CfnConfigRule

class aws_cdk.aws_config.CfnConfigRule(scope_, id, *, source, config_rule_name=None, description=None, input_parameters=None, maximum_execution_frequency=None, scope=None)

Bases: CfnResource

A CloudFormation AWS::Config::ConfigRule.

Adds or updates an AWS Config rule to evaluate if your AWS resources comply with your desired configurations. For information on how many AWS Config rules you can have per account, see *Service Limits* in the AWS Config Developer Guide .

There are two types of rules: AWS Config Managed Rules and AWS Config Custom Rules . You can use the ConfigRule resource to create both AWS Config Managed Rules and AWS Config Custom Rules.

AWS Config Managed Rules are predefined, customizable rules created by AWS Config . For a list of managed rules, see List of AWS Config Managed Rules . If you are adding an AWS Config managed rule, you must specify the rule’s identifier for the SourceIdentifier key.

AWS Config Custom Rules are rules that you create from scratch. There are two ways to create AWS Config custom rules: with Lambda functions ( AWS Lambda Developer Guide ) and with Guard ( Guard GitHub Repository ), a policy-as-code language. AWS Config custom rules created with AWS Lambda are called AWS Config Custom Lambda Rules and AWS Config custom rules created with Guard are called AWS Config Custom Policy Rules .

If you are adding a new AWS Config Custom Lambda rule, you first need to create an AWS Lambda function that the rule invokes to evaluate your resources. When you use the ConfigRule resource to add a Custom Lambda rule to AWS Config , you must specify the Amazon Resource Name (ARN) that AWS Lambda assigns to the function. You specify the ARN in the SourceIdentifier key. This key is part of the Source object, which is part of the ConfigRule object.

For any new AWS Config rule that you add, specify the ConfigRuleName in the ConfigRule object. Do not specify the ConfigRuleArn or the ConfigRuleId . These values are generated by AWS Config for new rules.

If you are updating a rule that you added previously, you can specify the rule by ConfigRuleName , ConfigRuleId , or ConfigRuleArn in the ConfigRule data type that you use in this request.

For more information about developing and using AWS Config rules, see Evaluating Resources with AWS Config Rules in the AWS Config Developer Guide .

CloudformationResource:: AWS::Config::ConfigRule
Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-config-configrule.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
import aws_cdk.aws_config as config

# input_parameters: Any

cfn_config_rule = config.CfnConfigRule(self, "MyCfnConfigRule",
    source=config.CfnConfigRule.SourceProperty(
        owner="owner",

        # the properties below are optional
        custom_policy_details=config.CfnConfigRule.CustomPolicyDetailsProperty(
            enable_debug_log_delivery=False,
            policy_runtime="policyRuntime",
            policy_text="policyText"
        ),
        source_details=[config.CfnConfigRule.SourceDetailProperty(
            event_source="eventSource",
            message_type="messageType",

            # the properties below are optional
            maximum_execution_frequency="maximumExecutionFrequency"
        )],
        source_identifier="sourceIdentifier"
    ),

    # the properties below are optional
    config_rule_name="configRuleName",
    description="description",
    input_parameters=input_parameters,
    maximum_execution_frequency="maximumExecutionFrequency",
    scope=config.CfnConfigRule.ScopeProperty(
        compliance_resource_id="complianceResourceId",
        compliance_resource_types=["complianceResourceTypes"],
        tag_key="tagKey",
        tag_value="tagValue"
    )
)

Create a new AWS::Config::ConfigRule.

Parameters:

scope (Union[IResolvable, ScopeProperty, Dict[str, Any], None]) –
- scope in which this resource is defined.
id (str) –
- scoped id of the resource.
source (Union[SourceProperty, Dict[str, Any], IResolvable]) – Provides the rule owner ( AWS for managed rules, CUSTOM_POLICY for Custom Policy rules, and CUSTOM_LAMBDA for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.
config_rule_name (Optional[str]) – A name for the AWS Config rule. If you don’t specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the rule name. For more information, see Name Type .
description (Optional[str]) – The description that you provide for the AWS Config rule.
input_parameters (Optional[Any]) – A string, in JSON format, that is passed to the AWS Config rule Lambda function.
maximum_execution_frequency (Optional[str]) – The maximum frequency with which AWS Config runs evaluations for a rule. You can specify a value for MaximumExecutionFrequency when: - You are using an AWS managed rule that is triggered at a periodic frequency. - Your custom rule is triggered when AWS Config delivers the configuration snapshot. For more information, see ConfigSnapshotDeliveryProperties . .. epigraph:: By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the MaximumExecutionFrequency parameter.
scope – Defines which resources can trigger an evaluation for the rule. The scope can include one or more resource types, a combination of one resource type and one resource ID, or a combination of a tag key and value. Specify a scope to constrain the resources that can trigger an evaluation for the rule. If you do not specify a scope, evaluations are triggered when any resource in the recording group changes. .. epigraph:: The scope can be empty.

