Resource: awsConfigOrganizationCustomRule
Manages a Config Organization Custom Rule. More information about these rules can be found in the Enabling AWS Config Rules Across all Accounts in Your Organization and AWS Config Managed Rules documentation. For working with Organization Managed Rules (those invoking an AWS managed rule), see the awsConfigOrganizationManagedRule
resource.
\~> NOTE: This resource must be created in the Organization master account and rules will include the master account unless its ID is added to the excludedAccounts
argument.
\~> NOTE: The proper Lambda permission to allow the AWS Config service invoke the Lambda Function must be in place before the rule will successfully create or update. See also the awsLambdaPermission
resource.
Example Usage
/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as aws from "./.gen/providers/aws";
const awsLambdaPermissionExample = new aws.lambdaPermission.LambdaPermission(
this,
"example",
{
action: "lambda:InvokeFunction",
functionName: "${aws_lambda_function.example.arn}",
principal: "config.amazonaws.com",
statementId: "AllowExecutionFromConfig",
}
);
const awsOrganizationsOrganizationExample =
new aws.organizationsOrganization.OrganizationsOrganization(
this,
"example_1",
{
awsServiceAccessPrincipals: ["config-multiaccountsetup.amazonaws.com"],
featureSet: "ALL",
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
awsOrganizationsOrganizationExample.overrideLogicalId("example");
const awsConfigOrganizationCustomRuleExample =
new aws.configOrganizationCustomRule.ConfigOrganizationCustomRule(
this,
"example_2",
{
depends_on: [
`\${${awsLambdaPermissionExample.fqn}}`,
`\${${awsOrganizationsOrganizationExample.fqn}}`,
],
lambdaFunctionArn: "${aws_lambda_function.example.arn}",
name: "example",
triggerTypes: ["ConfigurationItemChangeNotification"],
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
awsConfigOrganizationCustomRuleExample.overrideLogicalId("example");
Argument Reference
The following arguments are supported:
lambdaFunctionArn
- (Required) Amazon Resource Name (ARN) of the rule Lambda Functionname
- (Required) The name of the ruletriggerTypes
- (Required) List of notification types that trigger AWS Config to run an evaluation for the rule. Valid values:configurationItemChangeNotification
,oversizedConfigurationItemChangeNotification
, andscheduledNotification
description
- (Optional) Description of the ruleexcludedAccounts
- (Optional) List of AWS account identifiers to exclude from the ruleinputParameters
- (Optional) A string in JSON format that is passed to the AWS Config Rule Lambda FunctionmaximumExecutionFrequency
- (Optional) The maximum frequency with which AWS Config runs evaluations for a rule, if the rule is triggered at a periodic frequency. Defaults totwentyFourHours
for periodic frequency triggered rules. Valid values:oneHour
,threeHours
,sixHours
,twelveHours
, ortwentyFourHours
.resourceIdScope
- (Optional) Identifier of the AWS resource to evaluateresourceTypesScope
- (Optional) List of types of AWS resources to evaluatetagKeyScope
- (Optional, Required iftagValueScope
is configured) Tag key of AWS resources to evaluatetagValueScope
- (Optional) Tag value of AWS resources to evaluate
Attributes Reference
In addition to all arguments above, the following attributes are exported:
arn
- Amazon Resource Name (ARN) of the rule
Timeouts
create
- (Default5M
)delete
- (Default5M
)update
- (Default5M
)
Import
Config Organization Custom Rules can be imported using the name, e.g.,