User Variables

Pass variables at remediation time and reference them in audit logic, skip conditions, or remediation values. This example sets the AMI from vars.custom.ami_id.

Prompt

The following can be used with the gomboc-enterprise-skills.

/gomboc:fix

I want to create an ORL rule that checks that the AMI used for EC2 instances, launch configurations, or launch templates is one of the following:

- ami-0a1b2c3d4e5f67890
- ami-0987654321fedcba0
- ami-0ff11223344556677
- ami-0abcdef1234567890
- ami-0123456789abcdef0

The rule should use the variable `vars.custom.ami_id` to set the value.  The rule should skip itself (using `skip_expression`) if the variable is not set.  If skipped the `skip_reason` should be in the form "Variable 'vars.custom.ami_id' is not defined. Set it to one of: <AMIs from list>".

Use /gomboc-community:fix if you have the gomboc-community-skills installed.

Name the variable and define behavior when it is missing (here, skip the rule with a clear reason).

Rule Output Example

Each rule audits one resource type. Values that do not match vars.custom.ami_id are replaced with the variable value.