Policy Packs

guardrails-samples

This section contains recommendations for configuring identity and access management related options.

AWS CIS v3.0.0 - Section 1 - IAM

main

aws_ec2_instance_instance_profile

Determine whether the IAM instance profile is attached to AWS &gt; EC2 &gt; Instance.&#92;n

instanceProfile

AWS > EC2 > Instance > Instance Profile

aws_ec2_instance_instance_profile_role_name

The IAM instance profile name to be attached to the AWS EC2 instance.&#92;n

instanceProfileName

AWS > EC2 > Instance > Instance Profile > Name

aws_iam_access_key_active

Determine the action to take when an AWS IAM access key, based on the `AWS &gt; IAM &gt; Access Key &gt; Active &gt; *` policies.&#92;n&#92;nThe control determines whether the resource is in active use, and if not,&#92;nhas the ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`AWS &gt; IAM &gt; Access Key &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

accessKeyActive

AWS > IAM > Access Key > Active

aws_iam_access_key_active_age

The age after which the AWS IAM access key&#92;nis no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`AWS &gt; IAM &gt; Access Key &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

accessKeyActiveAge

AWS > IAM > Access Key > Active > Age

aws_iam_access_key_active_last_modified

The number of days since the AWS IAM access key&#92;nwas last modified before it is considered inactive.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`AWS &gt; IAM &gt; Access Key &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

accessKeyActiveLastModified

AWS > IAM > Access Key > Active > Last Modified

aws_iam_access_key_active_latest

Determine if the AWS IAM access key is latest for the user.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`AWS &gt; IAM &gt; Access Key &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

accessKeyActiveLatest

AWS > IAM > Access Key > Active > Latest

aws_iam_access_key_active_recently_used

The number of days since the AWS IAM access key was last used before it is considered inactive.&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`AWS &gt; IAM &gt; Access Key &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

accessKeyActiveRecentlyUsed

AWS > IAM > Access Key > Active > Recently Used

aws_iam_account_password_policy_settings

Check if the IAM account password policy is in sync with the account password settings policies.

accountPasswordPolicySettings

AWS > IAM > Account Password Policy > Settings

aws_iam_account_password_policy_settings_minimum_length

You can specify the minimum number of characters allowed in an IAM user password. You can type any number from 6 to 128.&#92;n&#92;nRefer to [Setting an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) for more information on account password policies.&#92;n

accountPasswordPolicySettingsMinimumLength

AWS > IAM > Account Password Policy > Settings > Minimum Length

aws_iam_account_password_policy_settings_reuse_prevention

You can prevent IAM users from reusing a specified number of previous passwords. You can set the number of previous passwords from 1 to 24, inclusive.&#92;n&#92;nRefer to [Setting an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) for more information on account password policies.&#92;n

accountPasswordPolicySettingsReusePrevention

AWS > IAM > Account Password Policy > Settings > Reuse Prevention

aws_iam_group_inline_policy_statements_approved

Configure IAM Policy Statements checking. This policy defines whether to verify the&#92;npolicy statements are approved, as well as the subsequent action to take on unapproved&#92;nstatements.&#92;n&#92;nRules for all Approved policies will be compiled in Approved &gt; Compiled Rules&#92;nand then evaluated. If set to &quot;Enforce: Delete unapproved&quot;, any unapproved statements&#92;nwill be removed from the policy.&#92;n

groupInlinePolicyStatementsApproved

AWS > IAM > Group > Inline Policy > Statements > Approved

aws_iam_group_inline_policy_statements_approved_admin_access

If set to &quot;Disabled&quot;, IAM Policy statements that allow any action (&#39;*&#39;) on any resource (&#39;*&#39;) will be unapproved.&#92;n

groupInlinePolicyStatementsApprovedAdminAccess

AWS > IAM > Group > Inline Policy > Statements > Approved > Administrator Access

aws_iam_iam_stack_terraform_version

The Version of Terraform to use for this stack.&#92;nSpecify an [npm-style semver](https://docs.npmjs.com/misc/semver) string to&#92;ndetermine which version of the Terraform container&#92;nGuardrails will use to run this stack.&#92;n&#92;nA Guardrails `Stack` is a set of resources configured by Guardrails,&#92;nas specified  via Terraform source.  Stacks are responsible&#92;nfor the creation and deletion of multiple resources. Once created,&#92;nstack resources are responsible for configuring themselves from&#92;nthe stack source via their `Configured` control.&#92;n

iamStackTerraformVersion

AWS > IAM > Stack > Terraform Version

aws_iam_regional_access_analyzer

Configure a custom stack on AWS, per the custom `Stack &gt; Source`.&#92;n&#92;nA Guardrails `Stack` is a set of resources configured by Guardrails, as specified&#92;nvia Terraform source.  Stacks are responsible for the creation and deletion&#92;nof multiple resources. Once created, stack resources are responsible for&#92;nconfiguring themselves from the stack source via their `Configured` control.&#92;n

