Atlas 리소스 정책

{
   "name": "Policy Preventing GCP Clusters",
   "policies": [
       {
           "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { context.cluster.cloudProviders.contains(ResourcePolicy::CloudProvider::\"gcp\") };"
        }
    ]
}

{
    "name": "Policy Allowing Only GCP Clusters",
    "policies": [
        {
           "body": "forbid(principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) unless { context.cluster.cloudProviders == [ResourcePolicy::CloudProvider::\"gcp\"] };"
        }
    ]
}

{
    "name": "Policy Allowing Only GCP Clusters for One Project",
    "policies": [
        {
            "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { resource in ResourcePolicy::Project::\"6217f7fff7957854e2d09179\" && context.cluster.cloudProviders == [ResourcePolicy::CloudProvider::\"gcp\"] };"
        }
    ]
}

{
    "name": "Forbid Modifications to Specific GCP Cluster",
    "policies": [
        {
            "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { resource in ResourcePolicy::Project::\"65dcbf5ccd12a54df59a54e6\" && resource == ResourcePolicy::Cluster::\"670968dfc0a2297ef46bc02a\" && context.cluster.cloudProviders == [ResourcePolicy::CloudProvider::\"gcp\"]};"
        }
    ]
}

{
    "name": "Prohibit Cluster Deployment in the US-EAST-1 Region",
    "policies": [
        {
            "body": "forbid (principal,action == ResourcePolicy::Action::\"cluster.modify\",resource) when {context.cluster.regions.contains(ResourcePolicy::Region::\"aws:us-east-1\")};"
        {
    ]
}

{
    "name": "Policy Preventing Clusters in AWS:us-west-1",
    "policies": [
        {
            "body": "forbid(principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { context.cluster.regions.contains(ResourcePolicy::Region::\"aws:us-west-1\") };"
        }
    ]
}

{
    "name": "Policy Preventing Clusters in 3 AWS Regions",
    "policies": [
        {
           "body": "forbid(principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { context.cluster.regions.containsAny([ResourcePolicy::Region::\"aws:us-east-1\", ResourcePolicy::Region::\"aws:us-west-1\", ResourcePolicy::Region::\"azure:westeurope\"]) };"
        }
    ]
}

{
    "name": "Policy Allowing Clusters Only in 2 AWS Regions",
    "policies": [
       {
          "body": "forbid(principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) unless { [ResourcePolicy::Region::\"aws:us-east-1\", ResourcePolicy::Region::\"azure:westeurope\"].containsAll(context.cluster.regions) };"
        }
    ]
{

{
    "name": "Policy Restricting Edits to One Cluster from 2 AWS Regions",
    "policies": [
        {
           "body": "forbid(principal, action == ResourcePolicy::Action::\"cluster.modify\", resource == ResourcePolicy::Cluster::\"3217e2gdf79a4c54e2d0827\") when { context.cluster.regions.containsAny([ResourcePolicy::Region::\"aws:us-east-1\",ResourcePolicy::Region::\"aws:us-west-1\"]) };"
        }
    ]
}

{
  "name": "Policy Restricting All GCP Clusters and Some AWS Regions",
  "policies": [{"body": "forbid (principal,action == ResourcePolicy::Action::\"cluster.modify\", resource) when {context.cluster.cloudProviders.containsAny([ResourcePolicy::CloudProvider::\"gcp\"]) || context.cluster.regions.containsAny([ResourcePolicy::Region::\"aws:us-east-1\", ResourcePolicy::Region::\"aws:us-west-1\"])};"}]
}

{
    "name": "Policy Restricting Wildcard IP",
    "policies": [
        {
           "body": "forbid(principal, action == ResourcePolicy::Action::\"project.ipAccessList.modify\", resource) when { context.project.ipAccessList.contains(ip(\"0.0.0.0/0\")) };"
        }
    ]
}

{
    "name": "Policy Restricting Project Edits to Specified IPs",
    "policies": [
       {
           "body": "forbid(principal, action == ResourcePolicy::Action::\"project.ipAccessList.modify\", resource) unless { [ip(\"1.2.3.4/32\"), ip(\"8.8.8.8/32\"), ip(\"4.4.4.4/32\")].containsAll(context.project.ipAccessList) };"
        }
    ]
}

{
    "name": "Policy Restricting Min/Max Cluster Size",
    "policies": [
        {
            "body": "forbid(principal, action == ResourcePolicy::Action::"cluster.modify", resource) when { (context.cluster has minGeneralClassInstanceSizeValue && context.cluster.minGeneralClassInstanceSizeValue < 30) || (context.cluster has maxGeneralClassInstanceSizeValue && context.cluster.maxGeneralClassInstanceSize > 60) };"
        }
    ]
}

{
    "name": "Policy Enforcing Existence of a Project Maintenance Window",
    "policies": [
        {
            "body": "forbid (principal, action == ResourcePolicy::Action::"project.maintenanceWindow.modify", resource) when {context.project.hasDefinedMaintenanceWindow == false};"
        }
    ]
}

{
    "name": "Policy Preventing Modifications to Peering Across Providers",
    "policies": [
        {
            "body": "forbid (principal, action == ResourcePolicy::Action::\"project.vpcPeering.modify\", resource) when {context.project.peeringConnections == [\"aws:000123456789:us-east-1:vpc-0316c47cc923ce313:10.0.0.0/16\", \"azure:fd01aafc-b3re-2193-8497-83lp3m83a1a5:rg-name:vnet\", \"gcp:inductive-cocoa-108200:default\"]};"
        }
    ]
}

{
    "name": "Policy Preventing Modifications to Peering Across Providers",
    "policies": [
        {
            "body": "forbid (principal, action == ResourcePolicy::Action::\"project.privateEndpoint.modify\", resource) when {context.project.privateEndpoints == [\"aws:vpce-042d72ded1748f314\", \"azure:/subscriptions/fd01aafc-b3re-2193-8497-83lp3m83a1a5/resourceGroups/rg-name/providers/Microsoft.Network/privateEndpoints/pe-name:10.0.0.4\", \"gcp:inductive-cocoa-108200:default\"]};"
        }
    ]
}