turbot/turbot

steampipe plugin install turbotsteampipe plugin install turbot
On This Page
Get Involved

Table: turbot_policy_setting

Policy settings in Turbot are policy definitions assigned to resources and then applied throughout the hierarchy below (policy values).

Queries to this table must specify (usually in the where clause) at least one of these columns: id, resource_id, exception, orphan, policy_type_id, policy_type_uri or filter.

Examples

Find all policy settings that are exceptions to another policy

select
policy_type_uri,
resource_id,
is_calculated,
exception,
value
from
turbot_policy_setting
where
exception

List policy settings with full resource and policy type information

select
r.trunk_title as resource,
pt.trunk_title as policy_type,
ps.value,
ps.is_calculated,
ps.exception
from
turbot_policy_setting as ps
left join turbot_policy_type as pt on pt.id = ps.policy_type_id
left join turbot_resource as r on r.id = ps.resource_id
where
-- Extract all policy settings by setting filter to empty string
ps.filter = ''

All policy settings set on a given resource

select
r.trunk_title as resource,
ps.resource_id,
pt.trunk_title as policy_type,
ps.value,
ps.is_calculated
from
turbot_policy_setting as ps
left join turbot_policy_type as pt on pt.id = ps.policy_type_id
left join turbot_resource as r on r.id = ps.resource_id
where
ps.resource_id = 173434983560398

All policy settings set on a given resource or below

select
r.trunk_title as resource,
ps.resource_id,
pt.trunk_title as policy_type,
ps.value,
ps.is_calculated
from
turbot_policy_setting as ps
left join turbot_policy_type as pt on pt.id = ps.policy_type_id
left join turbot_resource as r on r.id = ps.resource_id
where
ps.filter = 'resourceId:173434983560398 level:self,descendant'
select
r.trunk_title as resource,
ps.resource_id,
pt.trunk_title as policy_type,
ps.value,
ps.is_calculated
from
turbot_policy_setting as ps
left join turbot_policy_type as pt on pt.id = ps.policy_type_id
left join turbot_resource as r on r.id = ps.resource_id
where
ps.filter = 'resourceTypeId:"tmod:@turbot/aws-s3#/resource/types/bucket"'

.inspect turbot_policy_setting

Policy settings defined in the Turbot workspace.

NameTypeDescription
create_timestamptimestamp without time zoneWhen the policy setting was first discovered by Turbot. (It may have been created earlier.)
defaultbooleanTrue if this policy setting is the default.
exceptionbooleanTrue if this setting is an exception to a higher level setting.
filtertextFilter used for this policy setting list.
idbigintUnique identifier of the policy setting.
inputtextFor calculated policy settings, this is the input GraphQL query.
is_calculatedbooleanTrue if this is a policy setting will be calculated for each value.
notetextOptional note or comment for the setting.
orphanbooleanTrue if this setting is orphaned by a higher level setting.
policy_type_idbigintID of the policy type for this policy setting.
policy_type_trunk_titletextFull title (including ancestor trunk) of the policy type.
policy_type_uritextURI of the policy type for this policy setting.
precedencetextPrecedence of the setting: REQUIRED or RECOMMENDED.
resource_idbigintID of the resource this policy setting is associated with.
resource_trunk_titletextFull title (including ancestor trunk) of the resource.
templatetextFor a calculated policy setting, this is the nunjucks template string defining a YAML string which is parsed to get the value.
template_inputtextFor calculated policy settings, this GraphQL query is run and used as input to the template.
timestamptimestamp without time zoneTimestamp when the policy setting was last modified (created, updated or deleted).
update_timestamptimestamp without time zoneWhen the policy setting was last updated in Turbot.
valid_from_timestamptimestamp without time zoneTimestamp when the policy setting becomes valid.
valid_to_timestamptimestamp without time zoneTimestamp when the policy setting expires.
valuetextValue of the policy setting (for non-calculated policy settings).
value_sourcetextThe raw value in YAML format. If the setting was made via YAML template including comments, these will be included here.
version_idbigintUnique identifier for this version of the policy setting.