RDS subnet group.
Compute the diff from the current resource to a previous version.
A resource matches the filter if a diff exists between the current resource and the selected revision.
Utilizes config as a resource revision database.
Revisions can be selected by date, against the previous version, and against a locked version (requires use of is-locked filter).
properties: selector: enum: - previous - date - locked selector_value: type: string type: enum: - json-diff required: - type
Permissions - config:GetResourceConfigHistory
Filters all launch rds subnet groups that are not in use but exist
policies: - name: rds-subnet-group-delete-unused resource: rds-subnet-group filters: - unused
properties: type: enum: - unused required: - type
Permissions - rds:DescribeDBInstances
Action to delete RDS Subnet Group
It is recommended to apply a filter to the delete policy to avoid unwanted deletion of any rds subnet groups.
policies: - name: rds-subnet-group-delete resource: rds-subnet-group filters: - Instances:  actions: - delete
properties: type: enum: - delete required: - type
Permissions - rds:DeleteDBSubnetGroup
Rename an existing tag key to a new value.
rename Application, and Bap to App, if a resource has both of the old keys then we’ll use the value specified by Application, which is based on the order of values of old_keys.
policies: - name: rename-tags-example resource: aws.log-group filters: - or: - "tag:Bap": present - "tag:Application": present actions: - type: rename-tag old_keys: [Application, Bap] new_key: App
properties: new_key: type: string old_key: type: string old_keys: items: type: string type: array type: enum: - rename-tag required: - type