AWS Config 使用工具的示例 PowerShell - AWS SDK代码示例

AWS 文档 AWS SDK示例 GitHub 存储库中还有更多SDK示例

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

AWS Config 使用工具的示例 PowerShell

以下代码示例向您展示了如何使用with来执行操作和实现常见场景 AWS Config。 AWS Tools for PowerShell

操作是大型程序的代码摘录,必须在上下文中运行。您可以通过操作了解如何调用单个服务函数,还可以通过函数相关场景的上下文查看操作。

每个示例都包含一个指向完整源代码的链接,您可以在其中找到有关如何在上下文中设置和运行代码的说明。

主题

操作

以下代码示例演示如何使用 Add-CFGResourceTag

用于 PowerShell

示例 1:此示例将指定的标签与资源ARN相关联,在本例中为 config-rule/config-rule-16iyn0。

Add-CFGResourceTag -ResourceArn arn:aws:config:eu-west-1:123456789012:config-rule/config-rule-16iyn0 -Tag @{Key="Release";Value="Beta"}
  • 有关API详细信息,请参阅 AWS Tools for PowerShell Cmdlet 参考TagResource中的。

以下代码示例演示如何使用 Get-CFGAggregateComplianceByConfigRuleList

用于 PowerShell

示例 1:此示例从给定配置规则 ConfigurationAggregator 的 “kaju” 筛选中获取详细信息,并展开/返回规则的 “合规性”。

Get-CFGAggregateComplianceByConfigRuleList -ConfigurationAggregatorName kaju -Filters_ConfigRuleName ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK | Select-Object -ExpandProperty Compliance

输出:

ComplianceContributorCount ComplianceType -------------------------- -------------- Amazon.ConfigService.Model.ComplianceContributorCount NON_COMPLIANT

示例 2:此示例从给定内容中获取详细信息 ConfigurationAggregator,针对给定账户筛选聚合器中涵盖的所有区域,并进一步返回所有规则的合规性。

Get-CFGAggregateComplianceByConfigRuleList -ConfigurationAggregatorName kaju -Filters_AccountId 123456789012 | Select-Object ConfigRuleName, @{N="Compliance";E={$_.Compliance.ComplianceType}}

输出:

ConfigRuleName Compliance -------------- ---------- ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK NON_COMPLIANT ec2-instance-no-public-ip NON_COMPLIANT desired-instance-type NON_COMPLIANT

以下代码示例演示如何使用 Get-CFGAggregateComplianceDetailsByConfigRule

用于 PowerShell

示例 1:此示例返回评估结果,为给定账户、聚合器、区域和 AWS 配置规则的 Config 规则 “desired-instance-type” 选择带有资源 ID 和资源类型的输出,这些输出处于 COMPLIANT “” 状态

Get-CFGAggregateComplianceDetailsByConfigRule -AccountId 123456789012 -AwsRegion eu-west-1 -ComplianceType COMPLIANT -ConfigRuleName desired-instance-type -ConfigurationAggregatorName raju | Select-Object -ExpandProperty EvaluationResultIdentifier | Select-Object -ExpandProperty EvaluationResultQualifier

输出:

ConfigRuleName ResourceId ResourceType -------------- ---------- ------------ desired-instance-type i-0f1bf2f34c5678d12 AWS::EC2::Instance desired-instance-type i-0fd12dd3456789123 AWS::EC2::Instance

以下代码示例演示如何使用 Get-CFGAggregateConfigRuleComplianceSummary

用于 PowerShell

示例 1:此示例返回给定聚合器的不合规规则数。

(Get-CFGAggregateConfigRuleComplianceSummary -ConfigurationAggregatorName raju).AggregateComplianceCounts.ComplianceSummary.NonCompliantResourceCount

输出:

CapExceeded CappedCount ----------- ----------- False 5

以下代码示例演示如何使用 Get-CFGAggregateDiscoveredResourceCount

用于 PowerShell

示例 1:此示例返回针对区域 us-east-1 筛选的给定聚合器的资源计数。

Get-CFGAggregateDiscoveredResourceCount -ConfigurationAggregatorName Master -Filters_Region us-east-1

