| Info |
|---|
Use this This article is to define the criteria for a custom Compliance Engine policy request. |
...
Policy create request workflow:
Customer creates Create a service request for every required policy.
Customer provides Provide the following information:
Policy details
Policy logic and evaluation criteria
Violation details
Set of test objects
Policy The policy request is forwarded to policy development team.
Policy The policy is coded and tested against set of test objects (2.d):
Development team might require additional feedback and elaboration on the provided policy logic if they notice a discrepancy between the requested logic and provided test objects.
SLA will be on hold while inconsistency will be addressed.
Policy The policy is delivered to the organization where set of test objects (2.d) exists.
Request The request is closed.
Policy update workflow:
Customer opens Open a new service request and links link to the original Policy create request.
Customer provides Provide updates to the original request and outline required changes.
Workflow continues from section 3 of the Policy create workflow.
...
Severity*
Policy Name*
Description*
Tags
* - Required Fields
Example A |
|---|
...
Example B | |
|---|---|
Severity: Low Policy Name: AWS EC2 Reserved Instance Renewal (180 days before expiration) Description: Ensure that your AWS EC2 Reserved Instances are renewed before expiration in order to get a significant discount (up to 75% depending on the commitment term) on the hourly charges. The renewal process consists of purchasing another EC2 Reserved Instance so that Amazon can keep charging you based on the chosen reservation term. Tags: EC2, AWS, RI, Cost |
Example B:
Severity: High Policy Name: AWS S3 Bucket Public 'READ' Access Description: Ensure that your AWS S3 buckets content cannot be publicly listed in order to protect against unauthorized access. An S3 bucket that grants READ (LIST) access to everyone can allow anonymous users to list the objects within the bucket. Tags: S3, AWS, Security |
Policy Logic and Evaluation Criteria
The expected outcome should include all the objects and the condition they should be evaluated at.
Example A |
|---|
...
Example B | |
|---|---|
|
...
|
Example B:
The group will be INCOMPLIANT if the bucket name LIKE '%test% AND (NOT Name LIKE '%public%') AND AWS Account is not = '987654322345' |
Violation Details
Provide details on how to convert input objects into a human-readable violation. Comment on what pattern to use, how to combine fields from objects, what additional fields and objects to update upon violation occurs, etc.
...
The environment should remain static during the whole policy create/update workflow.
SLA and Support
All custom policy requests are handled by the policy development team.
...