Policies¶

Policies are YAML files that tell Argus which findings deserve a Jira ticket and what action to propose. Argus ships 13 bundled policies; you can add your own in config/policies/.

Policy YAML format¶

version: "1"

policy_id: aws-rds-resize-high-cost-idle   # (1) unique across all files
name: Resize idle high-cost RDS instances
resource_type: AWS::RDS::DBInstance        # (2) or "*" for all types
action: resize                             # (3) must be in registry spec.actions
weight: 20                                 # (4) higher = evaluated first

conditions:                                # ALL must pass
  ai_priority: [high, medium]              # Tier 1 — AI-assigned priority
  min_estimated_monthly_cost_usd: 100      # Tier 1 — cost floor
  idle_days_min: 14                        # Tier 1 — days since last activity
  metrics:                                 # Tier 2 — metric thresholds (registry-known types)
    - metric: CPUUtilization_avg
      operator: lt
      threshold: 5.0

include:                                   # scope filter — omit to match all
  cloud_platforms: [aws]
  regions: [us-east-1, us-west-2]
  tags:
    - team: [platform, infra]

exclude:                                   # exclusion filter — omit for none
  tags:
    - environment: [prod, production]
    - argus-exempt: ["true"]

1. policy_id must be unique across all files in the directory. Validation fails on duplicates.
2. resource_type must match the registry exactly (e.g. AWS::RDS::DBInstance). Use * to match any type.
3. action is validated against the registry for known resource types — an invalid action fails at load time.
4. weight controls evaluation order. The highest-weight matching policy wins for each resource — lower-weight policies are skipped.

Condition tiers¶

Tier 1 — universal¶

Applied to all resource types. All specified conditions must pass.

Tier 2 — metric thresholds¶

Only applied for registry-known resource types. Each entry must specify:

All metric conditions must pass (AND logic). If a metric is not present in metrics_summary, that condition is skipped. If a metric value is not numeric, the condition fails.

Rightsizing¶

For resize and reduce_nodes actions, Argus automatically computes a specific target recommendation from the observed CPU% in metrics_summary:

The recommendation appears inline in the plan table and in the Jira ticket Recommendation section. It is advisory — the human decides.

Scope filters¶

Both include and exclude support the same fields:

exclude takes precedence — a resource that matches both include and exclude is excluded.

Bundled policies¶

Writing your own policy¶

1. Copy a bundled policy as a starting point.
2. Set a unique policy_id.
3. Run argus policies validate --dir config/policies — fix any errors.
4. Run argus policies plan --report <scan.json> to see which findings it matches.
5. Add a test in tests/core/remediation/ — see Contributing.