输出:

GroupByKey GroupedResourceCounts NextToken TotalDiscoveredResources ---------- --------------------- --------- ------------------------ {} 455

示例 2:此示例返回给定聚合器的筛选区域按 RESOURCE _ TYPE 分组的资源计数。

Get-CFGAggregateDiscoveredResourceCount -ConfigurationAggregatorName Master -Filters_Region us-east-1 -GroupByKey RESOURCE_TYPE | Select-Object -ExpandProperty GroupedResourceCounts

输出:

GroupName ResourceCount --------- ------------- AWS::CloudFormation::Stack 12 AWS::CloudFront::Distribution 1 AWS::CloudTrail::Trail 1 AWS::DynamoDB::Table 1 AWS::EC2::EIP 2 AWS::EC2::FlowLog 2 AWS::EC2::InternetGateway 4 AWS::EC2::NatGateway 2 AWS::EC2::NetworkAcl 4 AWS::EC2::NetworkInterface 12 AWS::EC2::RouteTable 13 AWS::EC2::SecurityGroup 18 AWS::EC2::Subnet 16 AWS::EC2::VPC 4 AWS::EC2::VPCEndpoint 2 AWS::EC2::VPCPeeringConnection 1 AWS::IAM::Group 2 AWS::IAM::Policy 51 AWS::IAM::Role 78 AWS::IAM::User 7 AWS::Lambda::Function 3 AWS::RDS::DBSecurityGroup 1 AWS::S3::Bucket 3 AWS::SSM::AssociationCompliance 107 AWS::SSM::ManagedInstanceInventory 108

以下代码示例演示如何使用 Get-CFGAggregateDiscoveredResourceList

用于 PowerShell

示例 1:此示例返回在 “爱尔兰” 聚合器中聚合的给定资源类型的资源标识符。有关资源类型列表,请查看 https://docs.aws.amazon.com/sdkfornet/ v3/apidocs/index.html?page=ConfigService/TConfigServiceResourceType .html&t ConfigService ocid=Amazon_ _。ResourceType

Get-CFGAggregateDiscoveredResourceList -ConfigurationAggregatorName Ireland -ResourceType ([Amazon.ConfigService.ResourceType]::AWSAutoScalingAutoScalingGroup)

输出:

ResourceId : arn:aws:autoscaling:eu-west-1:123456789012:autoScalingGroup:12e3b4fc-1234-1234-a123-1d2ba3c45678:autoScalingGroupName/asg-1 ResourceName : asg-1 ResourceType : AWS::AutoScaling::AutoScalingGroup SourceAccountId : 123456789012 SourceRegion : eu-west-1

示例 2:此示例返回使用区域 us-east-1 筛选的给定聚合器的AwsEC2SecurityGroup名为 “default” 的资源类型。

Get-CFGAggregateDiscoveredResourceList -ConfigurationAggregatorName raju -ResourceType ([Amazon.ConfigService.ResourceType]::AWSEC2SecurityGroup) -Filters_Region us-east-1 -Filters_ResourceName default

输出:

ResourceId : sg-01234bd5dbfa67c89 ResourceName : default ResourceType : AWS::EC2::SecurityGroup SourceAccountId : 123456789102 SourceRegion : us-east-1 ResourceId : sg-0123a4ebbf56789be ResourceName : default ResourceType : AWS::EC2::SecurityGroup SourceAccountId : 123456789102 SourceRegion : us-east-1 ResourceId : sg-4fc1d234 ResourceName : default ResourceType : AWS::EC2::SecurityGroup SourceAccountId : 123456789102 SourceRegion : us-east-1

以下代码示例演示如何使用 Get-CFGAggregateResourceConfig

用于 PowerShell

示例 1:此示例返回给定资源的配置项目聚合并展开配置。

(Get-CFGAggregateResourceConfig -ResourceIdentifier_SourceRegion us-east-1 -ResourceIdentifier_SourceAccountId 123456789012 -ResourceIdentifier_ResourceId sg-4fc1d234 -ResourceIdentifier_ResourceType ([Amazon.ConfigService.ResourceType]::AWSEC2SecurityGroup) -ConfigurationAggregatorName raju).Configuration | ConvertFrom-Json

