Policy Packs

guardrails-samples

Ensure that only trusted, validated images are used, reducing the risk of security vulnerabilities and ensuring compliance with organizational policies and security standards.

Enforce AWS EC2 Instances Use Approved AMIs and Publisher Accounts

main

aws_ec2_instance_approved

Determine the action to take when an AWS EC2 instance is not approved based on `AWS &gt; EC2 &gt; Instance &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

instanceApproved

AWS > EC2 > Instance > Approved

aws_ec2_instance_approved_image

Determine whether Approved &gt; Image checking is enable for the instance&#92;n

instanceApprovedImage

AWS > EC2 > Instance > Approved > Image

aws_ec2_instance_approved_image_ami_ids

A list of AMI IDs that are approved to be used to launch EC2 Instances.&#92;n&#92;nThe &#39;*&#39; wildcard may be used to allow all AMIs&#92;n&#92;nExamples:&#92;n    - ami-ff81a385&#92;n    - ami-12345678&#92;n

instanceApprovedImageAmiIds

AWS > EC2 > Instance > Approved > Image > AMI IDs

aws_ec2_instance_approved_image_publishers

A list of AWS Account ids who&#39;s images may be used to launch EC2 Instances.  This list may contain:&#92;n  - AWS Account IDs - Approve all images from the specified account&#92;n  - `local` - Approve local images (where the `OwnerId` is the account id of the targeted instance)&#92;n  - `amazon` - Approve amazon images (where imageowneralias == `amazon`)&#92;n  - `aws-marketplace`  - Approve marketplace images (where imageowneralias == `aws-marketplace`)&#92;n&#92;nThe &#39;*&#39; wildcard may be used to allow all AMIs from all publishers.&#92;n&#92;n  Examples:&#92;n     - amazon         # allow all images with `amazon` ImageOwnerAlias&#92;n     - 102837901569   # Allow all images from AWS Account 102837901569&#92;n     - local          # Allow all local images&#92;n

Policy	Setting	Note
AWS > EC2 > Instance > Approved	Check: Approved
AWS > EC2 > Instance > Approved > Image	Approved if ImageId in Image > AMI IDs and Owner in Image > Publishers
AWS > EC2 > Instance > Approved > Image > AMI IDs	- "ami-12345678" - "ami-87654321"
AWS > EC2 > Instance > Approved > Image > Publishers	- "123456789012" - "987654321098"

Policy Settings