CfnGuardHookProps Struct
Properties for defining a CfnGuardHook.
Example
ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import * as cdk from 'aws-cdk-lib';
const cfnGuardHookProps: cdk.CfnGuardHookProps = {
alias: 'alias',
executionRole: 'executionRole',
failureMode: 'failureMode',
hookStatus: 'hookStatus',
ruleLocation: {
uri: 'uri',
// the properties below are optional
versionId: 'versionId',
},
targetOperations: ['targetOperations'],
// the properties below are optional
logBucket: 'logBucket',
options: {
inputParams: {
uri: 'uri',
// the properties below are optional
versionId: 'versionId',
},
},
stackFilters: {
filteringCriteria: 'filteringCriteria',
// the properties below are optional
stackNames: {
exclude: ['exclude'],
include: ['include'],
},
stackRoles: {
exclude: ['exclude'],
include: ['include'],
},
},
targetFilters: {
targets: [{
action: 'action',
invocationPoint: 'invocationPoint',
targetName: 'targetName',
}],
// the properties below are optional
actions: ['actions'],
invocationPoints: ['invocationPoints'],
targetNames: ['targetNames'],
},
};
Properties
The type name alias for the Hook. This alias must be unique per account and Region.
The alias must be in the form Name1::Name2::Name3 and must not begin with AWS . For example, Private::Guard::MyTestHook .
executionRolestringexecution_rolestrexecutionRoleStringExecutionRolestringExecutionRole*stringrequired#The IAM role that the Hook assumes to retrieve your Guard rules from S3 and optionally write a detailed Guard output report back.
failureModestringfailure_modestrfailureModeStringFailureModestringFailureMode*string= "WARN"required#Specifies how the Hook responds when rules fail their evaluation.
notes
FAIL: Prevents the action from proceeding. This is helpful for enforcing strict compliance or security policies.WARN: Issues warnings to users but allows actions to continue. This is useful for non-critical validations or informational checks.
hookStatusstringhook_statusstrhookStatusStringHookStatusstringHookStatus*string= "DISABLED"required#Specifies if the Hook is `ENABLED` or `DISABLED` .
Specifies the name of an S3 bucket to store the Guard output report.
This report contains the results of your Guard rule validations.
optionsIResolvable | CfnGuardHook.OptionsPropertyoptionstyping.Union[IResolvable, OptionsProperty]optionsIResolvableOptionsIResolvableOptionsinterface{}#Specifies the S3 location of your input parameters.
ruleLocationIResolvable | CfnGuardHook.S3LocationPropertyrule_locationtyping.Union[IResolvable, S3LocationProperty]ruleLocationIResolvableRuleLocationIResolvableRuleLocationinterface{}required#Specifies the S3 location of your Guard rules.
stackFiltersIResolvable | CfnGuardHook.StackFiltersPropertystack_filterstyping.Union[IResolvable, StackFiltersProperty]stackFiltersIResolvableStackFiltersIResolvableStackFiltersinterface{}#Specifies the stack level filters for the Hook.
notes
Example stack level filter in JSON:
"StackFilters": {"FilteringCriteria": "ALL", "StackNames": {"Exclude": [ "stack-1", "stack-2"]}}
Example stack level filter in YAML:
StackFilters: FilteringCriteria: ALL StackNames: Exclude: - stack-1 - stack-2
targetFiltersIResolvable | CfnGuardHook.TargetFiltersPropertytarget_filterstyping.Union[IResolvable, TargetFiltersProperty]targetFiltersIResolvableTargetFiltersIResolvableTargetFiltersinterface{}#Specifies the target filters for the Hook.
Example target filter in JSON:
"TargetFilters": {"Actions": [ "CREATE", "UPDATE", "DELETE" ]}
Example target filter in YAML:
TargetFilters: Actions: - CREATE - UPDATE - DELETE
targetOperationsstring[]target_operationstyping.List[str]targetOperationsList<String>TargetOperationsstring[]TargetOperations*[]*stringrequired#Specifies the list of operations the Hook is run against.
notes
For more information, see Hook targets in the CloudFormation Hooks User Guide .
Valid values: STACK | RESOURCE | CHANGE_SET | CLOUD_CONTROL