Methods

add_deletion_override(path)

Syntactic sugar for addOverride(path, undefined).

Parameters:: path (str) – The path of the value to delete.
Return type:: None

add_depends_on(target)

Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.

This can be used for resources across stacks (or nested stack) boundaries and the dependency will automatically be transferred to the relevant scope.

Parameters:

target (CfnResource) –

Return type:

None

add_metadata(key, value)

Add a value to the CloudFormation Resource Metadata.

Parameters:

key (str) –
value (Any) –

See:

Return type:

None

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html

Note that this is a different set of metadata from CDK node metadata; this metadata ends up in the stack template under the resource, whereas CDK node metadata ends up in the Cloud Assembly.

add_override(path, value)

Adds an override to the synthesized CloudFormation resource.

To add a property override, either use addPropertyOverride or prefix path with “Properties.” (i.e. Properties.TopicName).

If the override is nested, separate each nested level using a dot (.) in the path parameter. If there is an array as part of the nesting, specify the index in the path.

To include a literal . in the property name, prefix with a \. In most programming languages you will need to write this as "\\." because the \ itself will need to be escaped.

For example:

cfn_resource.add_override("Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes", ["myattribute"])
cfn_resource.add_override("Properties.GlobalSecondaryIndexes.1.ProjectionType", "INCLUDE")

would add the overrides Example:

"Properties": {
   "GlobalSecondaryIndexes": [
     {
       "Projection": {
         "NonKeyAttributes": [ "myattribute" ]
         ...
       }
       ...
     },
     {
       "ProjectionType": "INCLUDE"
       ...
     },
   ]
   ...
}

The value argument to addOverride will not be processed or translated in any way. Pass raw JSON values in here with the correct capitalization for CloudFormation. If you pass CDK classes or structs, they will be rendered with lowercased key names, and CloudFormation will reject the template.

Parameters:

path (str) –
- The path of the property, you can use dot notation to override values in complex types. Any intermdediate keys will be created as needed.
value (Any) –
- The value. Could be primitive or complex.

Return type:

None

add_property_deletion_override(property_path)

Adds an override that deletes the value of a property from the resource definition.

Parameters:: property_path (str) – The path to the property.
Return type:: None

add_property_override(property_path, value)

Adds an override to a resource property.

Syntactic sugar for addOverride("Properties.<...>", value).

Parameters:

property_path (str) – The path of the property.
value (Any) – The value.

Return type:

None

apply_removal_policy(policy=None, *, apply_to_update_replace_policy=None, default=None)

Sets the deletion policy of the resource based on the removal policy specified.

The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you’ve removed it from the CDK application or because you’ve made a change that requires the resource to be replaced.

The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).

Parameters:

policy (Optional[RemovalPolicy]) –
apply_to_update_replace_policy (Optional[bool]) – Apply the same deletion policy to the resource’s “UpdateReplacePolicy”. Default: true
default (Optional[RemovalPolicy]) – The default policy to apply in case the removal policy is not defined. Default: - Default value is resource specific. To determine the default value for a resoure, please consult that specific resource’s documentation.

Return type:

None

get_att(attribute_name)

Returns a token for an runtime attribute of this resource.

Ideally, use generated attribute accessors (e.g. resource.arn), but this can be used for future compatibility in case there is no generated attribute.

Parameters:: attribute_name (str) – The name of the attribute.
Return type:: Reference

get_metadata(key)

Retrieve a value value from the CloudFormation Resource Metadata.

