CfnConfigRule
- class aws_cdk.aws_config.CfnConfigRule(scope_, id, *, source, compliance=None, config_rule_name=None, description=None, evaluation_modes=None, input_parameters=None, maximum_execution_frequency=None, scope=None)
Bases:
CfnResource
You must first create and start the AWS Config configuration recorder in order to create AWS Config managed rules with AWS CloudFormation .
For more information, see Managing the Configuration Recorder .
Adds or updates an AWS Config rule to evaluate if your AWS resources comply with your desired configurations. For information on how many AWS Config rules you can have per account, see *Service Limits* in the AWS Config Developer Guide .
There are two types of rules: AWS Config Managed Rules and AWS Config Custom Rules . You can use the
ConfigRule
resource to create both AWS Config Managed Rules and AWS Config Custom Rules.AWS Config Managed Rules are predefined, customizable rules created by AWS Config . For a list of managed rules, see List of AWS Config Managed Rules . If you are adding an AWS Config managed rule, you must specify the rule’s identifier for the
SourceIdentifier
key.AWS Config Custom Rules are rules that you create from scratch. There are two ways to create AWS Config custom rules: with Lambda functions ( AWS Lambda Developer Guide ) and with Guard ( Guard GitHub Repository ), a policy-as-code language. AWS Config custom rules created with AWS Lambda are called AWS Config Custom Lambda Rules and AWS Config custom rules created with Guard are called AWS Config Custom Policy Rules .
If you are adding a new AWS Config Custom Lambda rule, you first need to create an AWS Lambda function that the rule invokes to evaluate your resources. When you use the
ConfigRule
resource to add a Custom Lambda rule to AWS Config , you must specify the Amazon Resource Name (ARN) that AWS Lambda assigns to the function. You specify the ARN in theSourceIdentifier
key. This key is part of theSource
object, which is part of theConfigRule
object.For any new AWS Config rule that you add, specify the
ConfigRuleName
in theConfigRule
object. Do not specify theConfigRuleArn
or theConfigRuleId
. These values are generated by AWS Config for new rules.If you are updating a rule that you added previously, you can specify the rule by
ConfigRuleName
,ConfigRuleId
, orConfigRuleArn
in theConfigRule
data type that you use in this request.For more information about developing and using AWS Config rules, see Evaluating Resources with AWS Config Rules in the AWS Config Developer Guide .
- see:
http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-config-configrule.html
- cloudformationResource:
AWS::Config::ConfigRule
- exampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_config as config # input_parameters: Any cfn_config_rule = config.CfnConfigRule(self, "MyCfnConfigRule", source=config.CfnConfigRule.SourceProperty( owner="owner", # the properties below are optional custom_policy_details=config.CfnConfigRule.CustomPolicyDetailsProperty( enable_debug_log_delivery=False, policy_runtime="policyRuntime", policy_text="policyText" ), source_details=[config.CfnConfigRule.SourceDetailProperty( event_source="eventSource", message_type="messageType", # the properties below are optional maximum_execution_frequency="maximumExecutionFrequency" )], source_identifier="sourceIdentifier" ), # the properties below are optional compliance=config.CfnConfigRule.ComplianceProperty( type="type" ), config_rule_name="configRuleName", description="description", evaluation_modes=[config.CfnConfigRule.EvaluationModeConfigurationProperty( mode="mode" )], input_parameters=input_parameters, maximum_execution_frequency="maximumExecutionFrequency", scope=config.CfnConfigRule.ScopeProperty( compliance_resource_id="complianceResourceId", compliance_resource_types=["complianceResourceTypes"], tag_key="tagKey", tag_value="tagValue" ) )
- Parameters:
scope (
Union
[IResolvable
,ScopeProperty
,Dict
[str
,Any
],None
]) – Scope in which this resource is defined.id (
str
) – Construct identifier for this resource (unique in its scope).source (
Union
[IResolvable
,SourceProperty
,Dict
[str
,Any
]]) – Provides the rule owner (AWS
for managed rules,CUSTOM_POLICY
for Custom Policy rules, andCUSTOM_LAMBDA
for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.compliance (
Union
[IResolvable
,ComplianceProperty
,Dict
[str
,Any
],None
]) – Indicates whether an AWS resource or AWS Config rule is compliant and provides the number of contributors that affect the compliance.config_rule_name (
