Home/Templates/Block the changes you never want
Block the changes you never want
Policies that make dangerous actions fail outright, so there is nothing to alert on afterwards.
Terraform
Why bother
Alerts tell you that someone turned off logging or opened a region you do not use. By then it has happened. A guardrail makes the action fail, so there is nothing to respond to.
How you know it worked
Try a blocked action from a member account. It should be refused.
Not written yet
No code exists for this one. It is listed so the gap shows on the coverage table. When it is written, each platform will use:
| Platform | Service |
|---|---|
| AWS | Service control policies on the organization |
| Azure | A policy set assigned to the management group |
| Google Cloud | Organization policy constraints |
| Oracle Cloud | Tenancy policies and compartment quotas |