# CfnGuardHookProps

Properties for defining a `CfnGuardHook`.

Extends: CfnGuardHookProps
Used as props by: CfnGuardHook

- Source: Generated code
- Type last changed: v2.168.0 · 20 Nov 2024

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import * as cdk from 'aws-cdk-lib';
const cfnGuardHookProps: cdk.CfnGuardHookProps = {
  alias: 'alias',
  executionRole: 'executionRole',
  failureMode: 'failureMode',
  hookStatus: 'hookStatus',
  ruleLocation: {
    uri: 'uri',

    // the properties below are optional
    versionId: 'versionId',
  },
  targetOperations: ['targetOperations'],

  // the properties below are optional
  logBucket: 'logBucket',
  options: {
    inputParams: {
      uri: 'uri',

      // the properties below are optional
      versionId: 'versionId',
    },
  },
  stackFilters: {
    filteringCriteria: 'filteringCriteria',

    // the properties below are optional
    stackNames: {
      exclude: ['exclude'],
      include: ['include'],
    },
    stackRoles: {
      exclude: ['exclude'],
      include: ['include'],
    },
  },
  targetFilters: {
    targets: [{
      action: 'action',
      invocationPoint: 'invocationPoint',
      targetName: 'targetName',
    }],

    // the properties below are optional
    actions: ['actions'],
    invocationPoints: ['invocationPoints'],
    targetNames: ['targetNames'],
  },
};
```

## Properties

- `alias`: string (required) — The type name alias for the Hook. This alias must be unique per account and Region.

  The alias must be in the form `Name1::Name2::Name3` and must not begin with `AWS` . For example, `Private::Guard::MyTestHook` .

- `executionRole`: string (required) — The IAM role that the Hook assumes to retrieve your Guard rules from S3 and optionally write a detailed Guard output report back.

- `failureMode`: string (required) = "WARN" — Specifies how the Hook responds when rules fail their evaluation.

  - `FAIL` : Prevents the action from proceeding. This is helpful for enforcing strict compliance or security policies.
  - `WARN` : Issues warnings to users but allows actions to continue. This is useful for non-critical validations or informational checks.

- `hookStatus`: string (required) = "DISABLED" — Specifies if the Hook is `ENABLED` or `DISABLED` .

- `logBucket`: string — Specifies the name of an S3 bucket to store the Guard output report.

  This report contains the results of your Guard rule validations.

- `options`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnGuardHook.OptionsProperty](/cdk/api/v2/docs/aws-cdk-lib.CfnGuardHook.OptionsProperty.html) — Specifies the S3 location of your input parameters.

- `ruleLocation`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnGuardHook.S3LocationProperty](/cdk/api/v2/docs/aws-cdk-lib.CfnGuardHook.S3LocationProperty.html) (required) — Specifies the S3 location of your Guard rules.

- `stackFilters`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnGuardHook.StackFiltersProperty](/cdk/api/v2/docs/aws-cdk-lib.CfnGuardHook.StackFiltersProperty.html) — Specifies the stack level filters for the Hook.

  Example stack level filter in JSON:

  `"StackFilters": {"FilteringCriteria": "ALL", "StackNames": {"Exclude": [ "stack-1", "stack-2"]}}`

  Example stack level filter in YAML:

  `StackFilters: FilteringCriteria: ALL StackNames: Exclude: - stack-1 - stack-2`

- `targetFilters`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnGuardHook.TargetFiltersProperty](/cdk/api/v2/docs/aws-cdk-lib.CfnGuardHook.TargetFiltersProperty.html) — Specifies the target filters for the Hook.

  Example target filter in JSON:

  `"TargetFilters": {"Actions": [ "CREATE", "UPDATE", "DELETE" ]}`

  Example target filter in YAML:

  `TargetFilters: Actions: - CREATE - UPDATE - DELETE`

- `targetOperations`: string[] (required) — Specifies the list of operations the Hook is run against.

  For more information, see [Hook targets](https://docs.aws.amazon.com/cloudformation-cli/latest/hooks-userguide/hooks-concepts.html#hook-terms-hook-target) in the *CloudFormation Hooks User Guide* .

  Valid values: `STACK` | `RESOURCE` | `CHANGE_SET` | `CLOUD_CONTROL`