Optional
[str
]) – A name for the AWS Config rule. If you don’t specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the rule name. For more information, see Name Type .description (
Optional
[str
]) – The description that you provide for the AWS Config rule.evaluation_modes (
Union
[IResolvable
,Sequence
[Union
[IResolvable
,EvaluationModeConfigurationProperty
,Dict
[str
,Any
]]],None
]) – The modes the AWS Config rule can be evaluated in. The valid values are distinct objects. By default, the value is Detective evaluation mode only.input_parameters (
Any
) – A string, in JSON format, that is passed to the AWS Config rule Lambda function.maximum_execution_frequency (
Optional
[str
]) – The maximum frequency with which AWS Config runs evaluations for a rule. You can specify a value forMaximumExecutionFrequency
when: - You are using an AWS managed rule that is triggered at a periodic frequency. - Your custom rule is triggered when AWS Config delivers the configuration snapshot. For more information, see ConfigSnapshotDeliveryProperties . .. epigraph:: By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for theMaximumExecutionFrequency
parameter.scope – Defines which resources can trigger an evaluation for the rule. The scope can include one or more resource types, a combination of one resource type and one resource ID, or a combination of a tag key and value. Specify a scope to constrain the resources that can trigger an evaluation for the rule. If you do not specify a scope, evaluations are triggered when any resource in the recording group changes. .. epigraph:: Scope is only supported for change-triggered rules. Scope is not supported for periodic or hybrid rules.
Methods
- add_deletion_override(path)
Syntactic sugar for
addOverride(path, undefined)
.- Parameters:
path (
str
) – The path of the value to delete.- Return type:
None
- add_dependency(target)
Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.
This can be used for resources across stacks (or nested stack) boundaries and the dependency will automatically be transferred to the relevant scope.
- Parameters:
target (
CfnResource
) –- Return type:
None
- add_depends_on(target)
(deprecated) Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.
- Parameters:
target (
CfnResource
) –- Deprecated:
use addDependency
- Stability:
deprecated
- Return type:
None
- add_metadata(key, value)
Add a value to the CloudFormation Resource Metadata.
- Parameters:
key (
str
) –value (
Any
) –
- See:
- Return type:
None
Note that this is a different set of metadata from CDK node metadata; this metadata ends up in the stack template under the resource, whereas CDK node metadata ends up in the Cloud Assembly.
- add_override(path, value)
Adds an override to the synthesized CloudFormation resource.
To add a property override, either use
addPropertyOverride
or prefixpath
with “Properties.” (i.e.Properties.TopicName
).If the override is nested, separate each nested level using a dot (.) in the path parameter. If there is an array as part of the nesting, specify the index in the path.
To include a literal
.
in the property name, prefix with a\
. In most programming languages you will need to write this as"\\."
because the\
itself will need to be escaped.For example:
cfn_resource.add_override("Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes", ["myattribute"]) cfn_resource.add_override("Properties.GlobalSecondaryIndexes.1.ProjectionType", "INCLUDE")
would add the overrides Example:
"Properties": { "GlobalSecondaryIndexes": [ { "Projection": { "NonKeyAttributes": [ "myattribute" ] ... } ... }, { "ProjectionType": "INCLUDE" ... }, ] ... }
The
value
argument toaddOverride
will not be processed or translated in any way. Pass raw JSON values in here with the correct capitalization for CloudFormation. If you pass CDK classes or structs, they will be rendered with lowercased key names, and CloudFormation will reject the template.- Parameters:
path (
str
) –The path of the property, you can use dot notation to override values in complex types. Any intermediate keys will be created as needed.
value (
Any
) –The value. Could be primitive or complex.
- Return type:
None
- add_property_deletion_override(property_path)
Adds an override that deletes the value of a property from the resource definition.
- Parameters:
property_path (
str
) – The path to the property.- Return type:
None
- add_property_override(property_path, value)
Adds an override to a resource property.