输出:

{"description":"default VPC security group","groupName":"default","ipPermissions":[{"ipProtocol":"-1","ipv6Ranges":[],"prefixListIds":[],"userIdGroupPairs":[{"groupId":"sg-4fc1d234","userId":"123456789012"}],"ipv4Ranges":[],"ipRanges":[]},{"fromPort":3389,"ipProtocol":"tcp","ipv6Ranges":[],"prefixListIds":[],"toPort":3389,"userIdGroupPairs":[],"ipv4Ranges":[{"cidrIp":"54.240.197.224/29","description":"office subnet"},{"cidrIp":"72.21.198.65/32","description":"home pc"}],"ipRanges":["54.240.197.224/29","72.21.198.65/32"]}],"ownerId":"123456789012","groupId":"sg-4fc1d234","ipPermissionsEgress":[{"ipProtocol":"-1","ipv6Ranges":[],"prefixListIds":[],"userIdGroupPairs":[],"ipv4Ranges":[{"cidrIp":"0.0.0.0/0"}],"ipRanges":["0.0.0.0/0"]}],"tags":[],"vpcId":"vpc-2d1c2e34"}

以下代码示例演示如何使用 Get-CFGAggregateResourceConfigBatch

用于 PowerShell

示例 1:此示例获取给定聚合器中存在的资源(已识别)的当前配置项目。

$resIdentifier=[Amazon.ConfigService.Model.AggregateResourceIdentifier]@{ ResourceId= "i-012e3cb4df567e8aa" ResourceName = "arn:aws:ec2:eu-west-1:123456789012:instance/i-012e3cb4df567e8aa" ResourceType = [Amazon.ConfigService.ResourceType]::AWSEC2Instance SourceAccountId = "123456789012" SourceRegion = "eu-west-1" } Get-CFGAggregateResourceConfigBatch -ResourceIdentifier $resIdentifier -ConfigurationAggregatorName raju

输出:

BaseConfigurationItems UnprocessedResourceIdentifiers ---------------------- ------------------------------ {} {arn:aws:ec2:eu-west-1:123456789012:instance/i-012e3cb4df567e8aa}

以下代码示例演示如何使用 Get-CFGAggregationAuthorizationList

用于 PowerShell

示例 1:此示例检索授予聚合器的授权。

Get-CFGAggregationAuthorizationList

输出:

AggregationAuthorizationArn AuthorizedAccountId AuthorizedAwsRegion CreationTime --------------------------- ------------------- ------------------- ------------ arn:aws:config-service:eu-west-1:123456789012:aggregation-authorization/123456789012/eu-west-1 123456789012 eu-west-1 8/26/2019 12:55:27 AM

以下代码示例演示如何使用 Get-CFGComplianceByConfigRule

用于 PowerShell

示例 1:此示例检索规则的合规性详细信息 ebs-optimized-instance,该规则当前没有评估结果,因此它返回 _ INSUFFICIENT DATA

(Get-CFGComplianceByConfigRule -ConfigRuleName ebs-optimized-instance).Compliance

输出:

ComplianceContributorCount ComplianceType -------------------------- -------------- INSUFFICIENT_DATA

示例 2:此示例返回规则 ALB _ HTTP _TO HTTPS _ _ 的不合规资源的数量。REDIRECTION CHECK

(Get-CFGComplianceByConfigRule -ConfigRuleName ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK -ComplianceType NON_COMPLIANT).Compliance.ComplianceContributorCount

输出:

CapExceeded CappedCount ----------- ----------- False 2

以下代码示例演示如何使用 Get-CFGComplianceByResource

用于 PowerShell

示例 1:此示例检查AWS::SSM::ManagedInstanceInventory资源类型的 “COMPLIANT” 合规性类型。

Get-CFGComplianceByResource -ComplianceType COMPLIANT -ResourceType AWS::SSM::ManagedInstanceInventory

