Skip to content

Commit

Permalink
update policy pack sections
Browse files Browse the repository at this point in the history
  • Loading branch information
dboeke committed Jul 22, 2024
1 parent 78a2bb3 commit e5abae0
Show file tree
Hide file tree
Showing 13 changed files with 42 additions and 31 deletions.
4 changes: 2 additions & 2 deletions docs/concepts/policies/hierarchy.md
Original file line number Diff line number Diff line change
Expand Up @@ -107,11 +107,11 @@ wins.

#### Policy Packs create automated collections of resources using search

![policy packs](/images/docs/guardrails/smart-folder.png)
![policy packs](/images/docs/guardrails/policy-pack.png)

#### Policies set on Policy Packs are injected into the hierarchy

![policy packs](/images/docs/guardrails/smart-folder-2.png)
![policy packs](/images/docs/guardrails/policy-pack-2.png)

## Permissions and Policy Management

Expand Down
Binary file added docs/concepts/policies/policy-pack-2.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/concepts/policies/policy-pack.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file removed docs/concepts/policies/smart-folder-2.png
Binary file not shown.
Binary file removed docs/concepts/policies/smart-folder.png
Binary file not shown.
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,6 @@ sidebar_label: Policy Packs

Policy Packs (previously name Smart Folders) allow administrators to create a set of policies and then attach them to specific resources, such as an AWS account, existing folder, or an individual resource.

<!--
Policy Packs allow resources from across the hierarchy to be organized
together as a group. For example, a Policy Pack can be used to group all AWS
VPCs in the us-west-2 region into a single collection.
-->

**Policy Packs** are a flexible container for
[Policy settings](concepts/policies/values-settings#policy-settings). Policies
can be set on policy packs, making it easy to apply collections of policies to
Expand Down Expand Up @@ -59,7 +53,7 @@ But consider a situation where we wish to have specific policy settings for VPCs
based on their region (e.g. local DNS servers). VPCs are based in different
accounts, so they exist in different branches of the hierarchy:

![](/images/docs/guardrails/smart-folders-none.png)
![](/images/docs/guardrails/policy-packs-none.png)

In this case, the resource hierarchy is insufficient and would require
duplication of policy settings to every individual region or VPC.
Expand Down Expand Up @@ -88,15 +82,11 @@ Policy packs are then attached to the region resources:
VPCs in each region will now have their region specific policies, while
administrators can maintain those policy settings in a single location.

![](/images/docs/guardrails/smart-folders-updated.png)
![](/images/docs/guardrails/policy-packs-updated.png)

### Further Reading

- [Working with Policy Packs](guides/policy-packs) - Learn how to
attach and detach a policy pack.
- [Guardrails Samples Repo Calculated Policies](https://github.com/turbot/guardrails-samples/tree/master/calculated_policies) -
Each set of policies is deployed via Terraform within a customizable Policy
pack.
- [Guardrails Samples Repo Common Control Objectives](https://github.com/turbot/guardrails-samples/tree/master/control_objectives) -
Common control objectives deployed via Terraform within a customizable Policy
pack.
- [Guardrails Hub](https://hub.guardrails.turbot.com) - A catalog of example policy packs for common control objectives. Each set of policies is deployed via Terraform.
pack.
Binary file added docs/concepts/policy-packs/policy-packs-none.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file removed docs/concepts/resources/smart-folders-none.png
Binary file not shown.
Binary file removed docs/concepts/resources/smart-folders-updated.png
Binary file not shown.
49 changes: 35 additions & 14 deletions docs/guides/policy-packs/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,17 +5,37 @@ sidebar_label: Policy Packs

# Policy Packs

Policy Packs (previously name Smart Folders) allow administrators to create a set of policies and then attach them to specific resources, such as an AWS account, existing folder, or an individual resource

[Policy packs](concepts/resources/policy-packs) allow administrators to create
a set of policies and then attach them to specific resources, such as an AWS
account, existing folder, or an individual resource. Administrators can apply a
wide set (or narrow set) of policies across multiple accounts and/ or resources,
which can be extremely time consuming to do manually. Creation, renaming, and
deleting a policy pack are going to be equivalent to a regular Guardrails folder,
but policy packs also have the ability to be **Attached** to one or many
resources. A policy pack cannot be attached to any resource that is above it in
the Guardrails hierarchy.
[Policy packs](concepts/resources/policy-packs) (previously named Smart Folders)
allow administrators to create a set of policies and then attach them to specific
resources, such as an AWS account, existing folder, or an individual resource.
Administrators can apply a wide set (or narrow set) of policies across multiple
accounts and/ or resources, which can be extremely time consuming to do manually.
Creation, renaming, and deleting a policy pack are going to be equivalent to a
regular Guardrails folder, but policy packs also have the ability to be **Attached**
to one or many resources. A policy pack cannot be attached to any resource that
is above it in the Guardrails hierarchy.

### Create a Policy Pack
1. Click on the "Policies" link in the top menu bar.
1. Select the large grey "Policy Packs" button.
1. Click on the green "New Policy Pack" button on the right side of the page
1. Give the pack a name, description and a unique aka (if desired).
1. Finish by clicking the green "Create" button

![](/images/docs/guardrails/policy-page.png)

**Tip**: It is most useful to create policy packs (and other Guardrails configuration)
as code. It is simple and easy to create a policy pack using the
[Turbot Guardrails Terraform provider](https://registry.terraform.io/providers/turbot/turbot/latest/docs):

```tf
resource "turbot_policy_pack" "my-pack" {
parent = "tmod:@turbot/turbot#/"
title = "My policy pack name"
description = "My policy pack description"
akas = ["my-unique-pack-v001"]
}
```

### Attach a Policy Pack to a Resource

Expand Down Expand Up @@ -51,14 +71,14 @@ Enforcements" and "Enterprise Checks" policy packs are intentionally indented
to indicate their presence in the folder hierarchy. The check-mod policies in
"Enterprise Checks" are set lower because we are not yet ready for enforcements.

**Note**:Policy packattachments and detachments is a heavy database operation
**Note**: Policy pack attachments and detachments are heavy database operations
if the policy pack is attached to many resources or if it contains many
policies (or both!). It is important to be mindful when doing large Policy pack
policy or attachment changes.

### Create a Policy Setting on a Policy Pack
### Create a Policy Setting on an existing Policy Pack

1. Navigate to the **Policies** tab and click the relevantPolicy packon the
1. Navigate to the **Policies** tab and click the relevant Policy pack on the
right side.
2. Click the green **New Policy Setting** button
3. [Create a policy setting](concepts/policies/values-settings#policy-settings).
Expand All @@ -68,3 +88,4 @@ policy or attachment changes.
5. Select a setting then click **Create**.
6. Congrats! You now how a policy that is contained within a Policy pack. This
can be subsequently attached to a resource.

Binary file added docs/guides/policy-packs/policies_page.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
2 changes: 1 addition & 1 deletion docs/sidebar.json
Original file line number Diff line number Diff line change
Expand Up @@ -80,14 +80,14 @@
"concepts/policies/calculated-faq"
]
},
"concepts/policy-packs",
"concepts/processes",
{
"type": "category",
"id": "resources",
"link": "concepts/resources",
"items": [
"concepts/resources/hierarchy",
"concepts/resources/policy-packs",
"concepts/resources/types-categories",
"concepts/resources/discovery"
]
Expand Down

0 comments on commit e5abae0

Please sign in to comment.