Parameters:

key (str) –

See:

Return type:

Any

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html

Note that this is a different set of metadata from CDK node metadata; this metadata ends up in the stack template under the resource, whereas CDK node metadata ends up in the Cloud Assembly.

inspect(inspector)

Examines the CloudFormation resource and discloses attributes.

Parameters:

inspector (TreeInspector) –

tree inspector to collect and process attributes.

Return type:

None

override_logical_id(new_logical_id)

Overrides the auto-generated logical ID with a specific ID.

Parameters:: new_logical_id (str) – The new logical ID to use for this stack element.
Return type:: None

to_string()

Returns a string representation of this construct.

Return type:: str
Returns:: a string representation of this resource

Attributes

CFN_RESOURCE_TYPE_NAME = 'AWS::Config::ConfigRule'

attr_arn

The Amazon Resource Name (ARN) of the AWS Config rule, such as arn:aws:config:us-east-1:123456789012:config-rule/config-rule-a1bzhi .

CloudformationAttribute:: Arn

attr_compliance_type

The compliance status of an AWS Config rule, such as COMPLIANT or NON_COMPLIANT .

CloudformationAttribute:: Compliance.Type

attr_config_rule_id

The ID of the AWS Config rule, such as config-rule-a1bzhi .

CloudformationAttribute:: ConfigRuleId

cfn_options: Options for this resource, such as condition, update policy etc.

cfn_resource_type: AWS resource type.

config_rule_name

A name for the AWS Config rule.

If you don’t specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the rule name. For more information, see Name Type .

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-config-configrule.html#cfn-config-configrule-configrulename

creation_stack

return:

the stack trace of the point where this Resource was created from, sourced from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most node +internal+ entries filtered.

description

The description that you provide for the AWS Config rule.

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-config-configrule.html#cfn-config-configrule-description

input_parameters

A string, in JSON format, that is passed to the AWS Config rule Lambda function.

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-config-configrule.html#cfn-config-configrule-inputparameters

logical_id

The logical ID for this CloudFormation stack element.

The logical ID of the element is calculated from the path of the resource node in the construct tree.

To override this value, use overrideLogicalId(newLogicalId).

Returns:

the logical ID as a stringified token. This value will only get resolved during synthesis.

maximum_execution_frequency

The maximum frequency with which AWS Config runs evaluations for a rule.

You can specify a value for MaximumExecutionFrequency when:

You are using an AWS managed rule that is triggered at a periodic frequency.
Your custom rule is triggered when AWS Config delivers the configuration snapshot. For more information, see ConfigSnapshotDeliveryProperties .

By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the MaximumExecutionFrequency parameter.

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-config-configrule.html#cfn-config-configrule-maximumexecutionfrequency

node: The construct tree node associated with this construct.

ref

Return a string that will be resolved to a CloudFormation { Ref } for this element.

If, by any chance, the intrinsic reference of a resource is not a string, you could coerce it to an IResolvable through Lazy.any({ produce: resource.ref }).

scope

Defines which resources can trigger an evaluation for the rule.

The scope can include one or more resource types, a combination of one resource type and one resource ID, or a combination of a tag key and value. Specify a scope to constrain the resources that can trigger an evaluation for the rule. If you do not specify a scope, evaluations are triggered when any resource in the recording group changes. .. epigraph:

The scope can be empty.

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-config-configrule.html#cfn-config-configrule-scope

source

Provides the rule owner ( AWS for managed rules, CUSTOM_POLICY for Custom Policy rules, and CUSTOM_LAMBDA for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-config-configrule.html#cfn-config-configrule-source

stack

The stack in which this element is defined.

CfnElements must be defined within a stack scope (directly or indirectly).

Static Methods

classmethod is_cfn_element(x)

Returns true if a construct is a stack element (i.e. part of the synthesized cloudformation template).

Uses duck-typing instead of instanceof to allow stack elements from different versions of this library to be included in the same stack.

Parameters:

x (Any) –

Return type:

bool

Returns:

The construct as a stack element or undefined if it is not a stack element.

classmethod is_cfn_resource(construct)

Check whether the given construct is a CfnResource.

Parameters:

construct (IConstruct) –

Return type:

bool

classmethod is_construct(x)

Return whether the given object is a Construct.

