Ensure that a access key is deactivated on expiration.

Turbot > IAM > Access Key

Turbot > IAM > Access Key > Expiration

Migrate access key schema to the required format for GA of Turbot v5.

Turbot > IAM > Access Key > GA Schema Migration

Turbot > IAM > LDAP Directory

Turbot > IAM > LDAP Directory > Connectivity Test

Take action when a Group Profile is created or is already present in a LDAP directory based on the policy setting configured for the same.&#92;n

Turbot > IAM > Group Profile

Turbot > IAM > Group Profile > LDAP Synchronization

Migrate local directory user schema to the required format for GA of Turbot v5.

Turbot > IAM > Local Directory > User

Turbot > IAM > Local Directory > User > GA Schema Migration

Ensure that a profile is deactivated on expiration.

Turbot > IAM > Profile

Turbot > IAM > Profile > Expiration

Turbot > IAM > Profile > Grants

Determine the action to taken on the grants when a profile is Inactive or Expired&#92;n&#92;nThe control determines whether the profile is an active user, and if not, has the ability to deactivate the grants on the profile.&#92;n

Turbot > IAM > Profile > Grants > Deactivate

Determine the action to taken on the grants when a profile is Inactive.&#92;n&#92;nThe control determines whether the profile is an active user, and if not, has the ability to delete the grants on the profile.&#92;n

Turbot > IAM > Profile > Grants > Delete

Take action when a Profile is created or is already present in a LDAP directory based on the policy setting configured for the same.&#92;n

Turbot > IAM > Profile > LDAP Synchronization

An Access Key including the secret access key.

397eea31-598a-45a4-9f95-3b8a02bde026

accessKey

accessKeyId

alphanumericId

base case with no begin/end and no line breaks

certificate

Defines the identity provider single sign-on (entry point) URL.

directoryEntryPoint

Defines the issuer for the SAML identity provider.

directoryIssuer

directorySignatureAlgorithm

Defines the different statuses for a Directory that can be used with Turbot.

directoryStatus

displayName

email

googleDirectory

groupProfile

Template to calculate the ID for a group profile based on a directory group.

groupProfileIdTemplate

A <a href="https://en.wikipedia.org/wiki/Hostname">DNS hostname</a>.

hostname

Turbot IAM

Turbot

identity

Invalid identity metadata (missing title)

Invalid identity metadata (missing picture)

identityMetadata

A Valid Directory

ldapDirectory

ldapFilter

ldapPassword

localDirectory

Information about the Group in the Turbot Directory.

Admins

localDirectoryGroup

Information about a local directory user.

Joe Bloggs

localDirectoryUser

Defines the name identifier format to request from the identity provider.

nameIdFormat

oAuthClientID

Client Secret setting for an OAuth provider.

oAuthClientSecret

A secret password, usually highly complex and hidden from view.

password

picture

profile

Template to calculate the ID for a profile based on a directory user.

profileIdTemplate

Internal format for Turbot Rights registrations.

Invalid - Levels includes a non #/permission/levels/* path

Invalid - Types includes a non #/permission/types/* path

rightDefinition

rightDefinitionList

A Valid SAML Directory

samlDirectory

secretKey

signRequests

signaturePrivateKey

An SSH Key, not including the private key.

68:df:b2:22:d8:43:5d:36:75:c1:d8:59:c0:8c:22:e8

SSH Key (2e:45:5f:72)

sshKey

sshKeyFingerprint

sshPublicKey

Defines the different statuses for IAM resources in Turbot.

status

tlsClientPrivateKey

turbotDirectory

The server to connect to for authentication via Turbot

turbotDirectoryServer

turbotLevelDefinition

turbotPermissionLevelReference

turbotPermissionTypeReference

Unique identifier in <a href="https://www.uuidgenerator.net/version4">UUID Version 4</a> format.

uuidv4

turbot-iam

Turbot > IAM > Access Key > Expiration > Days

Check if the access key has expired and provide a configurable warning period before enforcement.&#92;n&#92;n`Deactivate expired` will deactivate the key on the expiration day.&#92;n&#92;n`Delete expired` will delete the key on the expiration day.&#92;n&#92;nDuring the warning period, this control will be in Alarm, but the access&#92;nkey remains enabled and functional.&#92;n

Define the maximum age in days for profile access keys.&#92;n&#92;nDefault is `365` days, per the [CIS Password Policy&#92;nGuide](https://www.cisecurity.org/white-papers/cis-password-policy-guide/).&#92;n

A list of Account permissions that Guardrails may use to grant permissions on folders that have aws accounts as children.&#92;n

Turbot > IAM > Permissions > Compiled > Levels

Accountable

Turbot > IAM > Permissions > Compiled > Levels > Account

A list of account permissions that can be granted to accounts&#92;n

Turbot > IAM > Permissions > Account

Turbot > IAM > Permissions > Account > Permission

LDAP synchronizaton for Group Profiles enables synchronization of LDAP Groups in certain intervals of time&#92;nfrom Active Directory.&#92;n&#92;nThe policy can be set on the LDAP Directory as a whole, or on individual Groups Profiles if exceptions are needed.&#92;n

