Closed arwilczek90 closed 3 years ago
Here is a short term work around for now:
The awsguard has the following for my index.ts
import { AwsGuard } from "@pulumi/awsguard";
new AwsGuard({
all: "disabled",
acmCertificateExpiration: { maxDaysUntilExpiration: 10 },
});
export AWS_REGION=us-east-2
Then run the policy.
pulumi preview --policy-pack awsguard
Previewing update (dev)
View Live: https://app.pulumi.com/shaht/aws-ts-acm/dev/previews/1ece0735-32cb-4f02-9d05-9c8da52cf615
Type Name Plan
pulumi:pulumi:Stack aws-ts-acm-dev
Policy Violations:
[advisory] pulumi-awsguard v0.1.0 acm-certificate-expiration (pulumi:pulumi:Stack: aws-ts-acm-dev)
Checks whether an ACM certificate has expired. Certificates provided by ACM are automatically renewed. ACM does not automatically renew certificates that you import.
certificate expires in -1 (max allowed 10 days)
This has been fixed by the following release for pulumi-policy-aws. 0.2.4
When running the policy pack the acm-certificate-expiration policy throws an error at Request.VALIDATE_REGION saying missing region in config when it exists in the pulumi config.
Expected behavior
A certificate that passes policy with the correct values for accessing an aws account in the config file should pass correctly
Current behavior
Steps to reproduce
Context (Environment)
We have had to disable the acm-certificate-expiration policy which is non ideal.
Affected feature