Parameters:

x (Any) –

Return type:

bool

CustomPolicyDetailsProperty

class CfnConfigRule.CustomPolicyDetailsProperty(*, enable_debug_log_delivery=None, policy_runtime=None, policy_text=None)

Bases: object

Provides the runtime system, policy definition, and whether debug logging enabled.

You can specify the following CustomPolicyDetails parameter values only for AWS Config Custom Policy rules.

Parameters:

enable_debug_log_delivery (Union[bool, IResolvable, None]) – The boolean expression for enabling debug logging for your AWS Config Custom Policy rule. The default value is false .
policy_runtime (Optional[str]) –
The runtime system for your AWS Config Custom Policy rule. Guard is a policy-as-code language that allows you to write policies that are enforced by AWS Config Custom Policy rules. For more information about Guard, see the Guard GitHub Repository .
policy_text (Optional[str]) – The policy definition containing the logic for your AWS Config Custom Policy rule.

Link:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-custompolicydetails.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
import aws_cdk.aws_config as config

custom_policy_details_property = config.CfnConfigRule.CustomPolicyDetailsProperty(
    enable_debug_log_delivery=False,
    policy_runtime="policyRuntime",
    policy_text="policyText"
)

Attributes

enable_debug_log_delivery

The boolean expression for enabling debug logging for your AWS Config Custom Policy rule.

The default value is false .

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-custompolicydetails.html#cfn-config-configrule-custompolicydetails-enabledebuglogdelivery

policy_runtime

The runtime system for your AWS Config Custom Policy rule.

Guard is a policy-as-code language that allows you to write policies that are enforced by AWS Config Custom Policy rules. For more information about Guard, see the Guard GitHub Repository .

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-custompolicydetails.html#cfn-config-configrule-custompolicydetails-policyruntime

policy_text

The policy definition containing the logic for your AWS Config Custom Policy rule.

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-custompolicydetails.html#cfn-config-configrule-custompolicydetails-policytext

ScopeProperty

class CfnConfigRule.ScopeProperty(*, compliance_resource_id=None, compliance_resource_types=None, tag_key=None, tag_value=None)

Bases: object

Defines which resources trigger an evaluation for an AWS Config rule.

The scope can include one or more resource types, a combination of a tag key and value, or a combination of one resource type and one resource ID. Specify a scope to constrain which resources trigger an evaluation for a rule. Otherwise, evaluations for the rule are triggered when any resource in your recording group changes in configuration.

Parameters:

compliance_resource_id (Optional[str]) – The ID of the only AWS resource that you want to trigger an evaluation for the rule. If you specify a resource ID, you must specify one resource type for ComplianceResourceTypes .
compliance_resource_types (Optional[Sequence[str]]) – The resource types of only those AWS resources that you want to trigger an evaluation for the rule. You can only specify one type if you also specify a resource ID for ComplianceResourceId .
tag_key (Optional[str]) – The tag key that is applied to only those AWS resources that you want to trigger an evaluation for the rule.
tag_value (Optional[str]) – The tag value applied to only those AWS resources that you want to trigger an evaluation for the rule. If you specify a value for TagValue , you must also specify a value for TagKey .

Link:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-scope.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
import aws_cdk.aws_config as config

scope_property = config.CfnConfigRule.ScopeProperty(
    compliance_resource_id="complianceResourceId",
    compliance_resource_types=["complianceResourceTypes"],
    tag_key="tagKey",
    tag_value="tagValue"
)

Attributes

compliance_resource_id

The ID of the only AWS resource that you want to trigger an evaluation for the rule.

If you specify a resource ID, you must specify one resource type for ComplianceResourceTypes .

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-scope.html#cfn-config-configrule-scope-complianceresourceid

compliance_resource_types

The resource types of only those AWS resources that you want to trigger an evaluation for the rule.

You can only specify one type if you also specify a resource ID for ComplianceResourceId .

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-scope.html#cfn-config-configrule-scope-complianceresourcetypes

tag_key

The tag key that is applied to only those AWS resources that you want to trigger an evaluation for the rule.

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-scope.html#cfn-config-configrule-scope-tagkey

tag_value

The tag value applied to only those AWS resources that you want to trigger an evaluation for the rule.

If you specify a value for TagValue , you must also specify a value for TagKey .