Syntactic sugar for
addOverride("Properties.<...>", value)
.- Parameters:
property_path (
str
) – The path of the property.value (
Any
) – The value.
- Return type:
None
- apply_removal_policy(policy=None, *, apply_to_update_replace_policy=None, default=None)
Sets the deletion policy of the resource based on the removal policy specified.
The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you’ve removed it from the CDK application or because you’ve made a change that requires the resource to be replaced.
The resource can be deleted (
RemovalPolicy.DESTROY
), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN
). In some cases, a snapshot can be taken of the resource prior to deletion (RemovalPolicy.SNAPSHOT
). A list of resources that support this policy can be found in the following link:- Parameters:
policy (
Optional
[RemovalPolicy
]) –apply_to_update_replace_policy (
Optional
[bool
]) – Apply the same deletion policy to the resource’s “UpdateReplacePolicy”. Default: truedefault (
Optional
[RemovalPolicy
]) – The default policy to apply in case the removal policy is not defined. Default: - Default value is resource specific. To determine the default value for a resource, please consult that specific resource’s documentation.
- See:
- Return type:
None
- get_att(attribute_name, type_hint=None)
Returns a token for an runtime attribute of this resource.
Ideally, use generated attribute accessors (e.g.
resource.arn
), but this can be used for future compatibility in case there is no generated attribute.- Parameters:
attribute_name (
str
) – The name of the attribute.type_hint (
Optional
[ResolutionTypeHint
]) –
- Return type:
- get_metadata(key)
Retrieve a value value from the CloudFormation Resource Metadata.
- Parameters:
key (
str
) –- See:
- Return type:
Any
Note that this is a different set of metadata from CDK node metadata; this metadata ends up in the stack template under the resource, whereas CDK node metadata ends up in the Cloud Assembly.
- inspect(inspector)
Examines the CloudFormation resource and discloses attributes.
- Parameters:
inspector (
TreeInspector
) – tree inspector to collect and process attributes.- Return type:
None
- obtain_dependencies()
Retrieves an array of resources this resource depends on.
This assembles dependencies on resources across stacks (including nested stacks) automatically.
- Return type:
List
[Union
[Stack
,CfnResource
]]
- obtain_resource_dependencies()
Get a shallow copy of dependencies between this resource and other resources in the same stack.
- Return type:
List
[CfnResource
]
- override_logical_id(new_logical_id)
Overrides the auto-generated logical ID with a specific ID.
- Parameters:
new_logical_id (
str
) – The new logical ID to use for this stack element.- Return type:
None
- remove_dependency(target)
Indicates that this resource no longer depends on another resource.
This can be used for resources across stacks (including nested stacks) and the dependency will automatically be removed from the relevant scope.
- Parameters:
target (
CfnResource
) –- Return type:
None
- replace_dependency(target, new_target)
Replaces one dependency with another.
- Parameters:
target (
CfnResource
) – The dependency to replace.new_target (
CfnResource
) – The new dependency to add.
- Return type:
None
- to_string()
Returns a string representation of this construct.
- Return type:
str
- Returns:
a string representation of this resource
Attributes
- CFN_RESOURCE_TYPE_NAME = 'AWS::Config::ConfigRule'
- attr_arn
The Amazon Resource Name (ARN) of the AWS Config rule, such as
arn:aws:config:us-east-1:123456789012:config-rule/config-rule-a1bzhi
.- CloudformationAttribute:
Arn
- attr_compliance_type
Compliance type determined by the Config rule.
- CloudformationAttribute:
Compliance.Type
- attr_config_rule_id
The ID of the AWS Config rule, such as
config-rule-a1bzhi
.- CloudformationAttribute:
ConfigRuleId
- cfn_options
Options for this resource, such as condition, update policy etc.
- cfn_resource_type
AWS resource type.
- compliance
Indicates whether an AWS resource or AWS Config rule is compliant and provides the number of contributors that affect the compliance.
- config_rule_name
A name for the AWS Config rule.
- creation_stack
return:
the stack trace of the point where this Resource was created from, sourced from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most node +internal+ entries filtered.
