# Config

## Guard Custom policy

**Guard Custom policy**: using Guard DSL (**D**omain **S**pecific **L**anguage: policy-as-code language) to evaluate the config changes.

### Basic structure

```
rule rule_name when condition { 
    assertion 
}
```

#### example rule

```
# Check if DynamoDB tables have Point-in-Time Recovery enabled
rule dynamodb_pitr_enabled when 
    resourceType == "AWS::DynamoDB::Table" {
    
    configuration.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus == "ENABLED"
    <<
    Violation: DynamoDB table must have Point-in-Time Recovery enabled
    Fix: Enable Point-in-Time Recovery for the DynamoDB table
    >>
}
```
