Custom Build Policy Examples

To create code-based policies for your infrastructure, use these examples as guidance. They showcase how to use different attributes for working with IaC templates.

• Bicep Example
• Terraform Examples
• ARM Example
• Cloud Formation Examples
• Kubernetes Examples
• Secrets Security Examples
• Resource Control - Blocklist Example

Bicep Example

The following example shows how to create a Bicep policy that ensures auditing is enabled for Microsoft SQL servers and their databases. It filters resources to include only Microsoft.Sql/servers and Microsoft.Sql/servers/databases, then verifies that auditing settings are configured and enabled for both resource types.

metadata:
  name: "Ensure that auditing is set to on for SQL servers"
  guidelines: "..."
  category: "logging"
definition:
  and:
    - cond_type: filter
      attribute: resource_type
      operator: within
      value:
        - Microsoft.Sql/servers
        - Microsoft.Sql/servers/databases
    - or:
        - and:
            - cond_type: connection
              resource_types:
                - Microsoft.Sql/servers
              connected_resource_types:
                - Microsoft.Sql/servers/auditingSettings
              operator: exists
            - cond_type: attribute
              resource_types:
                - Microsoft.Sql/servers/auditingSettings
              attribute: properties.state
              operator: equals
              value: Enabled
        - and:
            - cond_type: connection
              resource_types:
                - Microsoft.Sql/servers/databases
              connected_resource_types:
                - Microsoft.Sql/servers/databases/auditingSettings
              operator: exists
            - cond_type: attribute
              resource_types:
                - Microsoft.Sql/servers/databases/auditingSettings
              attribute: properties.state
              operator: equals
              value: Enabled

ARM Example

metadata:
  name: "Ensure Azure Synapse Workspace has extended audit logs"
  guidelines: "..."
  category: "logging"
definition:
  and:
    - cond_type: filter
      attribute: resource_type
      value:
        - Microsoft.Synapse/workspaces
      operator: within
    - cond_type: connection
      resource_types:
        - Microsoft.Synapse/workspaces
      connected_resource_types:
        - Microsoft.Synapse/workspaces/extendedAuditingPolicies
      operator: exists
    - or:
        - and:
            - cond_type: attribute
              resource_types:
                - Microsoft.Synapse/workspaces/extendedAuditingPolicies
              attribute: properties.state
              operator: exists
            - cond_type: attribute
              resource_types:
                - Microsoft.Synapse/workspaces/extendedAuditingPolicies
              attribute: properties.state
              operator: equals
              value: Enabled
        - cond_type: attribute  # This line is correctly indented
          resource_types:
            - Microsoft.Synapse/workspaces/extendedAuditingPolicies
          attribute: properties.state
          operator: not_exists

Terraform Examples

If you are creating policies for Terraform, here are some examples you can use to create a custom build policy.

• Basic Policy Definition
• Policy Definition using AND Attribute
• Policy Definition using AND/OR Logic Attribute
• Policy Definition using OR Attribute
• Connection State
• Array

Basic Policy Definition

In the following example, the attribute is tags.env, where tags is the attribute, and env is the key name you are searching for in a key:value pair of tags. To ensure that every resource has a Department:<something> tag, modify and set the attribute to tags.Department. Note that this is case-sensitive. Use the equals_ignore_case operator for a case-insensitive check.

metadata:
  name: "Check that all resources are tagged with the key - env"
  guidelines: "Tags Governance - in case of the matched condition below -> add a tag of env with one of the values: prod/dev1/dev2/test/stage"
  category: "general"
scope:
  provider: "aws"
definition:
  cond_type: "attribute"
  resource_types: "all"
  attribute: "tags.env"
  operator: "exists"

Policy Definition using AND Attribute

Use the sample guideline to create a two policy definitions using attribute AND.