- description
The description that you provide for the AWS Config rule.
- evaluation_modes
The modes the AWS Config rule can be evaluated in.
- input_parameters
A string, in JSON format, that is passed to the AWS Config rule Lambda function.
- logical_id
The logical ID for this CloudFormation stack element.
The logical ID of the element is calculated from the path of the resource node in the construct tree.
To override this value, use
overrideLogicalId(newLogicalId)
.- Returns:
the logical ID as a stringified token. This value will only get resolved during synthesis.
- maximum_execution_frequency
The maximum frequency with which AWS Config runs evaluations for a rule.
- node
The tree node.
- ref
Return a string that will be resolved to a CloudFormation
{ Ref }
for this element.If, by any chance, the intrinsic reference of a resource is not a string, you could coerce it to an IResolvable through
Lazy.any({ produce: resource.ref })
.
- scope
Defines which resources can trigger an evaluation for the rule.
- source
Provides the rule owner (
AWS
for managed rules,CUSTOM_POLICY
for Custom Policy rules, andCUSTOM_LAMBDA
for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.
- stack
The stack in which this element is defined.
CfnElements must be defined within a stack scope (directly or indirectly).
Static Methods
- classmethod is_cfn_element(x)
Returns
true
if a construct is a stack element (i.e. part of the synthesized cloudformation template).Uses duck-typing instead of
instanceof
to allow stack elements from different versions of this library to be included in the same stack.- Parameters:
x (
Any
) –- Return type:
bool
- Returns:
The construct as a stack element or undefined if it is not a stack element.
- classmethod is_cfn_resource(x)
Check whether the given object is a CfnResource.
- Parameters:
x (
Any
) –- Return type:
bool
- classmethod is_construct(x)
Checks if
x
is a construct.Use this method instead of
instanceof
to properly detectConstruct
instances, even when the construct library is symlinked.Explanation: in JavaScript, multiple copies of the
constructs
library on disk are seen as independent, completely different libraries. As a consequence, the classConstruct
in each copy of theconstructs
library is seen as a different class, and an instance of one class will not test asinstanceof
the other class.npm install
will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of theconstructs
library can be accidentally installed, andinstanceof
will behave unpredictably. It is safest to avoid usinginstanceof
, and using this type-testing method instead.- Parameters:
x (
Any
) – Any object.- Return type:
bool
- Returns:
true if
x
is an object created from a class which extendsConstruct
.
ComplianceProperty
- class CfnConfigRule.ComplianceProperty(*, type=None)
Bases:
object
Indicates whether an AWS resource or AWS Config rule is compliant and provides the number of contributors that affect the compliance.
- Parameters:
type (
Optional
[str
]) – Indicates whether an AWS resource or AWS Config rule is compliant. A resource is compliant if it complies with all of the AWS Config rules that evaluate it. A resource is noncompliant if it does not comply with one or more of these rules. A rule is compliant if all of the resources that the rule evaluates comply with it. A rule is noncompliant if any of these resources do not comply. AWS Config returns theINSUFFICIENT_DATA
value when no evaluation results are available for the AWS resource or AWS Config rule. For theCompliance
data type, AWS Config supports onlyCOMPLIANT
,NON_COMPLIANT
, andINSUFFICIENT_DATA
values. AWS Config does not support theNOT_APPLICABLE
value for theCompliance
data type.- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_config as config compliance_property = config.CfnConfigRule.ComplianceProperty( type="type" )
Attributes
- type
Indicates whether an AWS resource or AWS Config rule is compliant.
A resource is compliant if it complies with all of the AWS Config rules that evaluate it. A resource is noncompliant if it does not comply with one or more of these rules.
A rule is compliant if all of the resources that the rule evaluates comply with it. A rule is noncompliant if any of these resources do not comply.
AWS Config returns the
INSUFFICIENT_DATA
value when no evaluation results are available for the AWS resource or AWS Config rule.For the
Compliance
data type, AWS Config supports onlyCOMPLIANT
,NON_COMPLIANT
, andINSUFFICIENT_DATA
values. AWS Config does not support theNOT_APPLICABLE
value for theCompliance
data type.