输出:

Compliance ResourceId ResourceType ---------- ---------- ------------ Amazon.ConfigService.Model.Compliance i-0123bcf4b567890e3 AWS::SSM::ManagedInstanceInventory Amazon.ConfigService.Model.Compliance i-0a1234f6f5d6b78f7 AWS::SSM::ManagedInstanceInventory

以下代码示例演示如何使用 Get-CFGComplianceDetailsByConfigRule

用于 PowerShell

示例 1:此示例获取规则的评估结果 access-keys-rotated并返回按合规类型分组的输出

Get-CFGComplianceDetailsByConfigRule -ConfigRuleName access-keys-rotated | Group-Object ComplianceType

输出:

Count Name Group ----- ---- ----- 2 COMPLIANT {Amazon.ConfigService.Model.EvaluationResult, Amazon.ConfigService.Model.EvaluationResult} 5 NON_COMPLIANT {Amazon.ConfigService.Model.EvaluationResult, Amazon.ConfigService.Model.EvaluationResult, Amazon.ConfigService.Model.EvaluationRes...

示例 2:此示例查询COMPLIANT资源规则 access-keys-rotated的合规性详细信息。

Get-CFGComplianceDetailsByConfigRule -ConfigRuleName access-keys-rotated -ComplianceType COMPLIANT | ForEach-Object {$_.EvaluationResultIdentifier.EvaluationResultQualifier}

输出:

ConfigRuleName ResourceId ResourceType -------------- ---------- ------------ access-keys-rotated BCAB1CDJ2LITAPVEW3JAH AWS::IAM::User access-keys-rotated BCAB1CDJ2LITL3EHREM4Q AWS::IAM::User

以下代码示例演示如何使用 Get-CFGComplianceDetailsByResource

用于 PowerShell

示例 1:此示例评估结果针对给定资源。

Get-CFGComplianceDetailsByResource -ResourceId ABCD5STJ4EFGHIVEW6JAH -ResourceType 'AWS::IAM::User'

输出:

Annotation : ComplianceType : COMPLIANT ConfigRuleInvokedTime : 8/25/2019 11:34:56 PM EvaluationResultIdentifier : Amazon.ConfigService.Model.EvaluationResultIdentifier ResultRecordedTime : 8/25/2019 11:34:56 PM ResultToken :

以下代码示例演示如何使用 Get-CFGComplianceSummaryByConfigRule

用于 PowerShell

示例 1:此示例返回不合规的 Config 规则的数量。

Get-CFGComplianceSummaryByConfigRule -Select ComplianceSummary.NonCompliantResourceCount

输出:

CapExceeded CappedCount ----------- ----------- False 9

以下代码示例演示如何使用 Get-CFGComplianceSummaryByResourceType

用于 PowerShell

示例 1:此示例返回合规或不合规资源的数量,并将输出转换为 json。

Get-CFGComplianceSummaryByResourceType -Select ComplianceSummariesByResourceType.ComplianceSummary | ConvertTo-Json { "ComplianceSummaryTimestamp": "2019-12-14T06:14:49.778Z", "CompliantResourceCount": { "CapExceeded": false, "CappedCount": 2 }, "NonCompliantResourceCount": { "CapExceeded": true, "CappedCount": 100 } }

以下代码示例演示如何使用 Get-CFGConfigRule

用于 PowerShell

示例 1:此示例列出了账户的配置规则以及选定的属性。

Get-CFGConfigRule | Select-Object ConfigRuleName, ConfigRuleId, ConfigRuleArn, ConfigRuleState

输出:

ConfigRuleName ConfigRuleId ConfigRuleArn ConfigRuleState -------------- ------------ ------------- --------------- ALB_REDIRECTION_CHECK config-rule-12iyn3 arn:aws:config-service:eu-west-1:123456789012:config-rule/config-rule-12iyn3 ACTIVE access-keys-rotated config-rule-aospfr arn:aws:config-service:eu-west-1:123456789012:config-rule/config-rule-aospfr ACTIVE autoscaling-group-elb-healthcheck-required config-rule-cn1f2x arn:aws:config-service:eu-west-1:123456789012:config-rule/config-rule-cn1f2x ACTIVE
  • 有关API详细信息,请参阅 AWS Tools for PowerShell Cmdlet 参考DescribeConfigRules中的。

