RuleScope

class aws_cdk.aws_config.RuleScope(*args: Any, **kwargs)

Bases: object

Determines which resources trigger an evaluation of an AWS Config rule.

ExampleMetadata:

infused

Example:

# eval_compliance_fn: lambda.Function
ssh_rule = config.ManagedRule(self, "SSH",
    identifier=config.ManagedRuleIdentifiers.EC2_SECURITY_GROUPS_INCOMING_SSH_DISABLED,
    rule_scope=config.RuleScope.from_resource(config.ResourceType.EC2_SECURITY_GROUP, "sg-1234567890abcdefgh")
)
custom_rule = config.CustomRule(self, "Lambda",
    lambda_function=eval_compliance_fn,
    configuration_changes=True,
    rule_scope=config.RuleScope.from_resources([config.ResourceType.CLOUDFORMATION_STACK, config.ResourceType.S3_BUCKET])
)

tag_rule = config.CustomRule(self, "CostCenterTagRule",
    lambda_function=eval_compliance_fn,
    configuration_changes=True,
    rule_scope=config.RuleScope.from_tag("Cost Center", "MyApp")
)

Attributes

key

tag key applied to resources that will trigger evaluation of a rule.

resource_id

ID of the only AWS resource that will trigger evaluation of a rule.

resource_types

Resource types that will trigger evaluation of a rule.

value

tag value applied to resources that will trigger evaluation of a rule.

Static Methods

classmethod from_resource(resource_type, resource_id=None)

restricts scope of changes to a specific resource type or resource identifier.

Parameters:
Return type:

RuleScope

classmethod from_resources(resource_types)

restricts scope of changes to specific resource types.

Parameters:

resource_types (Sequence[ResourceType])

Return type:

RuleScope

classmethod from_tag(key, value=None)

restricts scope of changes to a specific tag.

Parameters:

  • key (str)

  • value (Optional[str])

Return type:

RuleScope