CustomPolicyDetailsProperty
- class CfnConfigRule.CustomPolicyDetailsProperty(*, enable_debug_log_delivery=None, policy_runtime=None, policy_text=None)
Bases:
object
Provides the CustomPolicyDetails, the rule owner (
AWS
for managed rules,CUSTOM_POLICY
for Custom Policy rules, andCUSTOM_LAMBDA
for Custom Lambda rules), the rule identifier, and the events that cause the evaluation of your AWS resources.- Parameters:
enable_debug_log_delivery (
Union
[bool
,IResolvable
,None
]) – The boolean expression for enabling debug logging for your AWS Config Custom Policy rule. The default value isfalse
.policy_runtime (
Optional
[str
]) –The runtime system for your AWS Config Custom Policy rule. Guard is a policy-as-code language that allows you to write policies that are enforced by AWS Config Custom Policy rules. For more information about Guard, see the Guard GitHub Repository .
policy_text (
Optional
[str
]) – The policy definition containing the logic for your AWS Config Custom Policy rule.
- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_config as config custom_policy_details_property = config.CfnConfigRule.CustomPolicyDetailsProperty( enable_debug_log_delivery=False, policy_runtime="policyRuntime", policy_text="policyText" )
Attributes
- enable_debug_log_delivery
The boolean expression for enabling debug logging for your AWS Config Custom Policy rule.
The default value is
false
.
- policy_runtime
The runtime system for your AWS Config Custom Policy rule.
Guard is a policy-as-code language that allows you to write policies that are enforced by AWS Config Custom Policy rules. For more information about Guard, see the Guard GitHub Repository .
- policy_text
The policy definition containing the logic for your AWS Config Custom Policy rule.
EvaluationModeConfigurationProperty
- class CfnConfigRule.EvaluationModeConfigurationProperty(*, mode=None)
Bases:
object
The configuration object for AWS Config rule evaluation mode.
The supported valid values are Detective or Proactive.
- Parameters:
mode (
Optional
[str
]) – The mode of an evaluation. The valid values are Detective or Proactive.- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_config as config evaluation_mode_configuration_property = config.CfnConfigRule.EvaluationModeConfigurationProperty( mode="mode" )
Attributes
- mode
The mode of an evaluation.
The valid values are Detective or Proactive.
ScopeProperty
- class CfnConfigRule.ScopeProperty(*, compliance_resource_id=None, compliance_resource_types=None, tag_key=None, tag_value=None)
Bases:
object
Defines which resources trigger an evaluation for an AWS Config rule.
The scope can include one or more resource types, a combination of a tag key and value, or a combination of one resource type and one resource ID. Specify a scope to constrain which resources trigger an evaluation for a rule. Otherwise, evaluations for the rule are triggered when any resource in your recording group changes in configuration.
- Parameters:
compliance_resource_id (
Optional
[str
]) – The ID of the only AWS resource that you want to trigger an evaluation for the rule. If you specify a resource ID, you must specify one resource type forComplianceResourceTypes
.compliance_resource_types (
Optional
[Sequence
[str
]]) – The resource types of only those AWS resources that you want to trigger an evaluation for the rule. You can only specify one type if you also specify a resource ID forComplianceResourceId
.tag_key (
Optional
[str
]) – The tag key that is applied to only those AWS resources that you want to trigger an evaluation for the rule.tag_value (
Optional
[str
]) – The tag value applied to only those AWS resources that you want to trigger an evaluation for the rule. If you specify a value forTagValue
, you must also specify a value forTagKey
.
- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_config as config scope_property = config.CfnConfigRule.ScopeProperty( compliance_resource_id="complianceResourceId", compliance_resource_types=["complianceResourceTypes"], tag_key="tagKey", tag_value="tagValue" )
Attributes
- compliance_resource_id
The ID of the only AWS resource that you want to trigger an evaluation for the rule.
If you specify a resource ID, you must specify one resource type for
ComplianceResourceTypes
.
- compliance_resource_types
The resource types of only those AWS resources that you want to trigger an evaluation for the rule.