metadata:
  name: "Org's compute instances should not be t3.micro or t3.nano"
  guidelines: "In order to avoid compute issues in this account - change manually instances to be at least from type t3.small"
  category: "networking"
scope:
  provider: "aws"
definition:
  and:
  - cond_type: "attribute"
    resource_types:
    - "aws_instance"
    attribute: "instance_type"
    operator: "not_equals"
    value: "t3.micro"
  - cond_type: "attribute"
    resource_types:
    - "aws_instance"
    attribute: "instance_type"
    operator: "not_equals"
    value: "t3.nano"

metadata:
  name: "AWS Security rule check"
  guidelines: "AWS Security rule check"
  category: "general"
scope:
  provider: "aws"
definition:
  and:
  - cond_type: "attribute"
    resource_types:
      - "aws_security_group"
    attribute: "ingress[?(@.to_port == 22 & @.from_port == 22)].cidr_blocks[*]"
    operator: "jsonpath_equals"
    value: 0.0.0.0/0
  - cond_type: "attribute"
    resource_types:
      - "aws_security_group"
    attribute: "ingress[?(@.to_port == 443 & @.from_port == 443)].cidr_blocks[?(@ == '8.0.4.19/92')]"
    operator: "jsonpath_equals"
    value: 8.0.4.19/92

Policy Definition using AND/OR Logic Attribute

Use the sample guideline to create a two policy definitions using attribute AND/OR Logic.

metadata:
  name: "Check that all encrypted RDS clusters are tagged with encrypted: true"
  guidelines: "Tags Governance - in case of the matched condition below -> add/modify a tag of encrypted:true"
  category: "secrets"
scope:
  provider: "aws"
definition:
  and:
  - cond_type: "attribute"
    resource_types:
    - "aws_rds_cluster"
    attribute: "tags.encrypted"
    operator: "equals"
    value: "true"
  - or:
    - cond_type: "attribute"
      resource_types:
      - "aws_rds_cluster"
      attribute: "kms_key_id"
      operator: "exists"
    - cond_type: "attribute"
      resource_types:
      - "aws_rds_cluster"
      attribute: "storage_encrypted"
      operator: "equals"
      value: "true"

Policy Definition using OR Attribute

Use the sample guideline to create multiple policy definition using OR.

metadata:
  name: "Ensure all AWS databases have Backup Policy"
  guidelines: "In case of non-compliant resource - add a backup policy configuration for the resource"
  category: "storage"
scope:
  provider: "aws"
definition:
  or:
  - cond_type: "attribute"
    resource_types:
    - "aws_rds_cluster"
    - "aws_db_instance"
    attribute: "backup_retention_period"
    operator: "not_exists"
  - cond_type: "attribute"
    resource_types:
    - "aws_rds_cluster"
    - "aws_db_instance"
    attribute: "backup_retention_period"
    operator: "not_equals"
    value: "0"
  - cond_type: "attribute"
    resource_types:
    - "aws_redshift_cluster"
    attribute: "automated_snapshot_retention_period"
    operator: "not_equals"
    value: "0"
  - cond_type: "attribute"
    resource_types:
    - "aws_dynamodb_table"
    attribute: "point_in_time_recovery"
    operator: "not_equals"
    value: "false"
  - cond_type: "attribute"
    resource_types:
    - "aws_dynamodb_table"
    attribute: "point_in_time_recovery"
    operator: "exists"

Connection State

A Connection State Block indicates a type of resource that has or does not have a connection to another type of resource. Use the sample guideline to create a connection state with attributes and filter.

metadata:
  name: "Ensure all EC2s are connected only to encrypted EBS volumes"
  guidelines: "In case of non-compliant resource - change attached EBS volume's attribute into encrypted=true"
  category: "storage"
scope:
  provider: "aws"
definition:
  and:
  - cond_type: "attribute"
    resource_types:
    - "aws_ebs_volume"
    attribute: "encrypted"
    operator: "equals"
    value: "true"
  - cond_type: "connection"
    resource_types:
    - "aws_volume_attachment"
    connected_resource_types:
    - "aws_ebs_volume"
    operator: "exists"
  - cond_type: "filter"
    attribute: "resource_type"
    value:
    - "aws_ebs_volume"
    operator: "within"

If your connection state is complex using filter and attribute you can use the following sample guidelines.

