> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/governance/custom-build-policies/custom-build-policy-examples.md).

# Custom Build Policy Examples

To create code-based policies for your infrastructure, use these examples as guidance. They showcase how to use different attributes for working with IaC templates.

* [Bicep Example](#bicep-example)
* [Terraform Examples](#terraform-examples)
* [ARM Example](#arm-example)
* [Cloud Formation Examples](#cloudformation-examples)
* [Kubernetes Examples](#kubernetes-examples)
* [Secrets Security Examples](#ss-examples)
* [Resource Control - Blocklist Example](#resource-blocklist)

## Bicep Example

The following example shows how to create a Bicep policy that ensures auditing is enabled for Microsoft SQL servers and their databases. It filters resources to include only `Microsoft.Sql/servers` and `Microsoft.Sql/servers/databases`, then verifies that auditing settings are configured and enabled for both resource types.

```
metadata:
  name: "Ensure that auditing is set to on for SQL servers"
  guidelines: "..."
  category: "logging"
definition:
  and:
    - cond_type: filter
      attribute: resource_type
      operator: within
      value:
        - Microsoft.Sql/servers
        - Microsoft.Sql/servers/databases
    - or:
        - and:
            - cond_type: connection
              resource_types:
                - Microsoft.Sql/servers
              connected_resource_types:
                - Microsoft.Sql/servers/auditingSettings
              operator: exists
            - cond_type: attribute
              resource_types:
                - Microsoft.Sql/servers/auditingSettings
              attribute: properties.state
              operator: equals
              value: Enabled
        - and:
            - cond_type: connection
              resource_types:
                - Microsoft.Sql/servers/databases
              connected_resource_types:
                - Microsoft.Sql/servers/databases/auditingSettings
              operator: exists
            - cond_type: attribute
              resource_types:
                - Microsoft.Sql/servers/databases/auditingSettings
              attribute: properties.state
              operator: equals
              value: Enabled
```

## ARM Example

```yaml
metadata:
  name: "Ensure Azure Synapse Workspace has extended audit logs"
  guidelines: "..."
  category: "logging"
definition:
  and:
    - cond_type: filter
      attribute: resource_type
      value:
        - Microsoft.Synapse/workspaces
      operator: within
    - cond_type: connection
      resource_types:
        - Microsoft.Synapse/workspaces
      connected_resource_types:
        - Microsoft.Synapse/workspaces/extendedAuditingPolicies
      operator: exists
    - or:
        - and:
            - cond_type: attribute
              resource_types:
                - Microsoft.Synapse/workspaces/extendedAuditingPolicies
              attribute: properties.state
              operator: exists
            - cond_type: attribute
              resource_types:
                - Microsoft.Synapse/workspaces/extendedAuditingPolicies
              attribute: properties.state
              operator: equals
              value: Enabled
        - cond_type: attribute  # This line is correctly indented
          resource_types:
            - Microsoft.Synapse/workspaces/extendedAuditingPolicies
          attribute: properties.state
          operator: not_exists
```

## Terraform Examples

If you are creating policies for Terraform, here are some examples you can use to create a custom build policy.

* [Basic Policy Definition](#t-basic-policy-definition)
* [Policy Definition using AND Attribute](#t-policy-definition-using-and-attribute)
* [Policy Definition using AND/OR Logic Attribute](#t-policy-definition-using-and-or-logic-attribute)
* [Policy Definition using OR Attribute](#t-policy-definition-using-or-attribute)
* [Connection State](#t-connection-state)
* [Array](#t-array-)

### Basic Policy Definition

In the following example, the attribute is `tags.env`, where `tags` is the attribute, and `env` is the key name you are searching for in a key:value pair of tags. To ensure that every resource has a `Department:<something>` tag, modify and set the attribute to `tags.Department`. Note that this is case-sensitive. Use the `equals_ignore_case operator` for a case-insensitive check.

```yaml
metadata:
  name: "Check that all resources are tagged with the key - env"
  guidelines: "Tags Governance - in case of the matched condition below -> add a tag of env with one of the values: prod/dev1/dev2/test/stage"
  category: "general"
scope:
  provider: "aws"
definition:
  cond_type: "attribute"
  resource_types: "all"
  attribute: "tags.env"
  operator: "exists"
```