regionStack

AWS > Region > Stack

aws_iam_regional_access_analyzer_source

The Terraform HCL source used to configure this stack.&#92;n&#92;nA Guardrails `Stack` is a set of resources configured by Guardrails, as specified&#92;nvia Terraform source.  Stacks are responsible for the creation and deletion&#92;nof multiple resources. Once created, stack resources are responsible for&#92;nconfiguring themselves from the stack source via their `Configured` control.&#92;n

regionStackSource

AWS > Region > Stack > Source

aws_iam_role_inline_policy_statements_approved

Configure IAM Policy Statements checking. This policy defines whether to verify the&#92;npolicy statements are approved, as well as the subsequent action to take on unapproved&#92;nstatements.&#92;nRules for all Approved policies will be compiled in Approved &gt; Compiled Rules&#92;nand then evaluated. If set to &quot;Enforce: Delete unapproved&quot;, any unapproved statements&#92;nwill be removed from the policy.&#92;n

roleInlinePolicyStatementsApproved

AWS > IAM > Role > Inline Policy > Statements > Approved

aws_iam_role_inline_policy_statements_approved_admin_access

If set to &quot;Disabled&quot;, IAM Role Inline Policy statements that allow any action (&#39;*&#39;) on any resource (&#39;*&#39;) will be unapproved.&#92;n

roleInlinePolicyStatementsApprovedAdminAccess

AWS > IAM > Role > Inline Policy > Statements > Approved > Administrator Access

aws_iam_server_certificate_active

Determine the action to take when an AWS IAM server certificate, based on the `AWS &gt; IAM &gt; Server Certificate &gt; Active &gt; *` policies.&#92;n&#92;nThe control determines whether the resource is in active use, and if not,&#92;nhas the ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`AWS &gt; IAM &gt; Server Certificate &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

serverCertificateActive

AWS > IAM > Server Certificate > Active

aws_iam_server_certificate_active_expired

Determine if the AWS IAM server certificate has expired.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`AWS &gt; IAM &gt; Server Certificate &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

serverCertificateActiveExpired

AWS > IAM > Server Certificate > Active > Expired

aws_iam_stack

iamStack

AWS > IAM > Stack

aws_iam_stack_source

iamStackSource

AWS > IAM > Stack > Source

aws_iam_statements_approved

statementsApproved

AWS > IAM > Policy > Statements > Approved

aws_iam_statements_approved_rules

An Object Control List (OCL) with a list of filter rules to approve or reject IAM policy statements. Note that the Approved control does not operate directly from this policy, but from the Approved &gt; Compiled Rules. The rules are processed in order, and any built-in Guardrails rules will appear first in the list of compiled rules.&#92;nThis is the last statement, so all unmatched items will be (approved/rejected) by this statement.&#92;n&#92;n_Note_: Removing APPROVE * will reject all the unmatched rules.&#92;n

statementsApprovedRules

AWS > IAM > Policy > Statements > Approved > Rules

aws_iam_user_inline_policy_approved

Determine the action to take when an AWS IAM user inline policy is not approved based on `AWS &gt; IAM &gt; User &gt; Inline Policy &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

userInlinePolicyApproved

AWS > IAM > User > Inline Policy > Approved

aws_iam_user_inline_policy_approved_usage

Determine whether the AWS IAM user inline policy is allowed to exist.&#92;n&#92;nThis policy will be evaluated by the Approved control. If an AWS IAM user inline policy is not approved, it will be subject to the action specified in the `AWS &gt; IAM &gt; User &gt; Inline Policy &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

userInlinePolicyApprovedUsage

AWS > IAM > User > Inline Policy > Approved > Usage

aws_iam_user_inline_policy_statements_approved

userInlinePolicyStatementsApproved

AWS > IAM > User > Inline Policy > Statements > Approved

aws_iam_user_inline_policy_statements_approved_admin_access

If set to &quot;Disabled&quot;, IAM User Inline Policy statements that allow any action (&#39;*&#39;) on any resource (&#39;*&#39;) will be unapproved.&#92;n

userInlinePolicyStatementsApprovedAdminAccess

AWS > IAM > User > Inline Policy > Statements > Approved > Administrator Access

aws_iam_user_login_profile

Configure whether to remove Login Profile for a user. If set to `Enforce: Delete login profile`, the Login Profile for the User will be deleted.

userLoginProfile

AWS > IAM > User > Login Profile

aws_iam_user_policy_attachments_approved

Configure AWS IAM user policy attachments `Approved` checking. This policy&#92;ndefines whether to verify the IAM user attached policies are approved&#92;n(per `Approved &gt; Compiled Rules`), as well as the subsequent action to&#92;ntake on unapproved items.&#92;nIf set to &quot;Enforce: Delete unapproved&quot;, any unapproved attached policy&#92;nwill be removed.&#92;n

userPolicyAttachmentsApproved

AWS > IAM > User > Policy Attachments > Approved

aws_iam_user_policy_attachments_approved_rules

An [Object Control List (OCL)](https://turbot.com/guardrails/docs/reference/ocl) with a list of filter rules&#92;nto approve or reject policies.&#92;nNote that the Approved control does not operate directly from this policy,&#92;nbut from the `Approved &gt; Compiled Rules`.  The rules are processed in order,&#92;nand any built-in Guardrails rules will appear first in the list of compiled rules.&#92;n

Developers