Skip to content

Commit 0f4ba9f

Browse files
RahulSrivastav14SumitPopatrajlearner17
authored
Update guide > with newly added Native Stacks. Closes #383 (#384)
Co-authored-by: Sumit Popat <sumit@turbot.com> Co-authored-by: raj <raj@turbot.com>
1 parent 6265ac7 commit 0f4ba9f

File tree

1 file changed

+24
-65
lines changed

1 file changed

+24
-65
lines changed

‎docs/concepts/guardrails/stacks.md‎

Lines changed: 24 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Stack [Native] Guardrails
33
sidebar_label: Stack [Native]
44
---
55

6-
# Stack [Native] Guardrails
6+
# Stack [Native] Guardrails
77

88
## Overview
99

@@ -19,63 +19,22 @@ Guardrails provides many `Stack [Native]` controls in multiple mods. These stac
1919
- Resource stacks target individual resources, allowing you to configure standard resources that should be associated with them. Resource stacks will run for every resource of that type, and will run whenever new resources of that type are discovered.
2020

2121

22-
<table>
23-
<thead>
24-
<tr>
25-
<th nowrap="true">Stack</th>
26-
<th>Target</th>
27-
<th>Intended Purpose</th>
28-
</tr>
29-
</thead>
30-
<tbody>
31-
<tr>
32-
<td nowrap="true"><strong>AWS &gt; Account &gt; Stack [Native]</strong></td>
33-
<td>Account</td>
34-
<td>Account-level settings and global services like Route53 and CloudFront.</td>
35-
</tr>
36-
<tr>
37-
<td nowrap="true"><strong>AWS &gt; Region &gt; Stack [Native]</strong></td>
38-
<td>Region</td>
39-
<td>Regional resources, like Lambda Functions, EC2 instances, SNS Topics, etc.</td>
40-
</tr>
41-
<tr>
42-
<td nowrap="true"><strong>AWS &gt; IAM &gt; Stack [Native]</strong></td>
43-
<td>Account</td>
44-
<td>IAM resources, like standard users, roles, policies, and identity providers.</td>
45-
</tr>
46-
<tr>
47-
<td nowrap="true"><strong>AWS &gt; VPC &gt; Stack [Native]</strong></td>
48-
<td>Region</td>
49-
<td>VPC resources to set your standard "landing zone" VPCs - subnets, security groups, gateways, etc. </td>
50-
</tr>
51-
<tr>
52-
<td nowrap="true"><strong>AWS &gt; S3 &gt; Bucket &gt; Stack [Native]</strong></td>
53-
<td>Bucket</td>
54-
<td>Resources to associate with buckets such as lifecycle policies or replication configuration</td>
55-
</tr>
56-
<tr>
57-
<td nowrap="true"><strong>AWS &gt; VPC &gt; VPC &gt; Stack [Native]</strong></td>
58-
<td>VPC</td>
59-
<td>Standard VPC resources that belong in <em>every</em> VPC, like security groups, gateways, NACLs, etc. </td>
60-
</tr>
61-
<tr>
62-
<td nowrap="true"><strong>Azure &gt; Subscription &gt; Stack [Native]</strong></td>
63-
<td>Subscription</td>
64-
<td>Subscription-level settings and global services</td>
65-
</tr>
66-
<tr>
67-
<td nowrap="true"><strong>Azure &gt; Network &gt; Virtual Network &gt; Stack [Native]</strong></td>
68-
<td>Virtual Network</td>
69-
<td>Standard network resources that belong in <em>every</em> Virtual Network</td>
70-
</tr>
71-
<tr>
72-
<td nowrap="true"><strong>GCP &gt; Project &gt; Stack [Native]</strong></td>
73-
<td>Project</td>
74-
<td>Project-level settings and global services</td>
75-
</tr>
76-
</tbody>
77-
</table>
78-
22+
| **Stack** | **Target** | **Intended Purpose** |
23+
|---------------------------------------------------------------|--------------------|-----------------------------------------------------------------------------------------------------------------|
24+
| **AWS > Account > Stack [Native]** | Account | Account-level settings and global services like Route53 and CloudFront. |
25+
| **AWS > Region > Stack [Native]** | Region | Regional resources, like Lambda Functions, EC2 instances, SNS Topics, etc. |
26+
| **AWS > IAM > Stack [Native]** | Account | IAM resources, like standard users, roles, policies, and identity providers. |
27+
| **AWS > VPC > Stack [Native]** | Region | VPC resources to set your standard "landing zone" VPCs - subnets, security groups, gateways, etc. |
28+
| **AWS > S3 > Bucket > Stack [Native]** | Bucket | Resources to associate with buckets such as lifecycle policies or replication configuration |
29+
| **AWS > VPC > VPC > Stack [Native]** | VPC | Standard VPC resources that belong in *every* VPC, like security groups, gateways, NACLs, etc. |
30+
| **AWS > CloudFront > Distribution > Stack [Native]** | Distribution | Resources to associate with CloudFront distributions such as logging, monitoring, or WAF configuration |
31+
| **AWS > Secrets Manager > Secret > Stack [Native]** | Secret | Resources related to secrets such as key rotation, access policies, and tagging |
32+
| **Azure > Subscription > Stack [Native]** | Subscription | Subscription-level settings and global services |
33+
| **Azure > Network > Virtual Network > Stack [Native]** | Virtual Network | Standard network resources that belong in *every* Virtual Network |
34+
| **Azure > Resource Group > Stack [Native]** | Resource Group | Resources like diagnostic settings, policies, and tags applied at the resource group level |
35+
| **Azure > Key Vault > Vault > Stack [Native]** | Vault | Resources to associate with Key Vaults such as access policies, logging, and diagnostic settings |
36+
| **Azure > Storage > Storage Account > Stack [Native]** | Storage Account | Resources to associate with storage accounts such as encryption, access configuration, and diagnostic settings |
37+
| **GCP > Project > Stack [Native]** | Project | Project-level settings and global services |
7938