### Policy Definition using AND Attribute

Use the sample guideline to create a two policy definitions using attribute `AND`.

```yaml
metadata:
  name: "Org's compute instances should not be t3.micro or t3.nano"
  guidelines: "In order to avoid compute issues in this account - change manually instances to be at least from type t3.small"
  category: "networking"
scope:
  provider: "aws"
definition:
  and:
  - cond_type: "attribute"
    resource_types:
    - "aws_instance"
    attribute: "instance_type"
    operator: "not_equals"
    value: "t3.micro"
  - cond_type: "attribute"
    resource_types:
    - "aws_instance"
    attribute: "instance_type"
    operator: "not_equals"
    value: "t3.nano"
```

```yaml
metadata:
  name: "AWS Security rule check"
  guidelines: "AWS Security rule check"
  category: "general"
scope:
  provider: "aws"
definition:
  and:
  - cond_type: "attribute"
    resource_types:
      - "aws_security_group"
    attribute: "ingress[?(@.to_port == 22 & @.from_port == 22)].cidr_blocks[*]"
    operator: "jsonpath_equals"
    value: 0.0.0.0/0
  - cond_type: "attribute"
    resource_types:
      - "aws_security_group"
    attribute: "ingress[?(@.to_port == 443 & @.from_port == 443)].cidr_blocks[?(@ == '8.0.4.19/92')]"
    operator: "jsonpath_equals"
    value: 8.0.4.19/92
```

### Policy Definition using AND/OR Logic Attribute

Use the sample guideline to create a two policy definitions using attribute `AND/OR Logic`.

```yaml
metadata:
  name: "Check that all encrypted RDS clusters are tagged with encrypted: true"
  guidelines: "Tags Governance - in case of the matched condition below -> add/modify a tag of encrypted:true"
  category: "secrets"
scope:
  provider: "aws"
definition:
  and:
  - cond_type: "attribute"
    resource_types:
    - "aws_rds_cluster"
    attribute: "tags.encrypted"
    operator: "equals"
    value: "true"
  - or:
    - cond_type: "attribute"
      resource_types:
      - "aws_rds_cluster"
      attribute: "kms_key_id"
      operator: "exists"
    - cond_type: "attribute"
      resource_types:
      - "aws_rds_cluster"
      attribute: "storage_encrypted"
      operator: "equals"
      value: "true"
```

### Policy Definition using OR Attribute

Use the sample guideline to create multiple policy definition using `OR`.

```yaml
metadata:
  name: "Ensure all AWS databases have Backup Policy"
  guidelines: "In case of non-compliant resource - add a backup policy configuration for the resource"
  category: "storage"
scope:
  provider: "aws"
definition:
  or:
  - cond_type: "attribute"
    resource_types:
    - "aws_rds_cluster"
    - "aws_db_instance"
    attribute: "backup_retention_period"
    operator: "not_exists"
  - cond_type: "attribute"
    resource_types:
    - "aws_rds_cluster"
    - "aws_db_instance"
    attribute: "backup_retention_period"
    operator: "not_equals"
    value: "0"
  - cond_type: "attribute"
    resource_types:
    - "aws_redshift_cluster"
    attribute: "automated_snapshot_retention_period"
    operator: "not_equals"
    value: "0"
  - cond_type: "attribute"
    resource_types:
    - "aws_dynamodb_table"
    attribute: "point_in_time_recovery"
    operator: "not_equals"
    value: "false"
  - cond_type: "attribute"
    resource_types:
    - "aws_dynamodb_table"
    attribute: "point_in_time_recovery"
    operator: "exists"
```

### Connection State

A Connection State Block indicates a type of resource that has or does not have a connection to another type of resource. Use the sample guideline to create a connection state with attributes and filter.

```yaml
metadata:
  name: "Ensure all EC2s are connected only to encrypted EBS volumes"
  guidelines: "In case of non-compliant resource - change attached EBS volume's attribute into encrypted=true"
  category: "storage"
scope:
  provider: "aws"
definition:
  and:
  - cond_type: "attribute"
    resource_types:
    - "aws_ebs_volume"
    attribute: "encrypted"
    operator: "equals"
    value: "true"
  - cond_type: "connection"
    resource_types:
    - "aws_volume_attachment"
    connected_resource_types:
    - "aws_ebs_volume"
    operator: "exists"
  - cond_type: "filter"
    attribute: "resource_type"
    value:
    - "aws_ebs_volume"
    operator: "within"
```