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-scope.html#cfn-config-configrule-scope-tagvalue

SourceDetailProperty

class CfnConfigRule.SourceDetailProperty(*, event_source, message_type, maximum_execution_frequency=None)

Bases: object

Provides the source and the message types that trigger AWS Config to evaluate your AWS resources against a rule.

It also provides the frequency with which you want AWS Config to run evaluations for the rule if the trigger type is periodic. You can specify the parameter values for SourceDetail only for custom rules.

Parameters:

event_source (str) – The source of the event, such as an AWS service, that triggers AWS Config to evaluate your AWS resources.
message_type (str) – The type of notification that triggers AWS Config to run an evaluation for a rule. You can specify the following notification types: - ConfigurationItemChangeNotification - Triggers an evaluation when AWS Config delivers a configuration item as a result of a resource change. - OversizedConfigurationItemChangeNotification - Triggers an evaluation when AWS Config delivers an oversized configuration item. AWS Config may generate this notification type when a resource changes and the notification exceeds the maximum size allowed by Amazon SNS. - ScheduledNotification - Triggers a periodic evaluation at the frequency specified for MaximumExecutionFrequency . - ConfigurationSnapshotDeliveryCompleted - Triggers a periodic evaluation when AWS Config delivers a configuration snapshot. If you want your custom rule to be triggered by configuration changes, specify two SourceDetail objects, one for ConfigurationItemChangeNotification and one for OversizedConfigurationItemChangeNotification .
maximum_execution_frequency (Optional[str]) – The frequency at which you want AWS Config to run evaluations for a custom rule with a periodic trigger. If you specify a value for MaximumExecutionFrequency , then MessageType must use the ScheduledNotification value. .. epigraph:: By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the MaximumExecutionFrequency parameter. Based on the valid value you choose, AWS Config runs evaluations once for each valid value. For example, if you choose Three_Hours , AWS Config runs evaluations once every three hours. In this case, Three_Hours is the frequency of this rule.

Link:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source-sourcedetails.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
import aws_cdk.aws_config as config

source_detail_property = config.CfnConfigRule.SourceDetailProperty(
    event_source="eventSource",
    message_type="messageType",

    # the properties below are optional
    maximum_execution_frequency="maximumExecutionFrequency"
)

Attributes

event_source

The source of the event, such as an AWS service, that triggers AWS Config to evaluate your AWS resources.

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source-sourcedetails.html#cfn-config-configrule-source-sourcedetail-eventsource

maximum_execution_frequency

The frequency at which you want AWS Config to run evaluations for a custom rule with a periodic trigger.

If you specify a value for MaximumExecutionFrequency , then MessageType must use the ScheduledNotification value. .. epigraph:

By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the ``MaximumExecutionFrequency`` parameter.

Based on the valid value you choose, AWS Config runs evaluations once for each valid value. For example, if you choose ``Three_Hours`` , AWS Config runs evaluations once every three hours. In this case, ``Three_Hours`` is the frequency of this rule.

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source-sourcedetails.html#cfn-config-configrule-sourcedetail-maximumexecutionfrequency

message_type

The type of notification that triggers AWS Config to run an evaluation for a rule.

You can specify the following notification types:

ConfigurationItemChangeNotification - Triggers an evaluation when AWS Config delivers a configuration item as a result of a resource change.
OversizedConfigurationItemChangeNotification - Triggers an evaluation when AWS Config delivers an oversized configuration item. AWS Config may generate this notification type when a resource changes and the notification exceeds the maximum size allowed by Amazon SNS.
ScheduledNotification - Triggers a periodic evaluation at the frequency specified for MaximumExecutionFrequency .
ConfigurationSnapshotDeliveryCompleted - Triggers a periodic evaluation when AWS Config delivers a configuration snapshot.

If you want your custom rule to be triggered by configuration changes, specify two SourceDetail objects, one for ConfigurationItemChangeNotification and one for OversizedConfigurationItemChangeNotification .

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source-sourcedetails.html#cfn-config-configrule-source-sourcedetail-messagetype

SourceProperty

class CfnConfigRule.SourceProperty(*, owner, custom_policy_details=None, source_details=None, source_identifier=None)

Bases: object

Provides the CustomPolicyDetails, the rule owner ( AWS for managed rules, CUSTOM_POLICY for Custom Policy rules, and CUSTOM_LAMBDA for Custom Lambda rules), the rule identifier, and the events that cause the evaluation of your AWS resources.

