On this page
Policies#
A policy is a rule your organisation has decided on, written once and applied to every finding and every plan after that. "Production databases are never changed." "Anything in the archive account is compliant." "Changes to the payments account also need the head of finance."
Governance > Policies (/policy-management). Everyone who is signed in can read the policies. Writing, switching and
deleting are for administrators.
A sentence, a drafted rule, a person confirms it#
- Write the policy as a sentence, in your own words.
- Draft the rule. A model turns the sentence into a rule: a name, an effect, a scope and a reason. The model only drafts. It decides nothing about any resource. If no model is set up, or it cannot be asked, the screen shows why and lets you write the rule by hand. The sentence goes to the model as you typed it (ai.md).
- Read the rule and correct it. The screen shows the name, the sentence, the effect, the scope, an approver's address where the effect needs one, and the reason.
- Confirm it. Tick "I have read this rule and confirm it", and switch it on. Hyvop records who confirmed it and when.
A policy is in force only when it is switched on, has a rule, and a person has confirmed the rule as it stands. Change any part of the rule and the confirmation is dropped: confirm it again. A policy that is saved without being confirmed stays a draft, and the list says so ("Draft, not confirmed").
The scope: which resources#
A scope lists what a resource must match. Leave out what the policy does not care about.
| Criterion | Example |
|---|---|
| Providers | aws |
| Accounts | 111122223333 |
| Regions | eu-west-1 |
| Resource types | s3_bucket |
| Waste types | unused_resource |
| Resource ids | one or more |
| Tags | env=production (use * for any value) |
| Name pattern | archive-* |
* stands for any characters. Every criterion you give must match; for each criterion, one of its values is enough. A
fact Hyvop does not know does not match, so a rule on a tag does not cover a resource whose tags Hyvop has not read yet.
A scope with nothing in it matches nothing, and is refused.
Hyvop evaluates the rule in code, in a fixed order, with no model. The same facts always give the same answer and cite the same policy.
The three effects#
| Effect | What happens to a resource the scope matches |
|---|---|
| Exempt from detection | What is found there is compliant, not waste. The finding is stored as "Compliant by policy", is not listed as waste, is in no sum of savings, gets no plan, and names the policy and its reason (findings.md) |
| Require one more approver | A plan for the resource must also be approved by the person whose address you give. That person is added after the plan's own approvers. If no single active person with that address is known to Hyvop, nobody can approve the plan and the review says why |
| Forbid remediation | No plan is made for the resource, and the finding is Blocked, "Blocked by policy ...". A plan that already exists cannot be approved, by the screen or by a mailed link. A rejection is still taken |
Saving, switching on or off, or deleting a policy applies it to the findings already stored at once, not at the next run. Delete a policy that exempted something, and the finding is listed as waste again.
Each decision a policy takes is written to the audit trail with the policy cited (audit.md).
The other tabs#
- Templates. Starting points: pick one and change it.
- Compliant by policy. What the policies in force exempt today: each finding, the policy and the reason.
- Simulator. Tries a policy written as a prompt against an input you type.
On a finding, the panel shows which policies apply to its resource.
The limit in the Community Edition#
The Community Edition holds three active policies. A fourth cannot be switched on, and the answer is: "The Community Edition holds 3 active policies and 3 are active. Switch one off or delete one first." Switching a policy off is always allowed. The paid editions have no limit (editions.md).