software.amazon.awscdk.services.config

Class CfnConfigRule

java.lang.Object

software.constructs.Construct

software.amazon.awscdk.core.Construct

software.amazon.awscdk.core.CfnElement

software.amazon.awscdk.core.CfnRefElement

software.amazon.awscdk.core.CfnResource

software.amazon.awscdk.services.config.CfnConfigRule

All Implemented Interfaces:

IConstruct, IDependable, IInspectable

@Generated(value="jsii-pacmak/1.74.0 (build 6d08790)",
           date="2023-03-22T19:35:50.719Z")
public class CfnConfigRule
extends CfnResource
implements IInspectable

A CloudFormation `AWS::Config::ConfigRule`.

Adds or updates an AWS Config rule to evaluate if your AWS resources comply with your desired configurations. For information on how many AWS Config rules you can have per account, see Service Limits in the AWS Config Developer Guide .

There are two types of rules: AWS Config Managed Rules and AWS Config Custom Rules . You can use the ConfigRule resource to create both AWS Config Managed Rules and AWS Config Custom Rules.

AWS Config Managed Rules are predefined, customizable rules created by AWS Config . For a list of managed rules, see List of AWS Config Managed Rules . If you are adding an AWS Config managed rule, you must specify the rule's identifier for the SourceIdentifier key.

AWS Config Custom Rules are rules that you create from scratch. There are two ways to create AWS Config custom rules: with Lambda functions ( AWS Lambda Developer Guide ) and with Guard ( Guard GitHub Repository ), a policy-as-code language. AWS Config custom rules created with AWS Lambda are called AWS Config Custom Lambda Rules and AWS Config custom rules created with Guard are called AWS Config Custom Policy Rules .

If you are adding a new AWS Config Custom Lambda rule, you first need to create an AWS Lambda function that the rule invokes to evaluate your resources. When you use the ConfigRule resource to add a Custom Lambda rule to AWS Config , you must specify the Amazon Resource Name (ARN) that AWS Lambda assigns to the function. You specify the ARN in the SourceIdentifier key. This key is part of the Source object, which is part of the ConfigRule object.

For any new AWS Config rule that you add, specify the ConfigRuleName in the ConfigRule object. Do not specify the ConfigRuleArn or the ConfigRuleId . These values are generated by AWS Config for new rules.

If you are updating a rule that you added previously, you can specify the rule by ConfigRuleName , ConfigRuleId , or ConfigRuleArn in the ConfigRule data type that you use in this request.

For more information about developing and using AWS Config rules, see Evaluating Resources with AWS Config Rules in the AWS Config Developer Guide .

Example:

 // The code below shows an example of how to instantiate this type.
 // The values are placeholders you should change.
 import software.amazon.awscdk.services.config.*;
 Object inputParameters;
 CfnConfigRule cfnConfigRule = CfnConfigRule.Builder.create(this, "MyCfnConfigRule")
         .source(SourceProperty.builder()
                 .owner("owner")
                 // the properties below are optional
                 .customPolicyDetails(CustomPolicyDetailsProperty.builder()
                         .enableDebugLogDelivery(false)
                         .policyRuntime("policyRuntime")
                         .policyText("policyText")
                         .build())
                 .sourceDetails(List.of(SourceDetailProperty.builder()
                         .eventSource("eventSource")
                         .messageType("messageType")
                         // the properties below are optional
                         .maximumExecutionFrequency("maximumExecutionFrequency")
                         .build()))
                 .sourceIdentifier("sourceIdentifier")
                 .build())
         // the properties below are optional
         .configRuleName("configRuleName")
         .description("description")
         .inputParameters(inputParameters)
         .maximumExecutionFrequency("maximumExecutionFrequency")
         .scope(ScopeProperty.builder()
                 .complianceResourceId("complianceResourceId")
                 .complianceResourceTypes(List.of("complianceResourceTypes"))
                 .tagKey("tagKey")
                 .tagValue("tagValue")
                 .build())
         .build();
 

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	CfnConfigRule.Builder A fluent builder for CfnConfigRule.
static interface	CfnConfigRule.CustomPolicyDetailsProperty Provides the runtime system, policy definition, and whether debug logging enabled.
static interface	CfnConfigRule.ScopeProperty Defines which resources trigger an evaluation for an AWS Config rule.
static interface	CfnConfigRule.SourceDetailProperty Provides the source and the message types that trigger AWS Config to evaluate your AWS resources against a rule.
static interface	CfnConfigRule.SourceProperty Provides the CustomPolicyDetails, the rule owner ( `AWS` for managed rules, `CUSTOM_POLICY` for Custom Policy rules, and `CUSTOM_LAMBDA` for Custom Lambda rules), the rule identifier, and the events that cause the evaluation of your AWS resources.