If your connection state is complex using filter and attribute you can use the following sample guidelines.

```yaml
metadata:
  name: "Ensure all ALBs are connected only to HTTPS listeners"
  guidelines: "In case of non-compliant resource - change the definition of the listener/listener_rul protocol value into HTTPS"
  category: "networking"
scope:
  provider: "aws"
definition:
  and:
  - cond_type: "filter"
    value:
    - "aws_lb"
    attribute: "resource_type"
    operator: "within"
  - cond_type: "attribute"
    resource_types:
    - "aws_lb"
    attribute: "load_balancer_type"
    operator: "equals"
    value: "application"
  - or:
    - cond_type: "connection"
      resource_types:
      - "aws_lb"
      connected_resource_types:
      - "aws_lb_listener"
      operator: "not_exists"
    - and:
      - cond_type: "connection"
        resource_types:
        - "aws_lb"
        connected_resource_types:
        - "aws_lb_listener"
        operator: "exists"
      - cond_type: "attribute"
        resource_types:
        - "aws_lb_listener"
        attribute: "certificate_arn"
        operator: "exists"
      - cond_type: "attribute"
        resource_types:
        - "aws_lb_listener"
        attribute: "ssl_policy"
        operator: "exists"
      - cond_type: "attribute"
        resource_types:
        - "aws_lb_listener"
        attribute: "protocol"
        operator: "equals"
        value: "HTTPS"
      - or:
        - cond_type: "attribute"
          resource_types:
          - "aws_lb_listener"
          attribute: "default_action.redirect.protocol"
          operator: "equals"
          value: "HTTPS"
        - cond_type: "attribute"
          resource_types:
          - "aws_lb_listener"
          attribute: "default_action.redirect.protocol"
          operator: "not_exists"
      - or:
        - cond_type: "connection"
          resource_types:
          - "aws_lb_listener_rule"
          connected_resource_types:
          - "aws_lb_listener"
          operator: "not_exists"
        - and:
          - cond_type: "connection"
            resource_types:
            - "aws_lb_listener_rule"
            connected_resource_types:
            - "aws_lb_listener"
            operator: "exists"
          - or:
            - cond_type: "attribute"
              resource_types:
              - "aws_lb_listener_rule"
              attribute: "default_action.redirect.protocol"
              operator: "equals"
              value: "HTTPS"
            - cond_type: "attribute"
              resource_types:
              - "aws_lb_listener_rule"
              attribute: "default_action.redirect.protocol"
              operator: "not_exists"
```

```yaml
metadata:
  name: "Ensure resources allows encrypted ingress communication (SSH)"
  guidelines: "In case of non-compliant resource - change the definition of the security groups protocol into 22"
  category: "networking"
scope:
  provider: "aws"
definition:
  and:
  - cond_type: "filter"
    attribute: "resource_type"
    value:
    - "aws_instance"
    - "aws_elb"
    - "aws_lb"
    - "aws_db_instance"
    - "aws_elasticache_cluster"
    - "aws_emr_cluster"
    - "aws_redshift_cluster"
    - "aws_elasticsearch_domain"
    - "aws_rds_cluster"
    - "aws_efs_mount_target"
    - "aws_efs_file_system"
    - "aws_ecs_service"
    operator: "within"
  - cond_type: "connection"
    resource_types:
    - "aws_instance"
    - "aws_elb"
    - "aws_lb"
    - "aws_db_instance"
    - "aws_elasticache_cluster"
    - "aws_emr_cluster"
    - "aws_redshift_cluster"
    - "aws_elasticsearch_domain"
    - "aws_rds_cluster"
    - "aws_efs_mount_target"
    - "aws_efs_file_system"
    - "aws_ecs_service"
    connected_resource_types:
    - "aws_security_group"
    - "aws_default_security_group"
    operator: "exists"
  - or:
    - cond_type: "attribute"
      resource_types:
      - "aws_security_group"
      - "aws_default_security_group"
      attribute: "ingress.from_port"
      operator: "equals"
      value: "22"
    - cond_type: "attribute"
      resource_types:
      - "aws_security_group"
      - "aws_default_security_group"
      value: "22"
      operator: "equals"
      attribute: "ingress.to_port"
  - or:
    - cond_type: "connection"
      resource_types:
      - "aws_security_group_rule"
      connected_resource_types:
      - "aws_security_group"
      - "aws_default_security_group"
      operator: "not_exists"
    - and:
      - cond_type: "connection"
        resource_types:
        - "aws_security_group_rule"
        connected_resource_types:
        - "aws_security_group"
        - "aws_default_security_group"
        operator: "exists"
      - cond_type: "attribute"
        resource_types:
        - "aws_security_group_rule"
        attribute: "type"
        operator: "equals"
        value: "ingress"
      - or:
        - cond_type: "attribute"
          resource_types:
          - "aws_security_group_rule"
          attribute: "to_port"
          operator: "equals"
          value: "22"
        - cond_type: "attribute"
          resource_types:
          - "aws_security_group_rule"
          attribute: "from_port"
          operator: "equals"
          value: "22"
```