8039

8140
## Example: Standard IAM policy
@@ -133,7 +92,7 @@ Create a policy setting for the `AWS > IAM > Stack [Native]` policy on an accoun
13392

13493
Stack behavior is controlled by the `Stack [Native]` policy and sub-policies.
13594

136-
| Policy | Description
95+
| Policy | Description
13796
|---------------------------------------|-----------------------------------------------------------------------
13897
| **Stack [Native]** | Determine whether to run the stack in check mode, enforce mode, or skip
13998
| **Stack [Native] > Source** | The OpenTofu HCL configuration source code that should be applied
@@ -143,9 +102,9 @@ Stack behavior is controlled by the `Stack [Native]` policy and sub-policies.
143102

144103
The `Stack [Native]` primary policy determines what action the control will take:
145104

146-
| Value | Description
105+
| Value | Description
147106
| ----------------------- | -----------------------------------------------------------------------------------
148-
| **Skip** | The control will not run
107+
| **Skip** | The control will not run
149108
| **Check: Configured** | An OpenTofu plan will be generated. If the planned configuration does not match the current configuration, the control will alarm.
150109
| **Enforce: Configured** | An OpenTofu plan will be generated. If the planned configuration does not match the current configuration, the control will apply the configuration.
151110

@@ -189,13 +148,13 @@ You may also choose to trigger the stack to run when resources change, but:
189148
### Drift Detection Policies
190149
Drift detection behavior is controlled by the following sub-policies.
191150

192-
| Policy | Description
151+
| Policy | Description
193152
|---------------------------------------|-----------------------------------------------------------------------
194153
| **Stack [Native] > Drift Detection** | Specify the mechanism for drift detection.
195154
| **Stack [Native] > Drift Detection > Interval** | Specify the interval at which to run the stack, in minutes.
196155

197156

198-
The `Stack [Native] > Drift Detection` policy allows you to specify the mechanism for drift detection. You may run the stack at regular intervals to keep the resources up to date, and/or automatically trigger the stack to run whenever a resource that it created is modified. Note that resource triggering will only be available for resources that exist in the Guardrails CMDB; you may install the supporting mods and enable the CMDB for those resources.
157+
The `Stack [Native] > Drift Detection` policy allows you to specify the mechanism for drift detection. You may run the stack at regular intervals to keep the resources up to date, and/or automatically trigger the stack to run whenever a resource that it created is modified. Note that resource triggering will only be available for resources that exist in the Guardrails CMDB; you may install the supporting mods and enable the CMDB for those resources.
199158

200159

201160
The `Stack [Native] > Drift Detection > Interval ` allows you to specify the interval at which to run the stack, in minutes. The default is `1440` (Once a day).
@@ -205,9 +164,9 @@ The `Stack [Native] > Drift Detection > Interval ` allows you to specify the int
205164

206165
The `Stack [Native] > Version` policy allows you to select which OpenTofu version Turbot should use for the stack.
207166

208-
The policy supports semver semantics, allowing you to use new versions automatically, or to pin to specific versions, depending on your preference.
167+
The policy supports semver semantics, allowing you to use new versions automatically, or to pin to specific versions, depending on your preference.
209168

210-
By default this policy uses the global default value set in the `Turbot > Stack > Native Stack Version [Default]` policy. The shared default allows you to change only a single setting to change your default version, but still migrate versions over time on a per-stack basis.
169+
By default this policy uses the global default value set in the `Turbot > Stack > Native Stack Version [Default]` policy. The shared default allows you to change only a single setting to change your default version, but still migrate versions over time on a per-stack basis.
211170

212171
Guardrails native stack containers include standard cloud [providers](https://opentofu.org/docs/language/providers/). These providers are bundled in the container image, so in practice, the provider versions are tied to the OpenTofu version. The following versions are currently supported:
213172

0 commit comments

Comments
 (0)