---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Cloud Configuration Governance policies

# Cloud Configuration Governance policies {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Cloud Configuration Governance policy defines the non-compliant configurations for a
given cloud resource type.

Each Cloud Configuration Governance policy contains the following information:

* The cloud on which the resource is provisioned.
* The cloud resource type.
* Definition of the non-compliant configuration. For example, unencrypted Amazon Web Services (AWS) S3 buckets or insecure Identity and Access Management (IAM) accounts.
* Definition of the audit violation (policy violation) report.

{#ccg-policies__ul_nrm_4sv_gsb}  
Note:  
Starting with Cloud Configuration Governance version 1.3.7, the base system contents are moved to the CCG Content Pack. Install the CCG Content Pack to access the base system Cloud Configuration Governance contents.

Cloud Configuration Governance provides several base system policies. You can either use
these policies or create custom policies as per the needs of your organization. Depending on
the need and your familiarity with the ServiceNow AI Platform, you can use any one of the
following methods to create the policy:

* [Create a policy with the
  condition builder](https://servicenow-prod.fluidtopics.net/1kxMRm7bl6re2vTWInsJ8w "Use the condition builder to create a Cloud Configuration Governance policy without writing any code at all. Use it to specify the criteria for identifying and reporting the non-compliant cloud resource configurations.")
* [Create a policy with Integration
  Hub flow](https://servicenow-prod.fluidtopics.net/C~ZyxHF0iqbml24K1FC9lA "Use the Integration Hub subflow to create a Cloud Configuration Governance policy. An Integration Hub subflow uses graphical coding mechanisms to specify the policy conditions. It offers greater flexibility in audit violation reporting than the condition builder. That is, you can use the same policy to report different types of issues.")
* [Create a policy through
  script](https://servicenow-prod.fluidtopics.net/4oIbhUsfgzKPLM2A49~W~A "Use the ServiceNow platform native scripting mechanism to define the policy condition. You can externalize the decision making to script includes and reuse the code across different policies.")

{#ccg-policies__ul_orm_4sv_gsb}

To use the policy, add the policy to a policy set. Each policy set can contain one or more
policies. For more information on creating policy sets, see [Create policy set](https://servicenow-prod.fluidtopics.net/mbkenQsOuu5EbeHaSPof4g "Create a policy set in Cloud Configuration Governance to group policies that enforce a given security or organization standard. When the scan configuration runs the policy set, it identifies the cloud resources that don’t adhere to the set standards. A policy set can contain one or more policies.").  
{#ccg-policies__table_gdl_j2v_3sb__entry__3}

| Name | Type | Description |
|-|-|-|
| AWS IAM User Activity policy | Condition builder | Policy to check if the password is enabled for the AWS IAM user. To use this policy, ensure that the AWS IAM user account has the following permissions: * Iam:GetCredentialReport * Iam:GenerateCredentialReport {#ccg-policies__ul_qtn_5kx_jsb} |
| AWS S3 Enforce Bucket encryption | Condition builder | Policy to check if the AWS S3 buckets are encrypted. |
| AWS Sample flow policy | Integration Hub flow | Policy to illustrate an Integration Hub flow-based policy. |
| AWS VM HardwareType | Condition builder | Policy to check if the deployed EC2 VMs are using only the approved hardware types. |
| AWS VM IPAddress | Script | Policy to check if the IP address of the EC2 VM is matching with the Configuration Management Database (CMDB) record. |
| AWS VM Monitoring State | Condition builder | Policy to check if detailed monitoring is enabled for the EC2 VM. |
| Azure VM HardwareType | Condition builder | Policy to check if the deployed Azure VMs are using only the approved hardware types. |
| Azure VM IP Address | Script | Policy to check if the IP address of the Azure VM is matching with the CMDB record. |
| Azure VM Monitoring State | Condition builder | Policy to check if detailed monitoring is enabled for the Azure VM. |
[Table 1. Base system policies]

{#ccg-policies__table_gdl_j2v_3sb}