CfnConfigRulePropsMixin

class aws_cdk.mixins_preview.aws_config.mixins.CfnConfigRulePropsMixin(props, *, strategy=None)

Bases: Mixin

You must first create and start the AWS Config configuration recorder in order to create AWS Config managed rules with AWS CloudFormation .

For more information, see Managing the Configuration Recorder .

Adds or updates an AWS Config rule to evaluate if your AWS resources comply with your desired configurations. For information on how many AWS Config rules you can have per account, see *Service Limits* in the AWS Config Developer Guide .

There are two types of rules: AWS Config Managed Rules and AWS Config Custom Rules . You can use the ConfigRule resource to create both AWS Config Managed Rules and AWS Config Custom Rules.

AWS Config Managed Rules are predefined, customizable rules created by AWS Config . For a list of managed rules, see List of AWS Config Managed Rules . If you are adding an AWS Config managed rule, you must specify the rule’s identifier for the SourceIdentifier key.

AWS Config Custom Rules are rules that you create from scratch. There are two ways to create AWS Config custom rules: with Lambda functions ( AWS Lambda Developer Guide ) and with Guard ( Guard GitHub Repository ), a policy-as-code language. AWS Config custom rules created with AWS Lambda are called AWS Config Custom Lambda Rules and AWS Config custom rules created with Guard are called AWS Config Custom Policy Rules .

If you are adding a new AWS Config Custom Lambda rule, you first need to create an AWS Lambda function that the rule invokes to evaluate your resources. When you use the ConfigRule resource to add a Custom Lambda rule to AWS Config , you must specify the Amazon Resource Name (ARN) that AWS Lambda assigns to the function. You specify the ARN in the SourceIdentifier key. This key is part of the Source object, which is part of the ConfigRule object.

For any new AWS Config rule that you add, specify the ConfigRuleName in the ConfigRule object. Do not specify the ConfigRuleArn or the ConfigRuleId . These values are generated by AWS Config for new rules.

If you are updating a rule that you added previously, you can specify the rule by ConfigRuleName , ConfigRuleId , or ConfigRuleArn in the ConfigRule data type that you use in this request.

For more information about developing and using AWS Config rules, see Evaluating Resources with AWS Config Rules in the AWS Config Developer Guide .

see:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-config-configrule.html

cloudformationResource:

AWS::Config::ConfigRule

mixin:

true

exampleMetadata:

fixture=_generated

Example:
# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview import mixins
from aws_cdk.mixins_preview.aws_config import mixins as config_mixins

# input_parameters: Any

cfn_config_rule_props_mixin = config_mixins.CfnConfigRulePropsMixin(config_mixins.CfnConfigRuleMixinProps(
    compliance=config_mixins.CfnConfigRulePropsMixin.ComplianceProperty(
        type="type"
    ),
    config_rule_name="configRuleName",
    description="description",
    evaluation_modes=[config_mixins.CfnConfigRulePropsMixin.EvaluationModeConfigurationProperty(
        mode="mode"
    )],
    input_parameters=input_parameters,
    maximum_execution_frequency="maximumExecutionFrequency",
    scope=config_mixins.CfnConfigRulePropsMixin.ScopeProperty(
        compliance_resource_id="complianceResourceId",
        compliance_resource_types=["complianceResourceTypes"],
        tag_key="tagKey",
        tag_value="tagValue"
    ),
    source=config_mixins.CfnConfigRulePropsMixin.SourceProperty(
        custom_policy_details=config_mixins.CfnConfigRulePropsMixin.CustomPolicyDetailsProperty(
            enable_debug_log_delivery=False,
            policy_runtime="policyRuntime",
            policy_text="policyText"
        ),
        owner="owner",
        source_details=[config_mixins.CfnConfigRulePropsMixin.SourceDetailProperty(
            event_source="eventSource",
            maximum_execution_frequency="maximumExecutionFrequency",
            message_type="messageType"
        )],
        source_identifier="sourceIdentifier"
    )
),
    strategy=mixins.PropertyMergeStrategy.OVERRIDE
)

Create a mixin to apply properties to AWS::Config::ConfigRule.

