CustomPolicyProps Struct
Construction properties for a CustomPolicy.
Example
ts
const samplePolicyText = `
# This rule checks if point in time recovery (PITR) is enabled on active Amazon DynamoDB tables
let status = ['ACTIVE']
rule tableisactive when
resourceType == "AWS::DynamoDB::Table" {
configuration.tableStatus == %status
}
rule checkcompliance when
resourceType == "AWS::DynamoDB::Table"
tableisactive {
let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
%pitr == "ENABLED"
}
`;
new config.CustomPolicy(this, "Custom", {
policyText: samplePolicyText,
enableDebugLog: true,
ruleScope: config.RuleScope.fromResources([
config.ResourceType.DYNAMODB_TABLE,
]),
});
python
sample_policy_text = """
# This rule checks if point in time recovery (PITR) is enabled on active Amazon DynamoDB tables
let status = ['ACTIVE']
rule tableisactive when
resourceType == "AWS::DynamoDB::Table" {
configuration.tableStatus == %status
}
rule checkcompliance when
resourceType == "AWS::DynamoDB::Table"
tableisactive {
let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
%pitr == "ENABLED"
}
"""
config.CustomPolicy(self, "Custom",
policy_text=sample_policy_text,
enable_debug_log=True,
rule_scope=config.RuleScope.from_resources([config.ResourceType.DYNAMODB_TABLE
])
)
java
String samplePolicyText = "\n# This rule checks if point in time recovery (PITR) is enabled on active Amazon DynamoDB tables\nlet status = ['ACTIVE']\n\nrule tableisactive when\n resourceType == \"AWS::DynamoDB::Table\" {\n configuration.tableStatus == %status\n}\n\nrule checkcompliance when\n resourceType == \"AWS::DynamoDB::Table\"\n tableisactive {\n let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus\n %pitr == \"ENABLED\"\n}\n";
CustomPolicy.Builder.create(this, "Custom")
.policyText(samplePolicyText)
.enableDebugLog(true)
.ruleScope(RuleScope.fromResources(List.of(ResourceType.DYNAMODB_TABLE)))
.build();
csharp
// Install: dotnet add package Amazon.CDK.Lib
var samplePolicyText = @"
# This rule checks if point in time recovery (PITR) is enabled on active Amazon DynamoDB tables
let status = ['ACTIVE']
rule tableisactive when
resourceType == ""AWS::DynamoDB::Table"" {
configuration.tableStatus == %status
}
rule checkcompliance when
resourceType == ""AWS::DynamoDB::Table""
tableisactive {
let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
%pitr == ""ENABLED""
}
";
new CustomPolicy(this, "Custom", new CustomPolicyProps {
PolicyText = samplePolicyText,
EnableDebugLog = true,
RuleScope = RuleScope.FromResources(new [] { ResourceType.DYNAMODB_TABLE })
});
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
samplePolicyText := `
# This rule checks if point in time recovery (PITR) is enabled on active Amazon DynamoDB tables
let status = ['ACTIVE']
rule tableisactive when
resourceType == "AWS::DynamoDB::Table" {
configuration.tableStatus == %status
}
rule checkcompliance when
resourceType == "AWS::DynamoDB::Table"
tableisactive {
let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
%pitr == "ENABLED"
}
`
config.NewCustomPolicy(this, jsii.String("Custom"), &CustomPolicyProps{
PolicyText: samplePolicyText,
EnableDebugLog: jsii.Boolean(true),
RuleScope: config.RuleScope_FromResources([]ResourceType{
config.ResourceType_DYNAMODB_TABLE(),
}),
})
Properties
configRuleNameoptionalstringconfig_rule_nameoptionalstrconfigRuleNameoptionalStringConfigRuleNameoptionalstringConfigRuleNameoptional*string#A name for the AWS Config rule.
Default: CloudFormation generated name
descriptionoptionalstringdescriptionoptionalstrdescriptionoptionalStringDescriptionoptionalstringDescriptionoptional*string#A description about this AWS Config rule.
Default: No description
enableDebugLogoptionalbooleanenable_debug_logoptionalboolenableDebugLogoptionalBooleanEnableDebugLogoptionalboolEnableDebugLogoptional*bool= false#The boolean expression for enabling debug logging for your AWS Config Custom Policy rule.
evaluationModesoptionalEvaluationModeevaluation_modesoptionalEvaluationModeevaluationModesoptionalEvaluationModeEvaluationModesoptionalEvaluationModeEvaluationModesoptionalEvaluationMode#The modes the AWS Config rule can be evaluated in.
Default: Detective evaluation mode only
The valid values are distinct objects.
inputParametersoptional{ [key: string]: any }input_parametersoptionaltyping.Mapping[str, Any]inputParametersoptionalMap<String, Object>InputParametersoptionalIDictionary<string, object>InputParametersoptional*map[string]interface{}#Input parameter values that are passed to the AWS Config rule.
Default: No input parameters
maximumExecutionFrequencyoptionalMaximumExecutionFrequencymaximum_execution_frequencyoptionalMaximumExecutionFrequencymaximumExecutionFrequencyoptionalMaximumExecutionFrequencyMaximumExecutionFrequencyoptionalMaximumExecutionFrequencyMaximumExecutionFrequencyoptionalMaximumExecutionFrequency#The maximum frequency at which the AWS Config rule runs evaluations.
Default: MaximumExecutionFrequency.TWENTY_FOUR_HOURS
The policy definition containing the logic for your AWS Config Custom Policy rule.