Nested classes/interfaces inherited from interface software.amazon.awscdk.core.IInspectable

IInspectable.Jsii$Default, IInspectable.Jsii$Proxy

Nested classes/interfaces inherited from interface software.amazon.awscdk.core.IConstruct

IConstruct.Jsii$Default

Field Summary

Fields

Modifier and Type	Field and Description
static java.lang.String	CFN_RESOURCE_TYPE_NAME The CloudFormation resource type name for this resource class.

Constructor Summary

Constructors

Modifier	Constructor and Description
	CfnConfigRule(Construct scope, java.lang.String id, CfnConfigRuleProps props) Create a new `AWS::Config::ConfigRule`.
protected	CfnConfigRule(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)
protected	CfnConfigRule(software.amazon.jsii.JsiiObjectRef objRef)

Method Summary

Modifier and Type	Method and Description
java.lang.String	getAttrArn() The Amazon Resource Name (ARN) of the AWS Config rule, such as `arn:aws:config:us-east-1:123456789012:config-rule/config-rule-a1bzhi` .
java.lang.String	getAttrComplianceType() The compliance status of an AWS Config rule, such as `COMPLIANT` or `NON_COMPLIANT` .
java.lang.String	getAttrConfigRuleId() The ID of the AWS Config rule, such as `config-rule-a1bzhi` .
protected java.util.Map<java.lang.String,java.lang.Object>	getCfnProperties()
java.lang.String	getConfigRuleName() A name for the AWS Config rule.
java.lang.String	getDescription() The description that you provide for the AWS Config rule.
java.lang.Object	getInputParameters() A string, in JSON format, that is passed to the AWS Config rule Lambda function.
java.lang.String	getMaximumExecutionFrequency() The maximum frequency with which AWS Config runs evaluations for a rule.
java.lang.Object	getScope() Defines which resources can trigger an evaluation for the rule.
java.lang.Object	getSource() Provides the rule owner ( `AWS` for managed rules, `CUSTOM_POLICY` for Custom Policy rules, and `CUSTOM_LAMBDA` for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.
void	inspect(TreeInspector inspector) Examines the CloudFormation resource and discloses attributes.
protected java.util.Map<java.lang.String,java.lang.Object>	renderProperties(java.util.Map<java.lang.String,java.lang.Object> props)
void	setConfigRuleName(java.lang.String value) A name for the AWS Config rule.
void	setDescription(java.lang.String value) The description that you provide for the AWS Config rule.
void	setInputParameters(java.lang.Object value) A string, in JSON format, that is passed to the AWS Config rule Lambda function.
void	setMaximumExecutionFrequency(java.lang.String value) The maximum frequency with which AWS Config runs evaluations for a rule.
void	setScope(CfnConfigRule.ScopeProperty value) Defines which resources can trigger an evaluation for the rule.
void	setScope(IResolvable value) Defines which resources can trigger an evaluation for the rule.
void	setSource(CfnConfigRule.SourceProperty value) Provides the rule owner ( `AWS` for managed rules, `CUSTOM_POLICY` for Custom Policy rules, and `CUSTOM_LAMBDA` for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.
void	setSource(IResolvable value) Provides the rule owner ( `AWS` for managed rules, `CUSTOM_POLICY` for Custom Policy rules, and `CUSTOM_LAMBDA` for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.

Methods inherited from class software.amazon.awscdk.core.CfnResource

addDeletionOverride, addDependsOn, addMetadata, addOverride, addPropertyDeletionOverride, addPropertyOverride, applyRemovalPolicy, applyRemovalPolicy, applyRemovalPolicy, getAtt, getCfnOptions, getCfnResourceType, getMetadata, getUpdatedProperites, isCfnResource, shouldSynthesize, toString, validateProperties

Methods inherited from class software.amazon.awscdk.core.CfnRefElement

getRef

Methods inherited from class software.amazon.awscdk.core.CfnElement

getCreationStack, getLogicalId, getStack, isCfnElement, overrideLogicalId

Methods inherited from class software.amazon.awscdk.core.Construct

getNode, isConstruct, onPrepare, onSynthesize, onValidate, prepare, synthesize, validate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

CFN_RESOURCE_TYPE_NAME

public static final java.lang.String CFN_RESOURCE_TYPE_NAME

The CloudFormation resource type name for this resource class.

Constructor Detail

CfnConfigRule

protected CfnConfigRule(software.amazon.jsii.JsiiObjectRef objRef)

CfnConfigRule

protected CfnConfigRule(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

CfnConfigRule

public CfnConfigRule(Construct scope,
                     java.lang.String id,
                     CfnConfigRuleProps props)

Create a new `AWS::Config::ConfigRule`.