Parameters:

props (Union[CfnConfigRuleMixinProps, Dict[str, Any]]) – L1 properties to apply.
strategy (Optional[PropertyMergeStrategy]) – (experimental) Strategy for merging nested properties. Default: - PropertyMergeStrategy.MERGE

Methods

apply_to(construct)

Apply the mixin properties to the construct.

Parameters:: construct (IConstruct)
Return type:: None

supports(construct)

Check if this mixin supports the given construct.

Parameters:: construct (IConstruct)
Return type:: bool

Attributes

CFN_PROPERTY_KEYS = ['compliance', 'configRuleName', 'description', 'evaluationModes', 'inputParameters', 'maximumExecutionFrequency', 'scope', 'source']

Static Methods

classmethod is_mixin(x)

(experimental) Checks if x is a Mixin.

Parameters:: x (Any) – Any object.
Return type:: bool
Returns:: true if x is an object created from a class which extends Mixin.
Stability:: experimental

ComplianceProperty

class CfnConfigRulePropsMixin.ComplianceProperty(*, type=None)

Bases: object

Indicates whether an AWS resource or AWS Config rule is compliant and provides the number of contributors that affect the compliance.

Parameters:: type (Optional[str]) – Indicates whether an AWS resource or AWS Config rule is compliant. A resource is compliant if it complies with all of the AWS Config rules that evaluate it. A resource is noncompliant if it does not comply with one or more of these rules. A rule is compliant if all of the resources that the rule evaluates comply with it. A rule is noncompliant if any of these resources do not comply. AWS Config returns the INSUFFICIENT_DATA value when no evaluation results are available for the AWS resource or AWS Config rule. For the Compliance data type, AWS Config supports only COMPLIANT , NON_COMPLIANT , and INSUFFICIENT_DATA values. AWS Config does not support the NOT_APPLICABLE value for the Compliance data type.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-compliance.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_config import mixins as config_mixins

compliance_property = config_mixins.CfnConfigRulePropsMixin.ComplianceProperty(
    type="type"
)

Attributes

type

Indicates whether an AWS resource or AWS Config rule is compliant.

A resource is compliant if it complies with all of the AWS Config rules that evaluate it. A resource is noncompliant if it does not comply with one or more of these rules.

A rule is compliant if all of the resources that the rule evaluates comply with it. A rule is noncompliant if any of these resources do not comply.

AWS Config returns the INSUFFICIENT_DATA value when no evaluation results are available for the AWS resource or AWS Config rule.

For the Compliance data type, AWS Config supports only COMPLIANT , NON_COMPLIANT , and INSUFFICIENT_DATA values. AWS Config does not support the NOT_APPLICABLE value for the Compliance data type.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-compliance.html#cfn-config-configrule-compliance-type

CustomPolicyDetailsProperty

class CfnConfigRulePropsMixin.CustomPolicyDetailsProperty(*, enable_debug_log_delivery=None, policy_runtime=None, policy_text=None)

Bases: object

Provides the CustomPolicyDetails, the rule owner ( AWS for managed rules, CUSTOM_POLICY for Custom Policy rules, and CUSTOM_LAMBDA for Custom Lambda rules), the rule identifier, and the events that cause the evaluation of your AWS resources.

Parameters:

enable_debug_log_delivery (Union[bool, IResolvable, None]) – The boolean expression for enabling debug logging for your AWS Config Custom Policy rule. The default value is false .
policy_runtime (Optional[str]) –
The runtime system for your AWS Config Custom Policy rule. Guard is a policy-as-code language that allows you to write policies that are enforced by AWS Config Custom Policy rules. For more information about Guard, see the Guard GitHub Repository .
policy_text (Optional[str]) – The policy definition containing the logic for your AWS Config Custom Policy rule.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-custompolicydetails.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_config import mixins as config_mixins

custom_policy_details_property = config_mixins.CfnConfigRulePropsMixin.CustomPolicyDetailsProperty(
    enable_debug_log_delivery=False,
    policy_runtime="policyRuntime",
    policy_text="policyText"
)

Attributes

enable_debug_log_delivery

The boolean expression for enabling debug logging for your AWS Config Custom Policy rule.

