ec2-check-benchmarks-confidential.yml

policies:
  - name: ec2-classified-benchmarks
    description: |
      Confidential Classification instance which do not follow the best practices
    resource: ec2
    filters:
      - and:
        - type: value
          key: "State.Name"
          value: "running"
        - type: value
          key: "tag:Classification"
          value: "confidential" 
        - or:
          - not:
            - type: termination-protected
          - type: ebs
            key: Encrypted
            value: false
          - Monitoring.State: disabled
          - IamInstanceProfile: absent
          - type: instance-attribute
            attribute: ebsOptimized
            key: "Value"
            value: false
          - singleton
# optional Action
#    actions:
#      - type: stop
#        hibernate: true