Policy Packs

guardrails-samples

Ensure that aged AMIs are properly identified and classified, facilitating their management, compliance with organizational policies, and aiding in decisions related to their retention or deprecation.

Enforce Tags on AMIs if They Are Older Than 14 Days

main

aws_ec2_ami_active

Determine the action to take when an AWS EC2 ami, based on the `AWS &gt; EC2 &gt; AMI &gt; Active &gt; *` policies.&#92;n&#92;nThe control determines whether the resource is in active use, and if not,&#92;nhas the ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`AWS &gt; EC2 &gt; AMI &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

amiActive

AWS > EC2 > AMI > Active

aws_ec2_ami_active_age

The age after which the AWS EC2 ami&#92;nis no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`AWS &gt; EC2 &gt; AMI &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

amiActiveAge

AWS > EC2 > AMI > Active > Age

aws_ec2_ami_tags

Determine the action to take when an AWS EC2 ami tags are not updated based on the `AWS &gt; EC2 &gt; AMI &gt; Tags &gt; *` policies.&#92;n&#92;nThe control ensure AWS EC2 ami tags include tags defined in `AWS &gt; EC2 &gt; AMI &gt; Tags &gt; Template`.&#92;n&#92;nTags not defined in AMI Tags Template will not be modified or deleted. Setting a tag value to `undefined` will result in the tag being deleted.&#92;n&#92;nSee [Tags](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

amiTags

AWS > EC2 > AMI > Tags

aws_ec2_ami_tags_template

The template is used to generate the keys and values for AWS EC2 ami.&#92;n&#92;nTags not defined in AMI Tags Template will not be modified or deleted. Setting a tag value to `undefined` will result in the tag being deleted.&#92;n&#92;nSee [Tags](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

Policy	Setting	Note
AWS > EC2 > AMI > Active	Check: Active
AWS > EC2 > AMI > Active > Age	Force inactive if age > 14 days
AWS > EC2 > AMI > Tags	Check: Tags are correct
AWS > EC2 > AMI > Tags > Template	Calculated

Policy Settings