AWS::Config::ConfigRule

Adds or updates an AWS Config rule to evaluate if your AWS resources comply with your desired configurations. For information on how many AWS Config rules you can have per account, see Service Limits in the AWS Config Developer Guide.

There are two types of rules: AWS Config Managed Rules and AWS Config Custom Rules. You can use the ConfigRule resource to create both AWS Config Managed Rules and AWS Config Custom Rules.

AWS Config Managed Rules are predefined, customizable rules created by AWS Config. For a list of managed rules, see List of AWS Config Managed Rules. If you are adding an AWS Config managed rule, you must specify the rule's identifier for the SourceIdentifier key.

AWS Config Custom Rules are rules that you create from scratch. There are two ways to create AWS Config custom rules: with Lambda functions (AWS Lambda Developer Guide) and with Guard (Guard GitHub Repository), a policy-as-code language. AWS Config custom rules created with AWS Lambda are called AWS Config Custom Lambda Rules and AWS Config custom rules created with Guard are called AWS Config Custom Policy Rules.

If you are adding a new AWS Config Custom Lambda rule, you first need to create an AWS Lambda function that the rule invokes to evaluate your resources. When you use the ConfigRule resource to add a Custom Lambda rule to AWS Config, you must specify the Amazon Resource Name (ARN) that AWS Lambda assigns to the function. You specify the ARN in the SourceIdentifier key. This key is part of the Source object, which is part of the ConfigRule object.

For any new AWS Config rule that you add, specify the ConfigRuleName in the ConfigRule object. Do not specify the ConfigRuleArn or the ConfigRuleId. These values are generated by AWS Config for new rules.

If you are updating a rule that you added previously, you can specify the rule by ConfigRuleName, ConfigRuleId, or ConfigRuleArn in the ConfigRule data type that you use in this request.

For more information about developing and using AWS Config rules, see Evaluating Resources with AWS Config Rules in the AWS Config Developer Guide.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

{
  "Type" : "AWS::Config::ConfigRule",
  "Properties" : {
      "Compliance" : Compliance,
      "ConfigRuleName" : String,
      "Description" : String,
      "EvaluationModes" : [ EvaluationModeConfiguration, ... ],
      "InputParameters" : Json,
      "MaximumExecutionFrequency" : String,
      "Scope" : Scope,
      "Source" : Source
    }
}

Type: AWS::Config::ConfigRule
Properties:
  Compliance: 
    Compliance
  ConfigRuleName: String
  Description: String
  EvaluationModes: 
    - EvaluationModeConfiguration
  InputParameters: Json
  MaximumExecutionFrequency: String
  Scope: 
    Scope
  Source: 
    Source

Properties

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the rule name, such as mystack-MyConfigRule-12ABCFPXHV4OV.

For more information about using the Ref function, see Ref.

Fn::GetAtt

The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.

Examples

Config Rule

The following example uses an AWS managed rule that checks whether EC2 volumes resource types have a CostCenter tag.

"ConfigRuleForVolumeTags": {
  "Type": "AWS::Config::ConfigRule",
  "Properties": {
    "InputParameters": {"tag1Key": "CostCenter"},
    "Scope": {
      "ComplianceResourceTypes": ["AWS::EC2::Volume"]
    },
    "Source": {
      "Owner": "AWS",
      "SourceIdentifier": "REQUIRED_TAGS"
    }
  }
}

ConfigRuleForVolumeTags: 
  Type: AWS::Config::ConfigRule
  Properties: 
    InputParameters: |
        {"tag1Key": "CostCenter"}
    Scope: 
      ComplianceResourceTypes: 
        - "AWS::EC2::Volume"
    Source: 
      Owner: AWS
      SourceIdentifier: "REQUIRED_TAGS"

Create Rule Using Lambda Function

The following example is the AWS Lambda function’s code to check whether an EC2 volume has the AutoEnableIO property set to true. To deploy with AWS CloudFormation, follow the steps in Deploy Node.js Lambda functions with .zip file archives.

import { ConfigServiceClient, PutEvaluationsCommand } from "@aws-sdk/client-config-service";
import { EC2Client, DescribeVolumeAttributeCommand } from "@aws-sdk/client-ec2"
              
const configClient = new ConfigServiceClient({});
const ec2Client = new EC2Client({});
              
export const handler = async function (event, context) {
    await evaluateCompliance(event, async function (compliance, annotation, event) {
        var configurationItem = JSON.parse(event.invokingEvent).configurationItem;
        if (annotation) {
            var putEvaluationsRequest = {
                Evaluations: [{
                    ComplianceResourceType: configurationItem.resourceType,
                    ComplianceResourceId: configurationItem.resourceId,
                    ComplianceType: compliance,
                    OrderingTimestamp: new Date(configurationItem.configurationItemCaptureTime),
                    Annotation: annotation
                }],
              ResultToken: event.resultToken
            };
        } else {
            var putEvaluationsRequest = {
                Evaluations: [{
                    ComplianceResourceType: configurationItem.resourceType,
                    ComplianceResourceId: configurationItem.resourceId,
                    ComplianceType: compliance,
                    OrderingTimestamp: new Date(configurationItem.configurationItemCaptureTime)
                }],
                ResultToken: event.resultToken
            };
       }
       await configClient.send(new PutEvaluationsCommand(putEvaluationsRequest));
    });
};
async function evaluateCompliance(event, doReturn) {
    var configurationItem = JSON.parse(event.invokingEvent).configurationItem;
    var status = configurationItem.configurationItemStatus;
    if (configurationItem.resourceType !== 'AWS::EC2::Volume' || event.eventLeftScope || (status !== 'OK' && status !== 'ResourceDiscovered')) {
              doReturn('NOT_APPLICABLE', '', event);
    } else {
        const input = { VolumeId: configurationItem.resourceId, Attribute: 'autoEnableIO' };
        const command = new DescribeVolumeAttributeCommand(input);
        const response = await ec2Client.send(command);
        if (response.AutoEnableIO.Value) doReturn('COMPLIANT', '', event);
        else doReturn('NON_COMPLIANT', 'Annotation describing why NON_COMPLIANT', event);
    };
}