ec2-resources-in-logically-air-gapped-vault
Checks if Amazon Elastic Compute Cloud (Amazon EC2) instances are in a logically air-gapped vault. The rule is NON_COMPLIANT if an Amazon EC2 instance is not in a logically air-gapped vault within the specified time period.
Identifier: EC2_RESOURCES_IN_LOGICALLY_AIR_GAPPED_VAULT
Resource Types: AWS::EC2::Instance
Trigger type: Periodic
AWS Region: All supported AWS regions except Asia Pacific (New Zealand), China (Beijing), Asia Pacific (Thailand), Asia Pacific (Malaysia), AWS GovCloud (US-East), AWS GovCloud (US-West), Mexico (Central), Israel (Tel Aviv), Asia Pacific (Taipei), Canada West (Calgary), China (Ningxia) Region
Parameters:
- recoveryPointAgeUnit (Optional)
- Type: String
- Default: days
-
Unit of time for maximum allowed age. Accepted values: 'hours', 'days'.
- recoveryPointAgeValue (Optional)
- Type: int
- Default: 1
-
Numerical value for maximum allowed age. No more than 2184 for hours, 91 for days.
- resourceId (Optional)
- Type: String
-
ID of Amazon EC2 instance for the rule to check.
- resourceTags (Optional)
- Type: String
-
Tags of Amazon EC2 instances for the rule to check, in JSON format.
AWS CloudFormation template
To create AWS Config managed rules with AWS CloudFormation templates, see Creating AWS Config Managed Rules With AWS CloudFormation Templates.
