Interface IConfigRule

SecurityConfig / AwsConfig / AwsConfigRuleSet / ConfigRule

Description

AWS ConfigRule configuration

Example

Managed Config rule:

- name: accelerator-iam-user-group-membership-check
  complianceResourceTypes:
    - AWS::IAM::User
  identifier: IAM_USER_GROUP_MEMBERSHIP_CHECK

Custom Config rule:

- name: accelerator-attach-ec2-instance-profile
  type: Custom
  description: Custom rule for checking EC2 instance IAM profile attachment
  inputParameters:
    customRule:
      lambda:
        sourceFilePath: path/to/function.zip
        handler: index.handler
        runtime: nodejsXX.x
        rolePolicyFile: path/to/policy.json
      periodic: true
      maximumExecutionFrequency: Six_Hours
      configurationChanges: true
      triggeringResources:
        lookupType: ResourceTypes
        lookupKey: ResourceTypes
        lookupValue:
          - AWS::EC2::Instance

Managed Config rule with remediation:

- name: accelerator-s3-bucket-server-side-encryption-enabled
  identifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
  complianceResourceTypes:
    - AWS::S3::Bucket
  remediation:
    rolePolicyFile: path/to/policy.json
    automatic: true
    targetId: Put-S3-Encryption
    retryAttemptSeconds: 60
    maximumAutomaticAttempts: 5
    parameters:
      - name: BucketName
        value: RESOURCE_ID
        type: String
      - name: KMSMasterKey
        value: ${ACCEL_LOOKUP::KMS}
        type: StringList
interface IConfigRule {
    complianceResourceTypes?: string[];
    customRule?: ICustomRuleConfigType;
    description?: string;
    identifier?: string;
    inputParameters?: null | {
        [key: NonEmptyString]: NonEmptyString;
    };
    name: string;
    remediation?: IConfigRuleRemediationType;
    tags?: ITag[];
    type?: string;
}

Properties

complianceResourceTypes? customRule? description? identifier? inputParameters? name remediation? tags? type?

Properties

Optional ReadonlycomplianceResourceTypes

complianceResourceTypes?: string[]

(OPTIONAL) Defines which resources trigger an evaluation for an AWS Config rule.

Optional ReadonlycustomRule

customRule?: ICustomRuleConfigType

(OPTIONAL) A custom config rule is backed by AWS Lambda function. This is required when creating custom config rule.

Optional Readonlydescription

description?: string

(OPTIONAL) A description about this AWS Config rule.

Optional Readonlyidentifier

identifier?: string

(OPTIONAL) The identifier of the AWS managed rule.

Optional ReadonlyinputParameters

inputParameters?: null | {
    [key: NonEmptyString]: NonEmptyString;
}

(OPTIONAL) Input parameter values that are passed to the AWS Config rule.

Readonlyname

name: string

A name for the AWS Config rule.

Remarks

Note: Changing this value of an AWS Config Rule will trigger a new resource creation.

Optional Readonlyremediation

remediation?: IConfigRuleRemediationType

A remediation for the config rule, auto remediation to automatically remediate noncompliant resources.

Optional Readonlytags

tags?: ITag[]

(OPTIONAL) Tags for the config rule

Optional Readonlytype

type?: string

(OPTIONAL) Config rule type Managed or Custom. For custom config rule, this parameter value is Custom, when creating managed config rule this parameter value can be undefined or empty string

Settings

Member Visibility

On This Page

Properties