Package software.amazon.awscdk.services.config

Class CfnConfigRule

java.lang.Object
software.amazon.jsii.JsiiObject
software.constructs.Construct
software.amazon.awscdk.core.Construct
software.amazon.awscdk.core.CfnElement
software.amazon.awscdk.core.CfnRefElement
software.amazon.awscdk.core.CfnResource
software.amazon.awscdk.services.config.CfnConfigRule
All Implemented Interfaces:
IConstruct, IDependable, IInspectable, software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct
@Generated(value="jsii-pacmak/1.84.0 (build 5404dcf)", date="2023-06-19T16:30:48.527Z") @Stability(Stable) public class CfnConfigRule extends CfnResource implements IInspectable
A CloudFormation AWS::Config::ConfigRule.

Adds or updates an AWS Config rule to evaluate if your AWS resources comply with your desired configurations. For information on how many AWS Config rules you can have per account, see Service Limits in the AWS Config Developer Guide .

There are two types of rules: AWS Config Managed Rules and AWS Config Custom Rules . You can use the ConfigRule resource to create both AWS Config Managed Rules and AWS Config Custom Rules.

AWS Config Managed Rules are predefined, customizable rules created by AWS Config . For a list of managed rules, see List of AWS Config Managed Rules . If you are adding an AWS Config managed rule, you must specify the rule's identifier for the SourceIdentifier key.

AWS Config Custom Rules are rules that you create from scratch. There are two ways to create AWS Config custom rules: with Lambda functions ( AWS Lambda Developer Guide ) and with Guard ( Guard GitHub Repository ), a policy-as-code language. AWS Config custom rules created with AWS Lambda are called AWS Config Custom Lambda Rules and AWS Config custom rules created with Guard are called AWS Config Custom Policy Rules .

If you are adding a new AWS Config Custom Lambda rule, you first need to create an AWS Lambda function that the rule invokes to evaluate your resources. When you use the ConfigRule resource to add a Custom Lambda rule to AWS Config , you must specify the Amazon Resource Name (ARN) that AWS Lambda assigns to the function. You specify the ARN in the SourceIdentifier key. This key is part of the Source object, which is part of the ConfigRule object.

For any new AWS Config rule that you add, specify the ConfigRuleName in the ConfigRule object. Do not specify the ConfigRuleArn or the ConfigRuleId . These values are generated by AWS Config for new rules.

If you are updating a rule that you added previously, you can specify the rule by ConfigRuleName , ConfigRuleId , or ConfigRuleArn in the ConfigRule data type that you use in this request.

For more information about developing and using AWS Config rules, see Evaluating Resources with AWS Config Rules in the AWS Config Developer Guide .

Example: 

 // The code below shows an example of how to instantiate this type.
 // The values are placeholders you should change.
 import software.amazon.awscdk.services.config.*;
 Object inputParameters;
 CfnConfigRule cfnConfigRule = CfnConfigRule.Builder.create(this, "MyCfnConfigRule")
         .source(SourceProperty.builder()
                 .owner("owner")
                 // the properties below are optional
                 .customPolicyDetails(CustomPolicyDetailsProperty.builder()
                         .enableDebugLogDelivery(false)
                         .policyRuntime("policyRuntime")
                         .policyText("policyText")
                         .build())
                 .sourceDetails(List.of(SourceDetailProperty.builder()
                         .eventSource("eventSource")
                         .messageType("messageType")
                         // the properties below are optional
                         .maximumExecutionFrequency("maximumExecutionFrequency")
                         .build()))
                 .sourceIdentifier("sourceIdentifier")
                 .build())
         // the properties below are optional
         .configRuleName("configRuleName")
         .description("description")
         .inputParameters(inputParameters)
         .maximumExecutionFrequency("maximumExecutionFrequency")
         .scope(ScopeProperty.builder()
                 .complianceResourceId("complianceResourceId")
                 .complianceResourceTypes(List.of("complianceResourceTypes"))
                 .tagKey("tagKey")
                 .tagValue("tagValue")
                 .build())
         .build();

  • Field Details

    • CFN_RESOURCE_TYPE_NAME

      @Stability(Stable) public static final String CFN_RESOURCE_TYPE_NAME
      The CloudFormation resource type name for this resource class.

  • Constructor Details

    • CfnConfigRule

      protected CfnConfigRule(software.amazon.jsii.JsiiObjectRef objRef)

    • CfnConfigRule

      protected CfnConfigRule(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

    • CfnConfigRule

      @Stability(Stable) public CfnConfigRule(@NotNull Construct scope, @NotNull String id, @NotNull CfnConfigRuleProps props)
      Create a new AWS::Config::ConfigRule.

      Parameters:
      scope -
      • scope in which this resource is defined.
      This parameter is required.
      id -
      • scoped id of the resource.
      This parameter is required.
      props -
      • resource properties.
      This parameter is required.

  • Method Details

    • inspect

      @Stability(Stable) public void inspect(@NotNull TreeInspector inspector)
      Examines the CloudFormation resource and discloses attributes.

