Checks whether each custom Resource Access Management (RAM) policy contains a specified permission. If not, the evaluation result is Compliant.
Scenarios
Auditing permissions in custom RAM policies helps prevent unnecessary permission assignments that may pose risks to safe production.
Risk level
Default risk level: medium.
When you apply this rule, you can change the risk level based on your business requirements.
Compliance evaluation logic
-
If each custom RAM policy does not contain a specified permission, the evaluation result is Compliant.
-
If a custom RAM policy contains a specified permission, the evaluation result is Non-compliant.
Rule details
|
Item |
Description |
|
Rule name |
ram-policy-no-has-specified-document |
|
Rule ID |
|
|
Tag |
Policy and RAM |
|
Automatic remediation |
Not supported |
|
Trigger type |
Configuration change |
|
Supported resource type |
RAM policy |
|
Input parameter |
None |