You can only specify one type if you also specify a resource ID for
ComplianceResourceId
.
- tag_key
The tag key that is applied to only those AWS resources that you want to trigger an evaluation for the rule.
- tag_value
The tag value applied to only those AWS resources that you want to trigger an evaluation for the rule.
If you specify a value for
TagValue
, you must also specify a value forTagKey
.
SourceDetailProperty
- class CfnConfigRule.SourceDetailProperty(*, event_source, message_type, maximum_execution_frequency=None)
Bases:
object
Provides the source and the message types that trigger AWS Config to evaluate your AWS resources against a rule.
It also provides the frequency with which you want AWS Config to run evaluations for the rule if the trigger type is periodic. You can specify the parameter values for
SourceDetail
only for custom rules.- Parameters:
event_source (
str
) – The source of the event, such as an AWS service, that triggers AWS Config to evaluate your AWS resources.message_type (
str
) – The type of notification that triggers AWS Config to run an evaluation for a rule. You can specify the following notification types: -ConfigurationItemChangeNotification
- Triggers an evaluation when AWS Config delivers a configuration item as a result of a resource change. -OversizedConfigurationItemChangeNotification
- Triggers an evaluation when AWS Config delivers an oversized configuration item. AWS Config may generate this notification type when a resource changes and the notification exceeds the maximum size allowed by Amazon SNS. -ScheduledNotification
- Triggers a periodic evaluation at the frequency specified forMaximumExecutionFrequency
. -ConfigurationSnapshotDeliveryCompleted
- Triggers a periodic evaluation when AWS Config delivers a configuration snapshot. If you want your custom rule to be triggered by configuration changes, specify two SourceDetail objects, one forConfigurationItemChangeNotification
and one forOversizedConfigurationItemChangeNotification
.maximum_execution_frequency (
Optional
[str
]) – The frequency at which you want AWS Config to run evaluations for a custom rule with a periodic trigger. If you specify a value forMaximumExecutionFrequency
, thenMessageType
must use theScheduledNotification
value. .. epigraph:: By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for theMaximumExecutionFrequency
parameter. Based on the valid value you choose, AWS Config runs evaluations once for each valid value. For example, if you chooseThree_Hours
, AWS Config runs evaluations once every three hours. In this case,Three_Hours
is the frequency of this rule.
- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_config as config source_detail_property = config.CfnConfigRule.SourceDetailProperty( event_source="eventSource", message_type="messageType", # the properties below are optional maximum_execution_frequency="maximumExecutionFrequency" )
Attributes
- event_source
The source of the event, such as an AWS service, that triggers AWS Config to evaluate your AWS resources.
- maximum_execution_frequency
The frequency at which you want AWS Config to run evaluations for a custom rule with a periodic trigger.
If you specify a value for
MaximumExecutionFrequency
, thenMessageType
must use theScheduledNotification
value. .. epigraph:By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the ``MaximumExecutionFrequency`` parameter. Based on the valid value you choose, AWS Config runs evaluations once for each valid value. For example, if you choose ``Three_Hours`` , AWS Config runs evaluations once every three hours. In this case, ``Three_Hours`` is the frequency of this rule.
- message_type
The type of notification that triggers AWS Config to run an evaluation for a rule.
You can specify the following notification types:
ConfigurationItemChangeNotification
- Triggers an evaluation when AWS Config delivers a configuration item as a result of a resource change.OversizedConfigurationItemChangeNotification
- Triggers an evaluation when AWS Config delivers an oversized configuration item. AWS Config may generate this notification type when a resource changes and the notification exceeds the maximum size allowed by Amazon SNS.ScheduledNotification
- Triggers a periodic evaluation at the frequency specified forMaximumExecutionFrequency
.ConfigurationSnapshotDeliveryCompleted
- Triggers a periodic evaluation when AWS Config delivers a configuration snapshot.
If you want your custom rule to be triggered by configuration changes, specify two SourceDetail objects, one for
ConfigurationItemChangeNotification
and one forOversizedConfigurationItemChangeNotification
.
