Skip to main content

Built-in Controls

Built-in controls are NimbusGuard's own checks, written in native Python and maintained by the NimbusGuard team. They cover security posture and misconfiguration across AWS (primary) and Azure (secondary).

Each control contributes evidence toward compliance frameworks (CIS, NIST 800-53, PCI DSS) via an inline compliance mapping, but a passing control does not assert full framework compliance.

Control types​

There are only two kinds of controls:

  • Built-in — from NimbusGuard, native Python.
  • Custom — from the customer, written in Rego and evaluated via OPA. See Custom Controls.

Customer code never runs as Python — third-party logic only runs as sandboxed Rego inside OPA.

:::warning Placeholder ⚠️ Insert the generated catalog of built-in controls (id, provider, resource type, severity, framework mappings). :::