以下代码示例演示如何使用 Get-CFGConfigRuleEvaluationStatus

用于 PowerShell

示例 1:此示例返回给定配置规则的状态信息。

Get-CFGConfigRuleEvaluationStatus -ConfigRuleName root-account-mfa-enabled, vpc-flow-logs-enabled

输出:

ConfigRuleArn : arn:aws:config:eu-west-1:123456789012:config-rule/config-rule-kvq1wk ConfigRuleId : config-rule-kvq1wk ConfigRuleName : root-account-mfa-enabled FirstActivatedTime : 8/27/2019 8:05:17 AM FirstEvaluationStarted : True LastErrorCode : LastErrorMessage : LastFailedEvaluationTime : 1/1/0001 12:00:00 AM LastFailedInvocationTime : 1/1/0001 12:00:00 AM LastSuccessfulEvaluationTime : 12/13/2019 8:12:03 AM LastSuccessfulInvocationTime : 12/13/2019 8:12:03 AM ConfigRuleArn : arn:aws:config:eu-west-1:123456789012:config-rule/config-rule-z1s23b ConfigRuleId : config-rule-z1s23b ConfigRuleName : vpc-flow-logs-enabled FirstActivatedTime : 8/14/2019 6:23:44 AM FirstEvaluationStarted : True LastErrorCode : LastErrorMessage : LastFailedEvaluationTime : 1/1/0001 12:00:00 AM LastFailedInvocationTime : 1/1/0001 12:00:00 AM LastSuccessfulEvaluationTime : 12/13/2019 7:12:01 AM LastSuccessfulInvocationTime : 12/13/2019 7:12:01 AM

以下代码示例演示如何使用 Get-CFGConfigurationAggregatorList

用于 PowerShell

示例 1:此示例返回该地区/账户的所有聚合器。

Get-CFGConfigurationAggregatorList

输出:

AccountAggregationSources : {Amazon.ConfigService.Model.AccountAggregationSource} ConfigurationAggregatorArn : arn:aws:config-service:eu-west-1:123456789012:config-aggregator/config-aggregator-xabca1me ConfigurationAggregatorName : IrelandMaster CreationTime : 8/25/2019 11:42:39 PM LastUpdatedTime : 8/25/2019 11:42:39 PM OrganizationAggregationSource : AccountAggregationSources : {} ConfigurationAggregatorArn : arn:aws:config-service:eu-west-1:123456789012:config-aggregator/config-aggregator-qubqabcd ConfigurationAggregatorName : raju CreationTime : 8/11/2019 8:39:25 AM LastUpdatedTime : 8/11/2019 8:39:25 AM OrganizationAggregationSource : Amazon.ConfigService.Model.OrganizationAggregationSource

以下代码示例演示如何使用 Get-CFGConfigurationAggregatorSourcesStatus

用于 PowerShell

示例 1:此示例显示给定聚合器中源的请求字段。

Get-CFGConfigurationAggregatorSourcesStatus -ConfigurationAggregatorName raju | select SourceType, LastUpdateStatus, LastUpdateTime, SourceId

输出:

SourceType LastUpdateStatus LastUpdateTime SourceId ---------- ---------------- -------------- -------- ORGANIZATION SUCCEEDED 12/31/2019 7:45:06 AM Organization ACCOUNT SUCCEEDED 12/31/2019 7:09:38 AM 612641234567 ACCOUNT SUCCEEDED 12/31/2019 7:12:53 AM 933301234567 ACCOUNT SUCCEEDED 12/31/2019 7:18:10 AM 933301234567 ACCOUNT SUCCEEDED 12/31/2019 7:25:17 AM 933301234567 ACCOUNT SUCCEEDED 12/31/2019 7:25:49 AM 612641234567 ACCOUNT SUCCEEDED 12/31/2019 7:26:11 AM 612641234567