The default value is false .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-custompolicydetails.html#cfn-config-configrule-custompolicydetails-enabledebuglogdelivery

policy_runtime

The runtime system for your AWS Config Custom Policy rule.

Guard is a policy-as-code language that allows you to write policies that are enforced by AWS Config Custom Policy rules. For more information about Guard, see the Guard GitHub Repository .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-custompolicydetails.html#cfn-config-configrule-custompolicydetails-policyruntime

policy_text

The policy definition containing the logic for your AWS Config Custom Policy rule.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-custompolicydetails.html#cfn-config-configrule-custompolicydetails-policytext

EvaluationModeConfigurationProperty

class CfnConfigRulePropsMixin.EvaluationModeConfigurationProperty(*, mode=None)

Bases: object

The configuration object for AWS Config rule evaluation mode.

The supported valid values are Detective or Proactive.

Parameters:: mode (Optional[str]) – The mode of an evaluation. The valid values are Detective or Proactive.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-evaluationmodeconfiguration.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_config import mixins as config_mixins

evaluation_mode_configuration_property = config_mixins.CfnConfigRulePropsMixin.EvaluationModeConfigurationProperty(
    mode="mode"
)

Attributes

mode

The mode of an evaluation.

The valid values are Detective or Proactive.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-evaluationmodeconfiguration.html#cfn-config-configrule-evaluationmodeconfiguration-mode

ScopeProperty

class CfnConfigRulePropsMixin.ScopeProperty(*, compliance_resource_id=None, compliance_resource_types=None, tag_key=None, tag_value=None)

Bases: object

Defines which resources trigger an evaluation for an AWS Config rule.

The scope can include one or more resource types, a combination of a tag key and value, or a combination of one resource type and one resource ID. Specify a scope to constrain which resources trigger an evaluation for a rule. Otherwise, evaluations for the rule are triggered when any resource in your recording group changes in configuration.

Parameters:

compliance_resource_id (Optional[str]) – The ID of the only AWS resource that you want to trigger an evaluation for the rule. If you specify a resource ID, you must specify one resource type for ComplianceResourceTypes .
compliance_resource_types (Optional[Sequence[str]]) – The resource types of only those AWS resources that you want to trigger an evaluation for the rule. You can only specify one type if you also specify a resource ID for ComplianceResourceId .
tag_key (Optional[str]) – The tag key that is applied to only those AWS resources that you want to trigger an evaluation for the rule.
tag_value (Optional[str]) – The tag value applied to only those AWS resources that you want to trigger an evaluation for the rule. If you specify a value for TagValue , you must also specify a value for TagKey .

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-scope.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_config import mixins as config_mixins

scope_property = config_mixins.CfnConfigRulePropsMixin.ScopeProperty(
    compliance_resource_id="complianceResourceId",
    compliance_resource_types=["complianceResourceTypes"],
    tag_key="tagKey",
    tag_value="tagValue"
)

Attributes

compliance_resource_id

The ID of the only AWS resource that you want to trigger an evaluation for the rule.

If you specify a resource ID, you must specify one resource type for ComplianceResourceTypes .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-scope.html#cfn-config-configrule-scope-complianceresourceid

compliance_resource_types

The resource types of only those AWS resources that you want to trigger an evaluation for the rule.

You can only specify one type if you also specify a resource ID for ComplianceResourceId .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-scope.html#cfn-config-configrule-scope-complianceresourcetypes

tag_key

The tag key that is applied to only those AWS resources that you want to trigger an evaluation for the rule.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-scope.html#cfn-config-configrule-scope-tagkey

tag_value

The tag value applied to only those AWS resources that you want to trigger an evaluation for the rule.

If you specify a value for TagValue , you must also specify a value for TagKey .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-scope.html#cfn-config-configrule-scope-tagvalue

SourceDetailProperty

class CfnConfigRulePropsMixin.SourceDetailProperty(*, event_source=None, maximum_execution_frequency=None, message_type=None)

Bases: object

Provides the source and the message types that trigger AWS Config to evaluate your AWS resources against a rule.

