Policy Packs

guardrails-samples

Ensure that all data is encrypted when stored, protecting it from unauthorized access and potential breaches, and ensuring compliance with security best practices.

Enforce Encryption at Rest Is Enabled for RDS DB Instances

main

aws_rds_db_instance_approved

Determine the action to take when an AWS RDS db instance is not approved based on `AWS &gt; RDS &gt; DB Instance &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

dbInstanceApproved

AWS > RDS > DB Instance > Approved

aws_rds_db_instance_approved_encryption_at_rest

Define the Encryption at Rest settings required for `AWS &gt; RDS &gt; DB Instance`.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [Encryption at Rest](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest)&#92;ncontrol compares the encryption settings against the encryption policies for the resource&#92;n(`AWS &gt; RDS &gt; DB Instance &gt; Encryption at Rest  &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action&#92;n

dbInstanceEncryptionAtRest

AWS > RDS > DB Instance > Approved > Encryption at Rest

aws_rds_db_instance_approved_encryption_at_rest_customer_managed_key

Define the KMS key ID for encryption at rest.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [Encryption at Rest](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest)&#92;ncontrol compares the encryption settings against the encryption policies for the resource&#92;n(`AWS &gt; RDS &gt; DB Instance &gt; Encryption at Rest  &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action&#92;n&#92;nPlease make sure the key defined in the template has required permissions.&#92;n&#92;n```&#92;nexample:&#92;n  alias/aws/ebs&#92;n  ddc06e04-ce5f-4995-c758-c2b6c510e8fd&#92;n  arn:aws:kms:us-east-1:123456789012:key/ddc06e04-ce5f-4995-c758-c2b6c510e8fd&#92;n  arn:aws:kms:us-east-1:123456789012:alias/aws/ebs&#92;n```&#92;n

Developers