### Array

In addition to creating policies using multiple attributes, you can create a policy to check multiple entries, of the same type, within an array.

For this sample, you want to scan all the Ingress CIDR blocks for this resource to determine if any = 0.0.0.0/0.

```yaml
metadata:
  name: "Ensure security groups do not allow traffic from all IPs"
  guidelines: "..."
  category: "networking"
scope:
  provider: "aws"
definition:
  cond_type: "attribute"
  resource_types:
    - "aws_security_group"
  attribute: "ingress.*.cidr_blocks"
  operator: "not_contains"
  value: "0.0.0.0/0"
```

## CloudFormation Examples

If you are creating policies for CloudFormation, here are some examples you can use to create a custom build policy code.

* [Basic Policy Definition](#cf-basic-policy-definition)
* [Policy Definition using OR Attribute](#cf-policy-definition-using-or-attribute)
* [Connection State](#cf-connection-state)

### Basic Policy Definition

Use the sample guideline to create a basic policy definition using one attribute.

```yaml
metadata:
  name: "Ensure MSK Cluster logging is enabled"
  guidelines: "..."
  category: "logging"
scope:
  provider: "aws"
definition:
  cond_type: attribute
  attribute: KmsKeyId
  operator: exists
  resource_types:
    - AWS::SageMaker::NotebookInstance
```

### Policy Definition using OR Attribute

Use the sample guideline to create multiple policy definition using `OR`.

```yaml
metadata:
  name: "Ensure MSK Cluster logging is enabled"
  guidelines: "..."
  category: "logging"
scope:
  provider: "aws"
definition:
  or:
  - cond_type: attribute
    attribute: LoggingInfo.BrokerLogs.S3.Enabled
    operator: equals
    value: true
    resource_types:
      - "AWS::MSK::Cluster"
  - cond_type: attribute
    attribute: LoggingInfo.BrokerLogs.Firehose.Enabled
    operator: equals
    value: true
    resource_types:
      - "AWS::MSK::Cluster"
  - cond_type: attribute
    attribute: LoggingInfo.BrokerLogs.CloudWatchLogs.Enabled
    operator: equals
    value: true
    resource_types:
      - "AWS::MSK::Cluster"
```

### Connection State

A Connection State Block indicates a type of resource that has or does not have a connection to another type of resource. Use the sample guideline to create a connection state with attributes and filter.

```yaml
metadata:
  name: "Ensure that ALB redirects HTTP requests into HTTPS ones"
  guidelines: "..."
  category: "networking"
scope:
  provider: "aws"
definition:
  and:
  - cond_type: filter
    value:
      - AWS::ElasticLoadBalancingV2::LoadBalancer
    operator: within
    attribute: resource_type
  - or:
    - cond_type: connection
      operator: not_exists
      resource_types:
      - AWS::ElasticLoadBalancingV2::LoadBalancer
      connected_resource_types:
      - AWS::ElasticLoadBalancingV2::Listener
    - and:
      - cond_type: connection
        operator: exists
        resource_types:
        - AWS::ElasticLoadBalancingV2::LoadBalancer
        connected_resource_types:
        - AWS::ElasticLoadBalancingV2::Listener
      - or:
        - and:
          - cond_type: attribute
            attribute: Port
            operator: not_equals
            value: "80"
            resource_types:
            - AWS::ElasticLoadBalancingV2::Listener
          - cond_type: attribute
            attribute: Protocol
            operator: not_equals
            value: HTTP
            resource_types:
            - AWS::ElasticLoadBalancingV2::Listener
        - and:
          - cond_type: attribute
            attribute: Port
            operator: equals
            value: "80"
            resource_types:
            - AWS::ElasticLoadBalancingV2::Listener
          - cond_type: attribute
            attribute: Protocol
            operator: equals
            value: "HTTP"
            resource_types:
            - AWS::ElasticLoadBalancingV2::Listener
          - cond_type: attribute
            attribute: DefaultActions.Type
            operator: equals
            value: "redirect"
            resource_types:
            - AWS::ElasticLoadBalancingV2::Listener
          - cond_type: attribute
            attribute: DefaultActions.RedirectConfig.Port
            operator: equals
            value: "443"
            resource_types:
            - AWS::ElasticLoadBalancingV2::Listener
          - cond_type: attribute
            attribute: DefaultActions.RedirectConfig.Protocol
            operator: equals
            value: "HTTPS"
            resource_types:
            - AWS::ElasticLoadBalancingV2::Listener
```

