Writing rules
What you can check
The things Axiom knows about a resource, and how they work across clouds.
Axiom describes resources from every cloud the same way, so a rule about encryption reads the same whether the thing is on AWS, GCP or Azure.
The common things
resource is— the kind of thing, such as "storage bucket" or "database".name— whatever the cloud calls it, untouched.tags— always there, empty if the cloud has none.encrypted— true or false, worked out per cloud.
When that is not enough
raw gives you the cloud's own description of the resource, exactly as it arrived. Rules written against raw only work on that one cloud, so they are worth a comment saying so.