Writing rules

A rule has three parts it needs and one it can have. It reads top to bottom and stops at the first thing that fails.

when

when decides what the rule applies to. Anything that does not match is skipped, and does not count towards your coverage.

when  resource is "storage bucket" and region is "eu-west-1"

require

Every require has to hold. They are checked in order, and the first failure is the one you get told about.

owner

owner names the team a failure goes to. It is not optional — a rule nobody owns is a rule nobody fixes.

grace

grace lets a new rule report without stopping anything until the period is up. Use it whenever you tighten a rule that existing services would fail.