## Kubernetes Examples

If you are creating policies for Kubernetes, here are some examples you can use to create a custom build policy code.

* [Basic Policy Definition](#k-basic-policy-definition)
* [Connection State](#k-connection-state)

### Basic Policy Definition

Use the sample guideline to create a basic policy definition using one attribute.

```yaml
metadata:
  name: "Basic K8s Policy"
  guidelines: "..."
  category: "Kubernetes"
definition:
  cond_type: "attribute"
  resource_types:
  - "Pod"
  attribute: "spec.containers.*.securityContext.privileged"
  operator: "not_equals"
  value: "true"
```

### Connection State

A Connection State Block indicates a type of resource that has or does not have a connection to another type of resource. Use the sample guideline to create a connection state with attributes and filter.

```yaml
metadata:
  name: "No ServiceAccount/Node should be able to read all secrets"
  guidelines: "..."
  category: "Kubernetes"
definition:
  and:
    - cond_type: filter
      value:
        - ClusterRoleBinding
        - RoleBinding
      operator: within
      attribute: kind
    - or:
        - cond_type: connection
          operator: not_exists
          resource_types:
            - ClusterRoleBinding
            - RoleBinding
          connected_resource_types:
            - ClusterRole
            - Role
        - cond_type: attribute
          attribute: 'subjects.*.kind'
          operator: not_within
          value:
            - 'Node'
            - 'ServiceAccount'
          resource_types:
            - ClusterRoleBinding
            - RoleBinding
        - and:
            - cond_type: connection
              operator: exists
              resource_types:
                - ClusterRoleBinding
                - RoleBinding
              connected_resource_types:
                - ClusterRole
                - Role
            - or:
              - cond_type: attribute
                attribute: rules.resources
                operator: not_intersects
                value:
                  - 'secrets'
                  - '*'
                resource_types:
                  - ClusterRole
                  - Role
              - cond_type: attribute
                attribute: rules.verbs
                operator: not_intersects
                value:
                  - 'get'
                  - 'watch'
                  - 'list'
                  - '*'
                resource_types:
                  - ClusterRole
                  - Role
```

## Secrets Security Examples

The following examples demonstrate how to create a custom build policy code.

### Example #1 Basic Policy Definition

Use the sample guideline to create a basic policy definition using a single attribute.

```yaml
metadata:
  name: "My secret policy"
  guidelines: "..."
  category: "secrets"
definition:
  cond_type: "secrets"
  value:
    - "[A-Za-z0-9]{8,20}"
    - "my-super-secret-password-regex"
```

### Example #2 Detect Passwords

This policy detects instances where literal strings starting with "password" or "pwd" are used directly in the code or configuration files. This is a security risk because it exposes the actual password value.

```
metadata:
  name: "Detect password definition"
  guidelines: "Find passwords starting with password|pwd and the value format is not {var}.{var}"
  category: "secrets"
definition:
  cond_type: "secrets"
  value:
    - "(?:password|pass|pwd)\s*[=:|=>|\|\||:=|<]\s*([^.\s]+)(?![.\w])"
```

## Resource Control - Blocklist Example

Define granular resource controls to allow or block specific resource types. The following example demonstrates how to block the creation of `aws_sagemaker_model`, to ensure that certain resources are reviewed before deployment.

```
definition:
  cond_type: "resource"
  resource_types:
    - "aws_sagemaker_model"
  operator: "not_exists"
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/governance/custom-build-policies/custom-build-policy-examples.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.