以下代码示例演示如何使用 Get-CFGConfigurationRecorder

用于 PowerShell

示例 1:此示例返回配置记录器的详细信息。

Get-CFGConfigurationRecorder | Format-List

输出:

Name : default RecordingGroup : Amazon.ConfigService.Model.RecordingGroup RoleARN : arn:aws:iam::123456789012:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig

以下代码示例演示如何使用 Get-CFGConfigurationRecorderStatus

用于 PowerShell

示例 1:此示例返回配置记录器的状态。

Get-CFGConfigurationRecorderStatus

输出:

LastErrorCode : LastErrorMessage : LastStartTime : 10/11/2019 10:13:51 AM LastStatus : Success LastStatusChangeTime : 12/31/2019 6:14:12 AM LastStopTime : 10/11/2019 10:13:46 AM Name : default Recording : True

以下代码示例演示如何使用 Get-CFGConformancePack

用于 PowerShell

示例 1:此示例列出了所有一致性包。

Get-CFGConformancePack

输出:

ConformancePackArn : arn:aws:config:eu-west-1:123456789012:conformance-pack/dono/conformance-pack-p0acq8bpz ConformancePackId : conformance-pack-p0acabcde ConformancePackInputParameters : {} ConformancePackName : dono CreatedBy : DeliveryS3Bucket : kt-ps-examples DeliveryS3KeyPrefix : LastUpdateRequestedTime : 12/31/2019 8:45:31 AM

以下代码示例演示如何使用 Get-CFGDeliveryChannel

用于 PowerShell

示例 1:此示例检索该地区的配送渠道并显示详细信息。

Get-CFGDeliveryChannel -Region eu-west-1 | Select-Object Name, S3BucketName, S3KeyPrefix, @{N="DeliveryFrequency";E={$_.ConfigSnapshotDeliveryProperties.DeliveryFrequency}}

输出:

Name S3BucketName S3KeyPrefix DeliveryFrequency ---- ------------ ----------- ----------------- default config-bucket-NA my TwentyFour_Hours

以下代码示例演示如何使用 Get-CFGResourceTag

用于 PowerShell

示例 1:此示例列出了给定资源的关联标签

Get-CFGResourceTag -ResourceArn $rules[0].ConfigRuleArn

输出:

Key Value --- ----- Version 1.3
  • 有关API详细信息,请参阅 AWS Tools for PowerShell Cmdlet 参考ListTagsForResource中的。

以下代码示例演示如何使用 Remove-CFGConformancePack

用于 PowerShell

示例 1:此示例移除了给定的一致性包,以及该包的所有规则、补救措施和评估结果。

Remove-CFGConformancePack -ConformancePackName dono

输出:

Confirm Are you sure you want to perform this action? Performing the operation "Remove-CFGConformancePack (DeleteConformancePack)" on target "dono". [Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): Y

以下代码示例演示如何使用 Write-CFGConformancePack

用于 PowerShell

示例 1:此示例创建一致性包,从给定的 yaml 文件中获取模板。

Write-CFGConformancePack -ConformancePackName dono -DeliveryS3Bucket amzn-s3-demo-bucket -TemplateBody (Get-Content C:\windows\temp\template.yaml -Raw)
  • 有关API详细信息,请参阅 AWS Tools for PowerShell Cmdlet 参考PutConformancePack中的。

以下代码示例演示如何使用 Write-CFGDeliveryChannel

用于 PowerShell

示例 1:此示例更改了现有配送渠道的 deliveryFrequency 属性。

Write-CFGDeliveryChannel -ConfigSnapshotDeliveryProperties_DeliveryFrequency TwentyFour_Hours -DeliveryChannelName default -DeliveryChannel_S3BucketName amzn-s3-demo-bucket -DeliveryChannel_S3KeyPrefix my
  • 有关API详细信息,请参阅 AWS Tools for PowerShell Cmdlet 参考PutDeliveryChannel中的。