metadata:
  name: "Ensure all ALBs are connected only to HTTPS listeners"
  guidelines: "In case of non-compliant resource - change the definition of the listener/listener_rul protocol value into HTTPS"
  category: "networking"
scope:
  provider: "aws"
definition:
  and:
  - cond_type: "filter"
    value:
    - "aws_lb"
    attribute: "resource_type"
    operator: "within"
  - cond_type: "attribute"
    resource_types:
    - "aws_lb"
    attribute: "load_balancer_type"
    operator: "equals"
    value: "application"
  - or:
    - cond_type: "connection"
      resource_types:
      - "aws_lb"
      connected_resource_types:
      - "aws_lb_listener"
      operator: "not_exists"
    - and:
      - cond_type: "connection"
        resource_types:
        - "aws_lb"
        connected_resource_types:
        - "aws_lb_listener"
        operator: "exists"
      - cond_type: "attribute"
        resource_types:
        - "aws_lb_listener"
        attribute: "certificate_arn"
        operator: "exists"
      - cond_type: "attribute"
        resource_types:
        - "aws_lb_listener"
        attribute: "ssl_policy"
        operator: "exists"
      - cond_type: "attribute"
        resource_types:
        - "aws_lb_listener"
        attribute: "protocol"
        operator: "equals"
        value: "HTTPS"
      - or:
        - cond_type: "attribute"
          resource_types:
          - "aws_lb_listener"
          attribute: "default_action.redirect.protocol"
          operator: "equals"
          value: "HTTPS"
        - cond_type: "attribute"
          resource_types:
          - "aws_lb_listener"
          attribute: "default_action.redirect.protocol"
          operator: "not_exists"
      - or:
        - cond_type: "connection"
          resource_types:
          - "aws_lb_listener_rule"
          connected_resource_types:
          - "aws_lb_listener"
          operator: "not_exists"
        - and:
          - cond_type: "connection"
            resource_types:
            - "aws_lb_listener_rule"
            connected_resource_types:
            - "aws_lb_listener"
            operator: "exists"
          - or:
            - cond_type: "attribute"
              resource_types:
              - "aws_lb_listener_rule"
              attribute: "default_action.redirect.protocol"
              operator: "equals"
              value: "HTTPS"
            - cond_type: "attribute"
              resource_types:
              - "aws_lb_listener_rule"
              attribute: "default_action.redirect.protocol"
              operator: "not_exists"

metadata:
  name: "Ensure resources allows encrypted ingress communication (SSH)"
  guidelines: "In case of non-compliant resource - change the definition of the security groups protocol into 22"
  category: "networking"
scope:
  provider: "aws"
definition:
  and:
  - cond_type: "filter"
    attribute: "resource_type"
    value:
    - "aws_instance"
    - "aws_elb"
    - "aws_lb"
    - "aws_db_instance"
    - "aws_elasticache_cluster"
    - "aws_emr_cluster"
    - "aws_redshift_cluster"
    - "aws_elasticsearch_domain"
    - "aws_rds_cluster"
    - "aws_efs_mount_target"
    - "aws_efs_file_system"
    - "aws_ecs_service"
    operator: "within"
  - cond_type: "connection"
    resource_types:
    - "aws_instance"
    - "aws_elb"
    - "aws_lb"
    - "aws_db_instance"
    - "aws_elasticache_cluster"
    - "aws_emr_cluster"
    - "aws_redshift_cluster"
    - "aws_elasticsearch_domain"
    - "aws_rds_cluster"
    - "aws_efs_mount_target"
    - "aws_efs_file_system"
    - "aws_ecs_service"
    connected_resource_types:
    - "aws_security_group"
    - "aws_default_security_group"
    operator: "exists"
  - or:
    - cond_type: "attribute"
      resource_types:
      - "aws_security_group"
      - "aws_default_security_group"
      attribute: "ingress.from_port"
      operator: "equals"
      value: "22"
    - cond_type: "attribute"
      resource_types:
      - "aws_security_group"
      - "aws_default_security_group"
      value: "22"
      operator: "equals"
      attribute: "ingress.to_port"
  - or:
    - cond_type: "connection"
      resource_types:
      - "aws_security_group_rule"
      connected_resource_types:
      - "aws_security_group"
      - "aws_default_security_group"
      operator: "not_exists"
    - and:
      - cond_type: "connection"
        resource_types:
        - "aws_security_group_rule"
        connected_resource_types:
        - "aws_security_group"
        - "aws_default_security_group"
        operator: "exists"
      - cond_type: "attribute"
        resource_types:
        - "aws_security_group_rule"
        attribute: "type"
        operator: "equals"
        value: "ingress"
      - or:
        - cond_type: "attribute"
          resource_types:
          - "aws_security_group_rule"
          attribute: "to_port"
          operator: "equals"
          value: "22"
        - cond_type: "attribute"
          resource_types:
          - "aws_security_group_rule"
          attribute: "from_port"
          operator: "equals"
          value: "22"

