aws.eks¶
Filters¶
json-diff¶
Compute the diff from the current resource to a previous version.
A resource matches the filter if a diff exists between the current resource and the selected revision.
Utilizes config as a resource revision database.
Revisions can be selected by date, against the previous version, and against a locked version (requires use of is-locked filter).
properties:
selector:
enum:
- previous
- date
- locked
selector_value:
type: string
type:
enum:
- json-diff
required:
- type
Permissions - config:GetResourceConfigHistory
kms-key¶
Filter a resource by its associated kms key and optionally the aliasname of the kms key by using ‘c7n:AliasName’
- example:
Match a specific key alias:
policies: - name: dms-encrypt-key-check resource: dms-instance filters: - type: kms-key key: "c7n:AliasName" value: alias/aws/dms
Or match against native key attributes such as KeyManager
, which
more explicitly distinguishes between AWS
and CUSTOMER
-managed
keys. The above policy can also be written as:
policies: - name: dms-aws-managed-key resource: dms-instance filters: - type: kms-key key: KeyManager value: AWS
properties:
default:
type: object
key:
type: string
match-resource:
type: boolean
op:
enum:
- eq
- equal
- ne
- not-equal
- gt
- greater-than
- ge
- gte
- le
- lte
- lt
- less-than
- glob
- regex
- regex-case
- in
- ni
- not-in
- contains
- difference
- intersect
- mod
operator:
enum:
- and
- or
type:
enum:
- kms-key
value:
oneOf:
- type: array
- type: string
- type: boolean
- type: number
- type: 'null'
value_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
value_path:
type: string
value_regex:
type: string
value_type:
enum:
- age
- integer
- expiration
- normalize
- size
- cidr
- cidr_size
- swap
- resource_count
- expr
- unique_size
- date
- version
- float
required:
- type
Permissions - kms:ListKeys, tag:GetResources, kms:ListResourceTags, kms:DescribeKey
Actions¶
associate-encryption-config¶
Action that adds an encryption configuration to an EKS cluster.
- example:
This policy will find all EKS clusters that do not have Secrets encryption set and associate encryption config with the specified keyArn.
policies:
- name: associate-encryption-config
resource: aws.eks
filters:
- type: value
key: encryptionConfig[].provider.keyArn
value: absent
actions:
- type: associate-encryption-config
encryptionConfig:
- provider:
keyArn: alias/eks
resources:
- secrets
properties:
encryptionConfig:
properties:
properties:
provider:
properties:
keyArn:
type: string
type: object
resources:
properties:
enum: secrets
type: array
type: object
type: array
type:
enum:
- associate-encryption-config
Permissions - eks:AssociateEncryptionConfig, kms:DescribeKey
delete¶
Parent base class for filters and actions.
properties:
type:
enum:
- delete
required:
- type
Permissions - eks:DeleteCluster
update-config¶
Parent base class for filters and actions.
oneOf:
- required:
- type
- logging
- required:
- type
- resourcesVpcConfig
- required:
- type
- logging
- resourcesVpcConfig
properties:
logging:
type: object
resourcesVpcConfig:
type: object
type:
enum:
- update-config
Permissions - eks:UpdateClusterConfig