The period in hours after which the password for a Local Directory User is&#92;nconsidered expired. For example, a period of 2160 (90x24) hours will allow&#92;nthe password to be used for up to 90 days before it must be changed.&#92;n&#92;nDefault is `8760` hours (365 days), per the [CIS Password Policy&#92;nGuide](https://www.cisecurity.org/white-papers/cis-password-policy-guide/).&#92;n&#92;nThe maximum allowed value is `8760` hours i.e `365` days.&#92;n&#92;n**Note**: Setting the value to `-1` will never expire the password where as setting the value to `0` will expire the password.&#92;n

Turbot > IAM > Local Directory > User > Password expiration period in hours

Minimum password length for Local Directory Users.&#92;n&#92;nDefault is `14` characters, per the [CIS Password Policy Guide](https://www.cisecurity.org/white-papers/cis-password-policy-guide/).&#92;n

Turbot > IAM > Local Directory > User > Password Minimum Length

Minimum number of lowercase characters required in passwords for Local Directory Users.&#92;n&#92;nDefault is `1`, per the [CIS Password Policy Guide](https://www.cisecurity.org/white-papers/cis-password-policy-guide/).&#92;n

Turbot > IAM > Local Directory > User > Password Minimum Lowercase Characters

Minimum number of numeric characters required in passwords for Local Directory Users.&#92;n&#92;nDefault is `1` character, per the [CIS Password Policy Guide](https://www.cisecurity.org/white-papers/cis-password-policy-guide/).&#92;n

Turbot > IAM > Local Directory > User > Password Minimum Numeric Characters

Minimum number of symbolic characters required in passwords for Local Directory Users.&#92;n&#92;nDefault is `1` character, per the [CIS Password Policy Guide](https://www.cisecurity.org/white-papers/cis-password-policy-guide/).&#92;n

Turbot > IAM > Local Directory > User > Password Minimum Symbolic Characters

Minimum number of uppercase characters required in passwords for Local Directory Users.&#92;n&#92;nDefault is `1`, per the [CIS Password Policy Guide](https://www.cisecurity.org/white-papers/cis-password-policy-guide/).&#92;n

Turbot > IAM > Local Directory > User > Password Minimum Uppercase Characters

Turbot > IAM > Permissions

Turbot > IAM > Permissions > Compiled

Turbot > IAM

Turbot > IAM > Permissions > Compiled > Levels > AWS [Turbot]

Turbot > IAM > Permissions > Compiled > Levels > AWS

Turbot > IAM > Permissions > Compiled > Levels > Azure [Turbot]

Turbot > IAM > Permissions > Compiled > Levels > Azure

Turbot > IAM > Permissions > Compiled > Levels > GCP [Turbot]

Turbot > IAM > Permissions > Compiled > Levels > GCP

Turbot > IAM > Permissions > Compiled > Levels > Turbot

A calculated policy that Turbot uses to create a single list of ALL effective permissions levels for all services.

Grants

Turbot > IAM > Profile > Expiration > Days

Check if a profile has expired and provide a configurable warning period before deactivation. After profile dectivation, any active access keys linked to the profile will no longer be treated as active. To reactivate a profile, a user simply needs to log into the Turbot Console again via their Directory source.

Define the maximum age in days allowed for profiles since last login.

Check if a profile has expired and provide a configurable warning period before deactivating the grants.&#92;n&#92;n`Deactivate grants` will deactivate the grants on the profile.&#92;n

Check if a profile has expired and provide a configurable warning period before deleting the grants.&#92;n&#92;n`Delete grants` will delete the grants on the profile.&#92;n

LDAP synchronizaton for Profiles enables synchronization of LDAP Users in certain intervals of time&#92;nfrom Active Directory.&#92;n&#92;nThe policy can be set on the LDAP Directory as a whole, or on individual Profiles if exceptions are needed.&#92;n

Synchronize the profile groups in SAML during login.

Turbot > IAM > SAML Directory

Turbot > IAM > SAML Directory > Group Synchronization

Session timeout (in minutes) for Turbot authentication tokens used in the user&#92;ninterface and other API sessions. The default is 12 hours.&#92;n&#92;nWhile using the user interface your token will be automatically refreshed on a&#92;nregular basis, so in practice this timeout reflects the period of inactivity&#92;nrather than a fixed session length.&#92;n&#92;nAccess keys are not subject to this timeout. Access keys are long lived tokens&#92;n(with their own expiration) that may used to initiate a session, which then&#92;nhas this timeout.&#92;n

Turbot > Workspace

Turbot > Workspace > Console Session Timeout

A list of turbot permissions that Turbot may use to grant permissions on folders and above.&#92;n

Mod: turbot-iam

Recommended Version

Resource Types

Controls

Policies