Parameters:

owner (str) – Indicates whether AWS or the customer owns and manages the AWS Config rule. AWS Config Managed Rules are predefined rules owned by AWS . For more information, see AWS Config Managed Rules in the AWS Config developer guide . AWS Config Custom Rules are rules that you can develop either with Guard ( CUSTOM_POLICY ) or AWS Lambda ( CUSTOM_LAMBDA ). For more information, see AWS Config Custom Rules in the AWS Config developer guide .
custom_policy_details (Union[IResolvable, CustomPolicyDetailsProperty, Dict[str, Any], None]) – Provides the runtime system, policy definition, and whether debug logging is enabled. Required when owner is set to CUSTOM_POLICY .
source_details (Union[IResolvable, Sequence[Union[IResolvable, SourceDetailProperty, Dict[str, Any]]], None]) – Provides the source and the message types that cause AWS Config to evaluate your AWS resources against a rule. It also provides the frequency with which you want AWS Config to run evaluations for the rule if the trigger type is periodic. If the owner is set to CUSTOM_POLICY , the only acceptable values for the AWS Config rule trigger message type are ConfigurationItemChangeNotification and OversizedConfigurationItemChangeNotification .
source_identifier (Optional[str]) –
For AWS Config Managed rules, a predefined identifier from a list. For example, IAM_PASSWORD_POLICY is a managed rule. To reference a managed rule, see List of AWS Config Managed Rules . For AWS Config Custom Lambda rules, the identifier is the Amazon Resource Name (ARN) of the rule’s AWS Lambda function, such as arn:aws:lambda:us-east-2:123456789012:function:custom_rule_name . For AWS Config Custom Policy rules, this field will be ignored.

Link:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
import aws_cdk.aws_config as config

source_property = config.CfnConfigRule.SourceProperty(
    owner="owner",

    # the properties below are optional
    custom_policy_details=config.CfnConfigRule.CustomPolicyDetailsProperty(
        enable_debug_log_delivery=False,
        policy_runtime="policyRuntime",
        policy_text="policyText"
    ),
    source_details=[config.CfnConfigRule.SourceDetailProperty(
        event_source="eventSource",
        message_type="messageType",

        # the properties below are optional
        maximum_execution_frequency="maximumExecutionFrequency"
    )],
    source_identifier="sourceIdentifier"
)

Attributes

custom_policy_details

Provides the runtime system, policy definition, and whether debug logging is enabled.

Required when owner is set to CUSTOM_POLICY .

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source.html#cfn-config-configrule-source-custompolicydetails

owner

Indicates whether AWS or the customer owns and manages the AWS Config rule.

AWS Config Managed Rules are predefined rules owned by AWS . For more information, see AWS Config Managed Rules in the AWS Config developer guide .

AWS Config Custom Rules are rules that you can develop either with Guard ( CUSTOM_POLICY ) or AWS Lambda ( CUSTOM_LAMBDA ). For more information, see AWS Config Custom Rules in the AWS Config developer guide .

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source.html#cfn-config-configrule-source-owner

source_details

Provides the source and the message types that cause AWS Config to evaluate your AWS resources against a rule.

It also provides the frequency with which you want AWS Config to run evaluations for the rule if the trigger type is periodic.

If the owner is set to CUSTOM_POLICY , the only acceptable values for the AWS Config rule trigger message type are ConfigurationItemChangeNotification and OversizedConfigurationItemChangeNotification .

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source.html#cfn-config-configrule-source-sourcedetails

source_identifier

For AWS Config Managed rules, a predefined identifier from a list.

For example, IAM_PASSWORD_POLICY is a managed rule. To reference a managed rule, see List of AWS Config Managed Rules .

For AWS Config Custom Lambda rules, the identifier is the Amazon Resource Name (ARN) of the rule’s AWS Lambda function, such as arn:aws:lambda:us-east-2:123456789012:function:custom_rule_name .

For AWS Config Custom Policy rules, this field will be ignored.

Link:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source.html#cfn-config-configrule-source-sourceidentifier