Policies

Policies are compliance rules that continuously evaluate your cloud resources against criteria you define. They help enforce organisational standards – such as requiring encryption on storage, restricting instance sizes, or mandating specific tags – across all connected providers.

Rule Structure#

Each policy targets a specific resource property and evaluates it using an operator (such as equals, contains, greater than, or exists) against one or more values. Policies are evaluated independently of one another – a single resource can trigger violations against several policies at once, and each violation is tracked on its own.

Severity Levels#

Policies are assigned a severity that reflects their importance to your organisation:

• Critical – must be resolved immediately; represents a serious risk.
• High – should be addressed promptly.
• Medium – important but not urgent.
• Low – minor issue or housekeeping item.
• Info – informational only; no action required.

Provider Scoping#

A policy can be scoped to one or more cloud providers. When left unscoped, the policy applies to resources from every provider connected to your organisation; scoping narrows evaluation to resources from the selected providers only. This matters when a property or operator is only meaningful for certain providers.

Alerting#

When a resource violates a policy, Troposphere generates a policy alert with the corresponding severity. Alerts remain open until the resource is brought into compliance or the alert is manually ignored.