search

turbot / guardrails-docs

Turbot Guardrails documentation content in markdown format.
https://turbot.com/guardrails/docs
Other
3 stars 1 forks source link

Guide on how to connect an account to Guardrails into a read-only state #90

Open Joeturbot opened 2 months ago

Joeturbot commented 2 months ago

What are the steps to connect a cloud account to a mature Guardrails workspace with lots of policy settings in Enforce? This is a different requirement than a POC customer who is testing out Guardrails for the first time.

Process Proposal

  1. Create a folder specifically for this sensitive account (aka: ZZZ)
  2. On the folder set these policy settings:
    1. Turbot > Change Window to No Changes.
    2. AWS > Turbot > Event Handlers [Global] to Skip. (We do this so the event pollers will automatically enable in this account.)
  3. Import the ZZZ account into the new folder using the Guardrails console.
  4. Discovery happens as usual.
  5. Identify any controls in error.
  6. Evaluate the alarms that pop up. Be very thorough.
  7. If you're comfy with what Guardrails would do, delete the Change Window and Event Handlers [Global] policies.
  8. Move the ZZZ account to the same folder as all the other accounts of this type (NonProd, Prod, Sandbox).