Parameters:

scope - - scope in which this resource is defined. This parameter is required.

id - - scoped id of the resource. This parameter is required.

props - - resource properties. This parameter is required.

Method Detail

inspect

public void inspect(TreeInspector inspector)

Examines the CloudFormation resource and discloses attributes.

Specified by:

inspect in interface IInspectable

Parameters:

inspector - - tree inspector to collect and process attributes. This parameter is required.

renderProperties

protected java.util.Map<java.lang.String,java.lang.Object> renderProperties(java.util.Map<java.lang.String,java.lang.Object> props)

Overrides:

renderProperties in class CfnResource

Parameters:

props - This parameter is required.

getAttrArn

public java.lang.String getAttrArn()

The Amazon Resource Name (ARN) of the AWS Config rule, such as `arn:aws:config:us-east-1:123456789012:config-rule/config-rule-a1bzhi` .

getAttrComplianceType

public java.lang.String getAttrComplianceType()

The compliance status of an AWS Config rule, such as `COMPLIANT` or `NON_COMPLIANT` .

getAttrConfigRuleId

public java.lang.String getAttrConfigRuleId()

The ID of the AWS Config rule, such as `config-rule-a1bzhi` .

getCfnProperties

protected java.util.Map<java.lang.String,java.lang.Object> getCfnProperties()

Overrides:

getCfnProperties in class CfnResource

getInputParameters

public java.lang.Object getInputParameters()

A string, in JSON format, that is passed to the AWS Config rule Lambda function.

setInputParameters

public void setInputParameters(java.lang.Object value)

A string, in JSON format, that is passed to the AWS Config rule Lambda function.

getSource

public java.lang.Object getSource()

Provides the rule owner ( `AWS` for managed rules, `CUSTOM_POLICY` for Custom Policy rules, and `CUSTOM_LAMBDA` for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.

setSource

public void setSource(CfnConfigRule.SourceProperty value)

Provides the rule owner ( `AWS` for managed rules, `CUSTOM_POLICY` for Custom Policy rules, and `CUSTOM_LAMBDA` for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.

setSource

public void setSource(IResolvable value)

Provides the rule owner ( `AWS` for managed rules, `CUSTOM_POLICY` for Custom Policy rules, and `CUSTOM_LAMBDA` for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.

getConfigRuleName

public java.lang.String getConfigRuleName()

A name for the AWS Config rule.

If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the rule name. For more information, see Name Type .

setConfigRuleName

public void setConfigRuleName(java.lang.String value)

A name for the AWS Config rule.

If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the rule name. For more information, see Name Type .

getDescription

public java.lang.String getDescription()

The description that you provide for the AWS Config rule.

setDescription

public void setDescription(java.lang.String value)

The description that you provide for the AWS Config rule.

getMaximumExecutionFrequency

public java.lang.String getMaximumExecutionFrequency()

The maximum frequency with which AWS Config runs evaluations for a rule.

You can specify a value for MaximumExecutionFrequency when:

• You are using an AWS managed rule that is triggered at a periodic frequency.
• Your custom rule is triggered when AWS Config delivers the configuration snapshot. For more information, see ConfigSnapshotDeliveryProperties .

By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the MaximumExecutionFrequency parameter.

setMaximumExecutionFrequency

public void setMaximumExecutionFrequency(java.lang.String value)

The maximum frequency with which AWS Config runs evaluations for a rule.

You can specify a value for MaximumExecutionFrequency when:

• You are using an AWS managed rule that is triggered at a periodic frequency.
• Your custom rule is triggered when AWS Config delivers the configuration snapshot. For more information, see ConfigSnapshotDeliveryProperties .

By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the MaximumExecutionFrequency parameter.

getScope

public java.lang.Object getScope()

Defines which resources can trigger an evaluation for the rule.

The scope can include one or more resource types, a combination of one resource type and one resource ID, or a combination of a tag key and value. Specify a scope to constrain the resources that can trigger an evaluation for the rule. If you do not specify a scope, evaluations are triggered when any resource in the recording group changes.

The scope can be empty.

setScope

public void setScope(IResolvable value)

Defines which resources can trigger an evaluation for the rule.

The scope can include one or more resource types, a combination of one resource type and one resource ID, or a combination of a tag key and value. Specify a scope to constrain the resources that can trigger an evaluation for the rule. If you do not specify a scope, evaluations are triggered when any resource in the recording group changes.

The scope can be empty.

setScope

public void setScope(CfnConfigRule.ScopeProperty value)

Defines which resources can trigger an evaluation for the rule.

The scope can include one or more resource types, a combination of one resource type and one resource ID, or a combination of a tag key and value. Specify a scope to constrain the resources that can trigger an evaluation for the rule. If you do not specify a scope, evaluations are triggered when any resource in the recording group changes.

The scope can be empty.