SourceProperty
- class CfnConfigRule.SourceProperty(*, owner, custom_policy_details=None, source_details=None, source_identifier=None)
Bases:
object
Provides the CustomPolicyDetails, the rule owner (
AWS
for managed rules,CUSTOM_POLICY
for Custom Policy rules, andCUSTOM_LAMBDA
for Custom Lambda rules), the rule identifier, and the events that cause the evaluation of your AWS resources.- Parameters:
owner (
str
) – Indicates whether AWS or the customer owns and manages the AWS Config rule. AWS Config Managed Rules are predefined rules owned by AWS . For more information, see AWS Config Managed Rules in the AWS Config developer guide . AWS Config Custom Rules are rules that you can develop either with Guard (CUSTOM_POLICY
) or AWS Lambda (CUSTOM_LAMBDA
). For more information, see AWS Config Custom Rules in the AWS Config developer guide .custom_policy_details (
Union
[IResolvable
,CustomPolicyDetailsProperty
,Dict
[str
,Any
],None
]) – Provides the runtime system, policy definition, and whether debug logging is enabled. Required when owner is set toCUSTOM_POLICY
.source_details (
Union
[IResolvable
,Sequence
[Union
[IResolvable
,SourceDetailProperty
,Dict
[str
,Any
]]],None
]) – Provides the source and the message types that cause AWS Config to evaluate your AWS resources against a rule. It also provides the frequency with which you want AWS Config to run evaluations for the rule if the trigger type is periodic. If the owner is set toCUSTOM_POLICY
, the only acceptable values for the AWS Config rule trigger message type areConfigurationItemChangeNotification
andOversizedConfigurationItemChangeNotification
.source_identifier (
Optional
[str
]) –For AWS Config Managed rules, a predefined identifier from a list. For example,
IAM_PASSWORD_POLICY
is a managed rule. To reference a managed rule, see List of AWS Config Managed Rules . For AWS Config Custom Lambda rules, the identifier is the Amazon Resource Name (ARN) of the rule’s AWS Lambda function, such asarn:aws:lambda:us-east-2:123456789012:function:custom_rule_name
. For AWS Config Custom Policy rules, this field will be ignored.
- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_config as config source_property = config.CfnConfigRule.SourceProperty( owner="owner", # the properties below are optional custom_policy_details=config.CfnConfigRule.CustomPolicyDetailsProperty( enable_debug_log_delivery=False, policy_runtime="policyRuntime", policy_text="policyText" ), source_details=[config.CfnConfigRule.SourceDetailProperty( event_source="eventSource", message_type="messageType", # the properties below are optional maximum_execution_frequency="maximumExecutionFrequency" )], source_identifier="sourceIdentifier" )
Attributes
- custom_policy_details
Provides the runtime system, policy definition, and whether debug logging is enabled.
Required when owner is set to
CUSTOM_POLICY
.
- owner
Indicates whether AWS or the customer owns and manages the AWS Config rule.
AWS Config Managed Rules are predefined rules owned by AWS . For more information, see AWS Config Managed Rules in the AWS Config developer guide .
AWS Config Custom Rules are rules that you can develop either with Guard (
CUSTOM_POLICY
) or AWS Lambda (CUSTOM_LAMBDA
). For more information, see AWS Config Custom Rules in the AWS Config developer guide .
- source_details
Provides the source and the message types that cause AWS Config to evaluate your AWS resources against a rule.
It also provides the frequency with which you want AWS Config to run evaluations for the rule if the trigger type is periodic.
If the owner is set to
CUSTOM_POLICY
, the only acceptable values for the AWS Config rule trigger message type areConfigurationItemChangeNotification
andOversizedConfigurationItemChangeNotification
.
- source_identifier
For AWS Config Managed rules, a predefined identifier from a list.
For example,
IAM_PASSWORD_POLICY
is a managed rule. To reference a managed rule, see List of AWS Config Managed Rules .For AWS Config Custom Lambda rules, the identifier is the Amazon Resource Name (ARN) of the rule’s AWS Lambda function, such as
arn:aws:lambda:us-east-2:123456789012:function:custom_rule_name
.For AWS Config Custom Policy rules, this field will be ignored.