Managed remediation of non-compliant resources
A configuration policy applicable to one or more target resources is identified. An indication of a non-compliance remediation workflow corresponding to the policy, indicating an automated action, is obtained via a programmatic interface. In response to detecting that a particular target resource does not comply with the configuration policy, implementation of the automated action is initiated.
1. A computer-implemented method, comprising:
obtaining, by a management service for automated remediation at a cloud computing environment, via one or more programmatic interfaces, an indication of an authorization role granted to the management service and required to implement a client-specified remediation action in response to a detection of a non-compliance with a configuration policy at the cloud computing environment;
detecting, at the cloud computing environment, a non-compliance with the configuration policy; and
implementing, by the management service using the authorization role granted to the management service, at the cloud computing environment, the client-specified remediation action.
2. The computer-implemented method as recited in claim 1 , wherein the configuration policy comprises one or more of: (a) a security policy, (b) a cost control policy, (c) a connectivity policy, (d) an availability policy, (e) a data durability policy, (f) a resource category restriction policy, (g) a performance optimization policy, (h) a tenancy policy, (i) a record-keeping policy, (j) a regulations-based policy of a particular jurisdiction, or (k) a privacy protection policy.
3. The computer-implemented method as recited in claim 1 , wherein the client-specified remediation action comprises one or more of: (a) terminating operation of a resource, (b) causing a change to a configuration setting, (c) disconnecting a resource from at least a portion of a network, (d) generating one or more notifications, (e) initiating a request for approval of a configuration change, (f) causing a defect to be entered at a defect tracking tool, or (g) causing a record to be stored in a reporting tool.
4. The computer-implemented method as recited in claim 1 , further comprising:
providing, via the one or more programmatic interfaces, one or more of: (a) a recommended configuration policy, (b) a recommended criterion for determining non-compliance with the configuration policy, or (c) a recommended non-compliance remediation action.
5. The computer-implemented method as recited in claim 1 , further comprising:
obtaining, via the one or more programmatic interfaces, an indication of a criterion for detecting non-compliance with the configuration policy.
6. The computer-implemented method as recited in claim 1 , further comprising:
providing, via the one or more programmatic interfaces, an indication of a number of times non-compliance with the configuration policy was detected during a time interval.
7. The computer-implemented method as recited in claim 1 , further comprising:
obtaining, via the one or more programmatic interfaces, an indication of a resource to which the configuration policy applies.
8. A system, comprising:
one or more computing devices and corresponding memory;
wherein the memory stores instructions that upon execution on or across the one or more computing devices:
obtain, by a management service for automated remediation at a cloud computing environment, via one or more programmatic interfaces, an indication of an authorization role granted to the management service and required to implement a client-specified remediation action in response to a detection of a non-compliance with a configuration policy at the cloud computing environment;
detect, at the cloud computing environment, a non-compliance with the configuration policy; and
implement, by the management service using the authorization role granted to the management service, at the cloud computing environment, the client-specified remediation action.
9. The system as recited in claim 8 , wherein the configuration policy comprises one or more of: (a) a security policy, (b) a cost control policy, (c) a connectivity policy, (d) an availability policy, (e) a data durability policy, (f) a resource category restriction policy, (g) a performance optimization policy, (h) a tenancy policy, (i) a record-keeping policy, (j) a regulations-based policy of a particular jurisdiction, or (k) a privacy protection policy.
10. The system as recited in claim 8 , wherein the client-specified remediation action comprises one or more of: (a) terminating operation of a resource, (b) causing a change to a configuration setting, (c) disconnecting a resource from at least a portion of a network, (d) generating one or more notifications, (e) initiating a request for approval of a configuration change, (f) causing a defect to be entered at a defect tracking tool, or (g) causing a record to be stored in a reporting tool.
11. The system as recited in claim 8 , wherein the memory stores further instructions that upon execution on or across the one or more computing devices:
provide, via the one or more programmatic interfaces, one or more of: (a) a recommended configuration policy, (b) a recommended criterion for determining non-compliance with the configuration policy, or (c) a recommended non-compliance remediation action.
12. The system as recited in claim 8 , wherein the memory stores further instructions that upon execution on or across the one or more computing devices:
obtain, via the one or more programmatic interfaces, an indication of a criterion for detecting non-compliance with the configuration policy.
13. The system as recited in claim 8 , wherein the memory stores further instructions that upon execution on or across the one or more computing devices:
provide, via the one or more programmatic interfaces, a metric associated with the configuration policy.
14. The system as recited in claim 8 , wherein the memory stores further instructions that upon execution on or across the one or more computing devices:
obtain, via the one or more programmatic interfaces, an indication of a resource to which the configuration policy applies.
15. One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors:
obtain, by a management service for automated remediation at a cloud computing environment, via one or more programmatic interfaces, an indication of an authorization role granted to the management service and required to implement a client-specified remediation action in response to a detection of a non-compliance with a configuration policy at the cloud computing environment;
detect, at the cloud computing environment, a non-compliance with the configuration policy; and
implement, by the management service using the authorization role granted to the management service, at the cloud computing environment, the client-specified remediation action.
16. The one or more non-transitory computer-accessible storage media as recited in claim 15 , wherein the configuration policy comprises one or more of: (a) a security policy, (b) a cost control policy, (c) a connectivity policy, (d) an availability policy, (e) a data durability policy, (f) a resource category restriction policy, (g) a performance optimization policy, (h) a tenancy policy, (i) a record-keeping policy, (j) a regulations-based policy of a particular jurisdiction, or (k) a privacy protection policy.
17. The one or more non-transitory computer-accessible storage media as recited in claim 15 , wherein the client-specified remediation action comprises one or more of: (a) terminating operation of a resource, (b) causing a change to a configuration setting, (c) disconnecting a resource from at least a portion of a network, (d) generating one or more notifications, (e) initiating a request for approval of a configuration change, (f) causing a defect to be entered at a defect tracking tool, or (g) causing a record to be stored in a reporting tool.
18. The one or more non-transitory computer-accessible storage media as recited in claim 15 , storing further program instructions that that when executed on or across one or more processors:
provide, via the one or more programmatic interfaces, one or more of: (a) a recommended configuration policy, (b) a recommended criterion for determining non-compliance with the configuration policy, or (c) a recommended non-compliance remediation action.
19. The one or more non-transitory computer-accessible storage media as recited in claim 15 , storing further program instructions that that when executed on or across one or more processors:
obtain, via the one or more programmatic interfaces, an indication of a criterion for detecting non-compliance with the configuration policy.
20. The one or more non-transitory computer-accessible storage media as recited in claim 15 , storing further program instructions that that when executed on or across one or more processors:
provide, via the one or more programmatic interfaces, an indication of a number of times that the client-specified remediation action was implemented during a time interval.