      Specified by:
      inspect in interface IInspectable
      Parameters:
      inspector -
      • tree inspector to collect and process attributes.
      This parameter is required.

    • renderProperties

      @Stability(Stable) @NotNull protected Map<String,Object> renderProperties(@NotNull Map<String,Object> props)
      Overrides:
      renderProperties in class CfnResource
      Parameters:
      props - This parameter is required.

    • getAttrArn

      @Stability(Stable) @NotNull public String getAttrArn()
      The Amazon Resource Name (ARN) of the AWS Config rule, such as arn:aws:config:us-east-1:123456789012:config-rule/config-rule-a1bzhi .

    • getAttrComplianceType

      @Stability(Stable) @NotNull public String getAttrComplianceType()
      The compliance status of an AWS Config rule, such as COMPLIANT or NON_COMPLIANT .

    • getAttrConfigRuleId

      @Stability(Stable) @NotNull public String getAttrConfigRuleId()
      The ID of the AWS Config rule, such as config-rule-a1bzhi .

    • getCfnProperties

      @Stability(Stable) @NotNull protected Map<String,Object> getCfnProperties()
      Overrides:
      getCfnProperties in class CfnResource

    • getInputParameters

      @Stability(Stable) @NotNull public Object getInputParameters()
      A string, in JSON format, that is passed to the AWS Config rule Lambda function.

    • setInputParameters

      @Stability(Stable) public void setInputParameters(@NotNull Object value)
      A string, in JSON format, that is passed to the AWS Config rule Lambda function.

    • getSource

      @Stability(Stable) @NotNull public Object getSource()
      Provides the rule owner ( AWS for managed rules, CUSTOM_POLICY for Custom Policy rules, and CUSTOM_LAMBDA for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.

    • setSource

      @Stability(Stable) public void setSource(@NotNull CfnConfigRule.SourceProperty value)
      Provides the rule owner ( AWS for managed rules, CUSTOM_POLICY for Custom Policy rules, and CUSTOM_LAMBDA for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.

    • setSource

      @Stability(Stable) public void setSource(@NotNull IResolvable value)
      Provides the rule owner ( AWS for managed rules, CUSTOM_POLICY for Custom Policy rules, and CUSTOM_LAMBDA for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.

    • getConfigRuleName

      @Stability(Stable) @Nullable public String getConfigRuleName()
      A name for the AWS Config rule.

      If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the rule name. For more information, see Name Type .

    • setConfigRuleName

      @Stability(Stable) public void setConfigRuleName(@Nullable String value)
      A name for the AWS Config rule.

      If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the rule name. For more information, see Name Type .

    • getDescription

      @Stability(Stable) @Nullable public String getDescription()
      The description that you provide for the AWS Config rule.

    • setDescription

      @Stability(Stable) public void setDescription(@Nullable String value)
      The description that you provide for the AWS Config rule.

    • getMaximumExecutionFrequency

      @Stability(Stable) @Nullable public String getMaximumExecutionFrequency()
      The maximum frequency with which AWS Config runs evaluations for a rule.

      You can specify a value for MaximumExecutionFrequency when:

      • You are using an AWS managed rule that is triggered at a periodic frequency.
      • Your custom rule is triggered when AWS Config delivers the configuration snapshot. For more information, see ConfigSnapshotDeliveryProperties .

      By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the MaximumExecutionFrequency parameter.

    • setMaximumExecutionFrequency

      @Stability(Stable) public void setMaximumExecutionFrequency(@Nullable String value)
      The maximum frequency with which AWS Config runs evaluations for a rule.

      You can specify a value for MaximumExecutionFrequency when:

      • You are using an AWS managed rule that is triggered at a periodic frequency.
      • Your custom rule is triggered when AWS Config delivers the configuration snapshot. For more information, see ConfigSnapshotDeliveryProperties .

      By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the MaximumExecutionFrequency parameter.

    • getScope

      @Stability(Stable) @Nullable public Object getScope()
      Defines which resources can trigger an evaluation for the rule.

      The scope can include one or more resource types, a combination of one resource type and one resource ID, or a combination of a tag key and value. Specify a scope to constrain the resources that can trigger an evaluation for the rule. If you do not specify a scope, evaluations are triggered when any resource in the recording group changes.

      The scope can be empty.

    • setScope

      @Stability(Stable) public void setScope(@Nullable IResolvable value)
      Defines which resources can trigger an evaluation for the rule.

      The scope can include one or more resource types, a combination of one resource type and one resource ID, or a combination of a tag key and value. Specify a scope to constrain the resources that can trigger an evaluation for the rule. If you do not specify a scope, evaluations are triggered when any resource in the recording group changes.

      The scope can be empty.

    • setScope

      @Stability(Stable) public void setScope(@Nullable CfnConfigRule.ScopeProperty value)
      Defines which resources can trigger an evaluation for the rule.

      The scope can include one or more resource types, a combination of one resource type and one resource ID, or a combination of a tag key and value. Specify a scope to constrain the resources that can trigger an evaluation for the rule. If you do not specify a scope, evaluations are triggered when any resource in the recording group changes.

      The scope can be empty.