#92;n  - &quot;Microsoft.IAM/IAM/read&quot;: readonly&#92;n```&#92;n

Configures Guardrails IAM Users, Roles, per Azure &gt; Permissions.

Azure > IAM > Turbot

A HCL format configuration template to create Guardrails permissions policies.

Azure > Turbot > Permissions > Source

Azure > IAM > Login Names > Primary Object ID

A list of user names that should map to this profile.  This policy is used by the event router to map an Azure user to a Guardrails profile, and to grant permissions via Turbot.

Turbot > IAM > Profile

Azure > IAM > Login Names

Azure > Turbot > Permissions > Custom Levels

Azure > Turbot > Permissions > Levels

Azure > Turbot > Permissions > Levels [Default]

Azure > Turbot > Permissions > Terraform Version

Azure > Turbot > Permissions > Role

Configures whether Guardrails will manage permissions in Azure.&#92;n

An ordered list of azure role names  to use as custom Guardrails permission&#92;nlevels for Azure Subscriptions.&#92;n&#92;nLevels in this policy will appear in the Guardrails console as grantable to&#92;nGuardrails users as Azure/Role/{role name}.  When granted access, Guardrails will grant the&#92;nassociated IAM role to the Azure user in the subscription.&#92;n&#92;nNote that the IAM roles must already exist in the Azure Subscription.&#92;n

Azure > Turbot > Permissions > Levels > Modifiers

Define the permissions levels that can be used to grant access to an&#92;nAzure subscription.  Permissions levels defined will appear in the UI to assign&#92;naccess to Guardrails users.&#92;n

Define the permissions levels that can be used to grant access to services&#92;nAzure subscription.  Permissions levels defined will appear in the UI to assign&#92;naccess to Guardrails users.&#92;n&#92;nThis policy provides a default for Permissions &gt; Levels in each service,&#92;nhowever you can explicitly override the setting for each service if desired&#92;n

A map of Azure API to Guardrails Permission Level used to customize Guardrails&#39; standard permissions.&#92;nYou can add, remove or redefine the mapping of Azure API operations to Guardrails permissions levels here.&#92;n&#92;nNote:&#92;n  Modifiers are cumulative - if you add a permission to the metadata level, it is also added to readOnly, operator and admin.&#92;n&#92;n  Modifier policies set here apply ONLY to the Azure levels (Azure/Admin, Azure/Operator, etc),&#92;n  not to the service levels (Azure/Storage/Admin, Azure/Compute/Operator, etc),&#92;n

The Version of Terraform to use for this stack.&#92;nSpecify an [npm-style semver](https://docs.npmjs.com/misc/semver) string to&#92;ndetermine which version of the Terraform container&#92;nGuardrails will use to run this stack.&#92;nA Guardrails `Stack` is a set of resources configured by Turbot,&#92;nas specified  via Terraform source.  Stacks are responsible&#92;nfor the creation and deletion of multiple resources. Once created,&#92;nstack resources are responsible for configuring themselves from&#92;nthe stack source via their `Configured` control.&#92;n

The Azure Object ID of the primary login name, per Azure &gt; IAM &gt; Login Names.  This is a readonly value used by Guardrails for granting permissions.

Determine the action to take when an Azure IAM role assignment, based on the `Azure &gt; IAM &gt; Role Assignment &gt; Active &gt; *` policies.&#92;n&#92;nThe control determines whether the resource is in active use, and if not,&#92;nhas the ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`Azure &gt; IAM &gt; Role Assignment &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n&#92;n**Note:** In contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

The age after which the Azure IAM role assignment&#92;nis no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`Azure &gt; IAM &gt; Role Assignment &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n&#92;n**Note** In contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

The number of days since the Azure IAM role assignment was last modified before it is considered&#92;ninactive.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`Azure &gt; IAM &gt; Role Assignment &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n&#92;n**Note** In contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n

Determine the action to take when an Azure IAM role assignment is not approved based on `Azure &gt; IAM &gt; Role Assignment &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Determine whether the Azure IAM role assignment is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If an Azure IAM role assignment is not approved, it will be subject to the action specified in the `Azure &gt; IAM &gt; Role Assignment &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

string

Determine whether the Azure IAM role assignment is allowed to exist.&#92;n&#92;nThis policy will be evaluated by the Approved control. If an Azure IAM role assignment is not approved, it will be subject to the action specified in the `Azure &gt; IAM &gt; Role Assignment &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Configure whether to record and synchronize details for the Azure IAM role assignment into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

Determine how to configure this resource.&#92;n&#92;n**Note**: If the resource is managed by another stack, then the Skip/Check/Enforce values here are ignored&#92;nand inherit from the stack that owns it.&#92;n&#92;nThe policy values for Azure &gt; IAM &gt; Role Assignment are deprecated and&#92;nreplaced by new values. The deprecated values will be removed in the next major version.&#92;n&#92;n| Deprecated Values                                |  Current Values                                                |&#92;n|--------------------------------------------------|----------------------------------------------------------------|&#92;n| Skip if using Configured &gt; Source                | Skip &#92;&#92;(unless claimed by a stack&#92;&#92;)                             |&#92;n| Check: Configured if using Configured &gt; Source   | Check: Per Configured &gt; Source &#92;&#92;(unless claimed by a stack&#92;&#92;)   |&#92;n| Enforce: Configured if using Configured &gt; Source | Enforce: Per Configured &gt; Source &#92;&#92;(unless claimed by a stack&#92;&#92;) |&#92;n

An ordered list of who is allowed to claim a resource.&#92;nA stack cannot claim a resource if it is already claimed by another&#92;nstack at a higher level of precedence.&#92;n

A HCL or JSON format Terraform configuration source used to configure this resource.

Determine the action to take when an Azure IAM role definition, based on the `Azure &gt; IAM &gt; Role Definition &gt; Active &gt; *` policies.&#92;n&#92;nThe control determines whether the resource is in active use, and if not,&#92;nhas the ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`Azure &gt; IAM &gt; Role Definition &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n&#92;n**Note:** In contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

The age after which the Azure IAM role definition&#92;nis no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`Azure &gt; IAM &gt; Role Definition &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n&#92;n**Note** In contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

The number of days since the Azure IAM role definition was last modified before it is considered&#92;ninactive.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`Azure &gt; IAM &gt; Role Definition &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n&#92;n**Note** In contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n

Determine the action to take when an Azure IAM role definition is not approved based on `Azure &gt; IAM &gt; Role Definition &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

azure_iam_role_definition_approved

Azure CIS v2.0.0 - Section 1 - IAM

Determine whether the Azure IAM role definition is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If an Azure IAM role definition is not approved, it will be subject to the action specified in the `Azure &gt; IAM &gt; Role Definition &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

Mod: azure-iam

Recommended Version

Resource Types

Controls

IAM Roles

Policies

Policy Packs