It also provides the frequency with which you want AWS Config to run evaluations for the rule if the trigger type is periodic. You can specify the parameter values for SourceDetail only for custom rules.

Parameters:

event_source (Optional[str]) – The source of the event, such as an AWS service, that triggers AWS Config to evaluate your AWS resources.
maximum_execution_frequency (Optional[str]) – The frequency at which you want AWS Config to run evaluations for a custom rule with a periodic trigger. If you specify a value for MaximumExecutionFrequency , then MessageType must use the ScheduledNotification value. .. epigraph:: By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the MaximumExecutionFrequency parameter. Based on the valid value you choose, AWS Config runs evaluations once for each valid value. For example, if you choose Three_Hours , AWS Config runs evaluations once every three hours. In this case, Three_Hours is the frequency of this rule.
message_type (Optional[str]) – The type of notification that triggers AWS Config to run an evaluation for a rule. You can specify the following notification types: - ConfigurationItemChangeNotification - Triggers an evaluation when AWS Config delivers a configuration item as a result of a resource change. - OversizedConfigurationItemChangeNotification - Triggers an evaluation when AWS Config delivers an oversized configuration item. AWS Config may generate this notification type when a resource changes and the notification exceeds the maximum size allowed by Amazon SNS. - ScheduledNotification - Triggers a periodic evaluation at the frequency specified for MaximumExecutionFrequency . - ConfigurationSnapshotDeliveryCompleted - Triggers a periodic evaluation when AWS Config delivers a configuration snapshot. If you want your custom rule to be triggered by configuration changes, specify two SourceDetail objects, one for ConfigurationItemChangeNotification and one for OversizedConfigurationItemChangeNotification .

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-sourcedetail.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_config import mixins as config_mixins

source_detail_property = config_mixins.CfnConfigRulePropsMixin.SourceDetailProperty(
    event_source="eventSource",
    maximum_execution_frequency="maximumExecutionFrequency",
    message_type="messageType"
)

Attributes

event_source

The source of the event, such as an AWS service, that triggers AWS Config to evaluate your AWS resources.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-sourcedetail.html#cfn-config-configrule-sourcedetail-eventsource

maximum_execution_frequency

The frequency at which you want AWS Config to run evaluations for a custom rule with a periodic trigger.

If you specify a value for MaximumExecutionFrequency , then MessageType must use the ScheduledNotification value. .. epigraph:

By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the ``MaximumExecutionFrequency`` parameter.

Based on the valid value you choose, AWS Config runs evaluations once for each valid value. For example, if you choose ``Three_Hours`` , AWS Config runs evaluations once every three hours. In this case, ``Three_Hours`` is the frequency of this rule.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-sourcedetail.html#cfn-config-configrule-sourcedetail-maximumexecutionfrequency

message_type

The type of notification that triggers AWS Config to run an evaluation for a rule.

You can specify the following notification types:

ConfigurationItemChangeNotification - Triggers an evaluation when AWS Config delivers a configuration item as a result of a resource change.
OversizedConfigurationItemChangeNotification - Triggers an evaluation when AWS Config delivers an oversized configuration item. AWS Config may generate this notification type when a resource changes and the notification exceeds the maximum size allowed by Amazon SNS.
ScheduledNotification - Triggers a periodic evaluation at the frequency specified for MaximumExecutionFrequency .
ConfigurationSnapshotDeliveryCompleted - Triggers a periodic evaluation when AWS Config delivers a configuration snapshot.

If you want your custom rule to be triggered by configuration changes, specify two SourceDetail objects, one for ConfigurationItemChangeNotification and one for OversizedConfigurationItemChangeNotification .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-sourcedetail.html#cfn-config-configrule-sourcedetail-messagetype

SourceProperty

class CfnConfigRulePropsMixin.SourceProperty(*, custom_policy_details=None, owner=None, source_details=None, source_identifier=None)

Bases: object

Provides the CustomPolicyDetails, the rule owner ( AWS for managed rules, CUSTOM_POLICY for Custom Policy rules, and CUSTOM_LAMBDA for Custom Lambda rules), the rule identifier, and the events that cause the evaluation of your AWS resources.

