Documentation
¶
Overview ¶
Package policy is what the operator is allowed to hit, decided before the incident rather than during it.
The default is deliberately useless: with no scope configured the planner refuses everything. A cost tool that defaults to "the whole account" is one typo away from being the outage, and the first time anyone reads the config carefully is after it has fired.
Index ¶
Constants ¶
const DefaultConfirmAbove = 25
DefaultConfirmAbove is the plan size beyond which a fire needs an explicit force flag.
const ProtectTag = "killswitch:protect"
ProtectTag marks a resource as untouchable. Checked before anything else, and there is no flag that overrides it — a team that tags a resource protected has made a decision the incident does not get to revisit.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Policy ¶
type Policy struct {
// Scope selects what may be touched. Empty means nothing.
Scope Scope `json:"scope"`
// IncludeDatabases opts into stopping RDS. Off by default: databases are
// where the data is, stopping one has a seven-day fuse, and compute plus
// egress is where runaway spend actually lives.
IncludeDatabases bool `json:"include_databases"`
// FinalSnapshot takes a snapshot as part of stopping a database.
FinalSnapshot bool `json:"final_snapshot"`
// AllowInstanceStoreLoss permits stopping instances whose local NVMe is
// erased by the stop. Off by default; the API will not warn you.
AllowInstanceStoreLoss bool `json:"allow_instance_store_loss"`
// DeleteNATGateways opts into removing NAT gateways. They bill by the hour
// and hold no state, but restoring one means recreating it and repointing
// route tables — so it is a real change, not a stop.
DeleteNATGateways bool `json:"delete_nat_gateways"`
// ConfirmAbove requires an explicit force flag when the plan touches more
// than this many resources. Zero means the default.
ConfirmAbove int `json:"confirm_above"`
// StateURI is where the snapshot goes. S3 is the sensible answer and is in
// the never-touch set, so the kill switch cannot destroy its own restore.
StateURI string `json:"state_uri"`
}
Policy is the written-down version of what this account allows. It lives in a file rather than in flags: every dangerous option here should have been decided before the incident, not typed during one.
func Parse ¶ added in v1.10.0
Parse reads a policy from JSON, refusing anything it does not recognise.
DisallowUnknownFields is deliberate: a misspelled key in a file that decides what gets stopped would otherwise be silently ignored, and the operator would find out during an incident that the scope they wrote was not the scope in force.
func (Policy) InScope ¶
InScope reports whether a resource may be considered, and why not when it may not. The reason is surfaced in the plan output — a resource that is quietly absent is the thing someone spends an hour looking for afterwards.
type Scope ¶
type Scope struct {
// Tags that a resource must carry to be in scope. All must match.
Tags map[string]string `json:"tags"`
// Regions to search. Empty means the caller's configured region only.
Regions []string `json:"regions"`
// Everything disables tag scoping. It exists because some accounts are
// genuinely single-purpose, but it has to be written down in a config file
// rather than typed as a flag under pressure.
Everything bool `json:"everything"`
}
Scope selects what is in range. The default is nothing: a kill switch that defaults to the whole account is a footgun with a countdown.
Source Files