Array

In addition to creating policies using multiple attributes, you can create a policy to check multiple entries, of the same type, within an array.

For this sample, you want to scan all the Ingress CIDR blocks for this resource to determine if any = 0.0.0.0/0.

metadata:
  name: "Ensure security groups do not allow traffic from all IPs"
  guidelines: "..."
  category: "networking"
scope:
  provider: "aws"
definition:
  cond_type: "attribute"
  resource_types:
    - "aws_security_group"
  attribute: "ingress.*.cidr_blocks"
  operator: "not_contains"
  value: "0.0.0.0/0"

CloudFormation Examples

If you are creating policies for CloudFormation, here are some examples you can use to create a custom build policy code.

• Basic Policy Definition
• Policy Definition using OR Attribute
• Connection State

Basic Policy Definition

Use the sample guideline to create a basic policy definition using one attribute.

metadata:
  name: "Ensure MSK Cluster logging is enabled"
  guidelines: "..."
  category: "logging"
scope:
  provider: "aws"
definition:
  cond_type: attribute
  attribute: KmsKeyId
  operator: exists
  resource_types:
    - AWS::SageMaker::NotebookInstance

Policy Definition using OR Attribute

Use the sample guideline to create multiple policy definition using OR.

metadata:
  name: "Ensure MSK Cluster logging is enabled"
  guidelines: "..."
  category: "logging"
scope:
  provider: "aws"
definition:
  or:
  - cond_type: attribute
    attribute: LoggingInfo.BrokerLogs.S3.Enabled
    operator: equals
    value: true
    resource_types:
      - "AWS::MSK::Cluster"
  - cond_type: attribute
    attribute: LoggingInfo.BrokerLogs.Firehose.Enabled
    operator: equals
    value: true
    resource_types:
      - "AWS::MSK::Cluster"
  - cond_type: attribute
    attribute: LoggingInfo.BrokerLogs.CloudWatchLogs.Enabled
    operator: equals
    value: true
    resource_types:
      - "AWS::MSK::Cluster"

Connection State

A Connection State Block indicates a type of resource that has or does not have a connection to another type of resource. Use the sample guideline to create a connection state with attributes and filter.

metadata:
  name: "Ensure that ALB redirects HTTP requests into HTTPS ones"
  guidelines: "..."
  category: "networking"
scope:
  provider: "aws"
definition:
  and:
  - cond_type: filter
    value:
      - AWS::ElasticLoadBalancingV2::LoadBalancer
    operator: within
    attribute: resource_type
  - or:
    - cond_type: connection
      operator: not_exists
      resource_types:
      - AWS::ElasticLoadBalancingV2::LoadBalancer
      connected_resource_types:
      - AWS::ElasticLoadBalancingV2::Listener
    - and:
      - cond_type: connection
        operator: exists
        resource_types:
        - AWS::ElasticLoadBalancingV2::LoadBalancer
        connected_resource_types:
        - AWS::ElasticLoadBalancingV2::Listener
      - or:
        - and:
          - cond_type: attribute
            attribute: Port
            operator: not_equals
            value: "80"
            resource_types:
            - AWS::ElasticLoadBalancingV2::Listener
          - cond_type: attribute
            attribute: Protocol
            operator: not_equals
            value: HTTP
            resource_types:
            - AWS::ElasticLoadBalancingV2::Listener
        - and:
          - cond_type: attribute
            attribute: Port
            operator: equals
            value: "80"
            resource_types:
            - AWS::ElasticLoadBalancingV2::Listener
          - cond_type: attribute
            attribute: Protocol
            operator: equals
            value: "HTTP"
            resource_types:
            - AWS::ElasticLoadBalancingV2::Listener
          - cond_type: attribute
            attribute: DefaultActions.Type
            operator: equals
            value: "redirect"
            resource_types:
            - AWS::ElasticLoadBalancingV2::Listener
          - cond_type: attribute
            attribute: DefaultActions.RedirectConfig.Port
            operator: equals
            value: "443"
            resource_types:
            - AWS::ElasticLoadBalancingV2::Listener
          - cond_type: attribute
            attribute: DefaultActions.RedirectConfig.Protocol
            operator: equals
            value: "HTTPS"
            resource_types:
            - AWS::ElasticLoadBalancingV2::Listener

