AWS CloudFormation
User Guide (Version )

AWS::Config::RemediationConfiguration

An object that represents the details about the remediation configuration that includes the remediation action, parameters, and data to execute the action.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

JSON

{ "Type" : "AWS::Config::RemediationConfiguration", "Properties" : { "Automatic" : Boolean, "ConfigRuleName" : String, "ExecutionControls" : ExecutionControls, "MaximumAutomaticAttempts" : Integer, "Parameters" : Json, "ResourceType" : String, "RetryAttemptSeconds" : Integer, "TargetId" : String, "TargetType" : String, "TargetVersion" : String } }

YAML

Type: AWS::Config::RemediationConfiguration Properties: Automatic: Boolean ConfigRuleName: String ExecutionControls: ExecutionControls MaximumAutomaticAttempts: Integer Parameters: Json ResourceType: String RetryAttemptSeconds: Integer TargetId: String TargetType: String TargetVersion: String

Properties

Automatic

The remediation is triggered automatically.

Required: No

Type: Boolean

Update requires: No interruption

ConfigRuleName

The name of the AWS Config rule.

Required: Yes

Type: String

Minimum: 1

Maximum: 128

Pattern: .*\S.*

Update requires: Replacement

ExecutionControls

An ExecutionControls object.

Required: No

Type: ExecutionControls

Update requires: No interruption

MaximumAutomaticAttempts

The maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.

For example, if you specify MaximumAutomaticAttempts as 5 with RetryAttemptsSeconds as 50 seconds, AWS Config throws an exception after the 5th failed attempt within 50 seconds.

Required: No

Type: Integer

Minimum: 1

Maximum: 25

Update requires: No interruption

Parameters

An object of the RemediationParameterValue.

Note

The type is a map of strings to RemediationParameterValue.

Required: No

Type: Json

Update requires: No interruption

ResourceType

The type of a resource.

Required: No

Type: String

Update requires: No interruption

RetryAttemptSeconds

Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.

For example, if you specify RetryAttemptsSeconds as 50 seconds and MaximumAutomaticAttempts as 5, AWS Config will run auto-remediations 5 times within 50 seconds before throwing an exception.

Required: No

Type: Integer

Update requires: No interruption

TargetId

Target ID is the name of the public document.

Required: Yes

Type: String

Minimum: 1

Maximum: 256

Update requires: No interruption

TargetType

The type of the target. Target executes remediation. For example, SSM document.

Required: Yes

Type: String

Allowed Values: SSM_DOCUMENT

Update requires: No interruption

TargetVersion

Version of the target. For example, version of the SSM document.

Required: No

Type: String

Update requires: No interruption

Return Values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the remediation action with the associated SSM document.

For more information about using the Ref function, see Ref.

Examples

Remeditation Configuration

The following example creates a remediation configuration using AWS Systems Manager document.

JSON

{ "BasicRemediationConfiguration": { "Type": "AWS::Config::RemediationConfiguration", "Properties": { "ConfigRuleName": "configRuleName", "Parameters": { "AutomationAssumeRole": { "StaticValue": { "Values": [ "automationAssumeRole" ] } }, "InstanceId": { "StaticValue": { "Values": [ "instanceId" ] } } }, "TargetId": "AWS-StartEC2Instance", "TargetType": "SSM_DOCUMENT", "TargetVersion": "1" } } }

YAML

BasicRemediationConfiguration: Type: "AWS::Config::RemediationConfiguration" Properties: ConfigRuleName: configRuleName Parameters: AutomationAssumeRole: StaticValue: Values: - automationAssumeRole InstanceId: StaticValue: Values: - instanceId TargetId: "AWS-StartEC2Instance" TargetType: "SSM_DOCUMENT" TargetVersion: "1"