Policy Packs

guardrails-samples

Ensure that RDS instances comply with organizational policies, meet performance and security requirements, and align with best practices for cost management and resource utilization.

Enforce AWS RDS DB Instances Use Specific Engines and Instance Classes

main

aws_rds_db_instance_approved

Determine the action to take when an AWS RDS db instance is not approved based on `AWS &gt; RDS &gt; DB Instance &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

dbInstanceApproved

AWS > RDS > DB Instance > Approved

aws_rds_db_instance_approved_database_engines

A list of database engines that the AWS RDS db instance is approved to use.&#92;n&#92;nThe expected format is an array of database engines. You may use the `*` and `?` wildcard characters (and [more](https://github.com/micromatch/micromatch#matching-features)).&#92;n&#92;nThis policy will be evaluated by the Approved control. If an AWS RDS db instance is not matched by the approved list, it will be subject to the action specified in the `AWS &gt; RDS &gt; DB Instance &gt; Approved` policy.&#92;n&#92;n```&#92;nexample:&#92;n  postgres&#92;n```&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

dbInstanceApprovedDatabaseEngines

AWS > RDS > DB Instance > Approved > Database Engines

aws_rds_db_instance_approved_instance_classes

A list of instance classes that the AWS RDS db instance is approved to use.&#92;n&#92;nThe expected format is an array of instance classes. You may use the `*` and `?` wildcard characters (and [more](https://github.com/micromatch/micromatch#matching-features)).&#92;n&#92;nThis policy will be evaluated by the Approved control. If an AWS RDS db instance is not matched by the approved list, it will be subject to the action specified in the `AWS &gt; RDS &gt; DB Instance &gt; Approved` policy.&#92;n&#92;n```&#92;nexample:&#92;n  db.t2.large&#92;n```&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Policy	Setting	Note
AWS > RDS > DB Instance > Approved	Check: Approved
AWS > RDS > DB Instance > Approved > Database Engines	- "aurora" - "mariadb" - "postgresql"
AWS > RDS > DB Instance > Approved > Instance Classes	- "db.t3.*" - "db.m5.2xlarge"

Policy Settings