Parameters:

custom_policy_details (Union[IResolvable, CustomPolicyDetailsProperty, Dict[str, Any], None]) – Provides the runtime system, policy definition, and whether debug logging is enabled. Required when owner is set to CUSTOM_POLICY .
owner (Optional[str]) – Indicates whether AWS or the customer owns and manages the AWS Config rule. AWS Config Managed Rules are predefined rules owned by AWS . For more information, see AWS Config Managed Rules in the AWS Config developer guide . AWS Config Custom Rules are rules that you can develop either with Guard ( CUSTOM_POLICY ) or AWS Lambda ( CUSTOM_LAMBDA ). For more information, see AWS Config Custom Rules in the AWS Config developer guide .
source_details (Union[IResolvable, Sequence[Union[IResolvable, SourceDetailProperty, Dict[str, Any]]], None]) – Provides the source and the message types that cause AWS Config to evaluate your AWS resources against a rule. It also provides the frequency with which you want AWS Config to run evaluations for the rule if the trigger type is periodic. If the owner is set to CUSTOM_POLICY , the only acceptable values for the AWS Config rule trigger message type are ConfigurationItemChangeNotification and OversizedConfigurationItemChangeNotification .
source_identifier (Optional[str]) –
For AWS Config Managed rules, a predefined identifier from a list. For example, IAM_PASSWORD_POLICY is a managed rule. To reference a managed rule, see List of AWS Config Managed Rules . For AWS Config Custom Lambda rules, the identifier is the Amazon Resource Name (ARN) of the rule’s AWS Lambda function, such as arn:aws:lambda:us-east-2:123456789012:function:custom_rule_name . For AWS Config Custom Policy rules, this field will be ignored.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_config import mixins as config_mixins

source_property = config_mixins.CfnConfigRulePropsMixin.SourceProperty(
    custom_policy_details=config_mixins.CfnConfigRulePropsMixin.CustomPolicyDetailsProperty(
        enable_debug_log_delivery=False,
        policy_runtime="policyRuntime",
        policy_text="policyText"
    ),
    owner="owner",
    source_details=[config_mixins.CfnConfigRulePropsMixin.SourceDetailProperty(
        event_source="eventSource",
        maximum_execution_frequency="maximumExecutionFrequency",
        message_type="messageType"
    )],
    source_identifier="sourceIdentifier"
)

Attributes

custom_policy_details

Provides the runtime system, policy definition, and whether debug logging is enabled.

Required when owner is set to CUSTOM_POLICY .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source.html#cfn-config-configrule-source-custompolicydetails

owner

Indicates whether AWS or the customer owns and manages the AWS Config rule.

AWS Config Managed Rules are predefined rules owned by AWS . For more information, see AWS Config Managed Rules in the AWS Config developer guide .

AWS Config Custom Rules are rules that you can develop either with Guard ( CUSTOM_POLICY ) or AWS Lambda ( CUSTOM_LAMBDA ). For more information, see AWS Config Custom Rules in the AWS Config developer guide .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source.html#cfn-config-configrule-source-owner

source_details

Provides the source and the message types that cause AWS Config to evaluate your AWS resources against a rule.

It also provides the frequency with which you want AWS Config to run evaluations for the rule if the trigger type is periodic.

If the owner is set to CUSTOM_POLICY , the only acceptable values for the AWS Config rule trigger message type are ConfigurationItemChangeNotification and OversizedConfigurationItemChangeNotification .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source.html#cfn-config-configrule-source-sourcedetails

source_identifier

For AWS Config Managed rules, a predefined identifier from a list.

For example, IAM_PASSWORD_POLICY is a managed rule. To reference a managed rule, see List of AWS Config Managed Rules .

For AWS Config Custom Lambda rules, the identifier is the Amazon Resource Name (ARN) of the rule’s AWS Lambda function, such as arn:aws:lambda:us-east-2:123456789012:function:custom_rule_name .

For AWS Config Custom Policy rules, this field will be ignored.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source.html#cfn-config-configrule-source-sourceidentifier