Kubernetes Examples

If you are creating policies for Kubernetes, here are some examples you can use to create a custom build policy code.

• Basic Policy Definition
• Connection State

Basic Policy Definition

Use the sample guideline to create a basic policy definition using one attribute.

metadata:
  name: "Basic K8s Policy"
  guidelines: "..."
  category: "Kubernetes"
definition:
  cond_type: "attribute"
  resource_types:
  - "Pod"
  attribute: "spec.containers.*.securityContext.privileged"
  operator: "not_equals"
  value: "true"

Connection State

A Connection State Block indicates a type of resource that has or does not have a connection to another type of resource. Use the sample guideline to create a connection state with attributes and filter.

metadata:
  name: "No ServiceAccount/Node should be able to read all secrets"
  guidelines: "..."
  category: "Kubernetes"
definition:
  and:
    - cond_type: filter
      value:
        - ClusterRoleBinding
        - RoleBinding
      operator: within
      attribute: kind
    - or:
        - cond_type: connection
          operator: not_exists
          resource_types:
            - ClusterRoleBinding
            - RoleBinding
          connected_resource_types:
            - ClusterRole
            - Role
        - cond_type: attribute
          attribute: 'subjects.*.kind'
          operator: not_within
          value:
            - 'Node'
            - 'ServiceAccount'
          resource_types:
            - ClusterRoleBinding
            - RoleBinding
        - and:
            - cond_type: connection
              operator: exists
              resource_types:
                - ClusterRoleBinding
                - RoleBinding
              connected_resource_types:
                - ClusterRole
                - Role
            - or:
              - cond_type: attribute
                attribute: rules.resources
                operator: not_intersects
                value:
                  - 'secrets'
                  - '*'
                resource_types:
                  - ClusterRole
                  - Role
              - cond_type: attribute
                attribute: rules.verbs
                operator: not_intersects
                value:
                  - 'get'
                  - 'watch'
                  - 'list'
                  - '*'
                resource_types:
                  - ClusterRole
                  - Role

Secrets Security Examples

The following examples demonstrate how to create a custom build policy code.

Example #1 Basic Policy Definition

Use the sample guideline to create a basic policy definition using a single attribute.

metadata:
  name: "My secret policy"
  guidelines: "..."
  category: "secrets"
definition:
  cond_type: "secrets"
  value:
    - "[A-Za-z0-9]{8,20}"
    - "my-super-secret-password-regex"

Example #2 Detect Passwords

This policy detects instances where literal strings starting with "password" or "pwd" are used directly in the code or configuration files. This is a security risk because it exposes the actual password value.

metadata:
  name: "Detect password definition"
  guidelines: "Find passwords starting with password|pwd and the value format is not {var}.{var}"
  category: "secrets"
definition:
  cond_type: "secrets"
  value:
    - "(?:password|pass|pwd)\s*[=:|=>|\|\||:=|<]\s*([^.\s]+)(?![.\w])"

Resource Control - Blocklist Example

Define granular resource controls to allow or block specific resource types. The following example demonstrates how to block the creation of aws_sagemaker_model, to ensure that certain resources are reviewed before deployment.

definition:
  cond_type: "resource"
  resource_types:
    - "aws_sagemaker_model"
  operator: "not_exists"