diff --git a/iam/All-permissions.json b/iam/All-permissions.json index a9622fae7..73d519d7d 100644 --- a/iam/All-permissions.json +++ b/iam/All-permissions.json @@ -27,6 +27,7 @@ "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", + "cloudwatch:GetMetricStatistics", "cloudwatch:DescribeAlarms", "codebuild:BatchGetProjects", "codebuild:ListProjects", diff --git a/policies/ecc-aws-552-dynamodb_tables_unused.yml b/policies/ecc-aws-552-dynamodb_tables_unused.yml new file mode 100644 index 000000000..657de2102 --- /dev/null +++ b/policies/ecc-aws-552-dynamodb_tables_unused.yml @@ -0,0 +1,46 @@ +# Copyright (c) 2023 EPAM Systems, Inc. +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + + +policies: + - name: ecc-aws-552-dynamodb_tables_unused + comment: '010002062000' + description: | + Unused Amazon DynamoDB tables + resource: aws.dynamodb-table + filters: + - and: + - type: value + key: ProvisionedThroughput.ReadCapacityUnits + op: ne + value: 0 + - type: value + key: TableStatus + value: ACTIVE + - type: value + key: CreationDateTime + value_type: age + value: 60 + op: ge + - or: + - type: value + key: ItemCount + value: 0 + - and: + - type: metrics + name: ConsumedWriteCapacityUnits + namespace: AWS/DynamoDB + statistics: Maximum + days: 60 + value: 0 + op: equal + - type: metrics + name: ConsumedReadCapacityUnits + namespace: AWS/DynamoDB + statistics: Maximum + days: 60 + value: 0 + op: equal \ No newline at end of file diff --git a/terraform/ecc-aws-552-dynamodb_tables_unused/green/dynamodb.tf b/terraform/ecc-aws-552-dynamodb_tables_unused/green/dynamodb.tf new file mode 100644 index 000000000..2c9bad15d --- /dev/null +++ b/terraform/ecc-aws-552-dynamodb_tables_unused/green/dynamodb.tf @@ -0,0 +1,28 @@ +resource "aws_dynamodb_table" "this" { + name = "552_dynamodb_table_green" + hash_key = "GreenTableHashKey" + billing_mode = "PROVISIONED" + read_capacity = 1 + write_capacity = 1 + + + attribute { + name = "GreenTableHashKey" + type = "S" + } +} + +resource "aws_dynamodb_table_item" "this" { + table_name = aws_dynamodb_table.this.name + hash_key = aws_dynamodb_table.this.hash_key + + item = <