Skip to content

Resource: awsConfigOrganizationManagedRule

Manages a Config Organization Managed Rule. More information about these rules can be found in the Enabling AWS Config Rules Across all Accounts in Your Organization and AWS Config Managed Rules documentation. For working with Organization Custom Rules (those invoking a custom Lambda Function), see the awsConfigOrganizationCustomRule resource.

\~> NOTE: This resource must be created in the Organization master account and rules will include the master account unless its ID is added to the excludedAccounts argument.

\~> NOTE: Every Organization account except those configured in the excludedAccounts argument must have a Configuration Recorder with proper IAM permissions before the rule will successfully create or update. See also the awsConfigConfigurationRecorder resource.

Example Usage

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as aws from "./.gen/providers/aws";
const awsOrganizationsOrganizationExample =
  new aws.organizationsOrganization.OrganizationsOrganization(this, "example", {
    awsServiceAccessPrincipals: ["config-multiaccountsetup.amazonaws.com"],
    featureSet: "ALL",
  });
const awsConfigOrganizationManagedRuleExample =
  new aws.configOrganizationManagedRule.ConfigOrganizationManagedRule(
    this,
    "example_1",
    {
      depends_on: [`\${${awsOrganizationsOrganizationExample.fqn}}`],
      name: "example",
      ruleIdentifier: "IAM_PASSWORD_POLICY",
    }
  );
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
awsConfigOrganizationManagedRuleExample.overrideLogicalId("example");

Argument Reference

The following arguments are supported:

  • name - (Required) The name of the rule
  • ruleIdentifier - (Required) Identifier of an available AWS Config Managed Rule to call. For available values, see the List of AWS Config Managed Rules documentation
  • description - (Optional) Description of the rule
  • excludedAccounts - (Optional) List of AWS account identifiers to exclude from the rule
  • inputParameters - (Optional) A string in JSON format that is passed to the AWS Config Rule Lambda Function
  • maximumExecutionFrequency - (Optional) The maximum frequency with which AWS Config runs evaluations for a rule, if the rule is triggered at a periodic frequency. Defaults to twentyFourHours for periodic frequency triggered rules. Valid values: oneHour, threeHours, sixHours, twelveHours, or twentyFourHours.
  • resourceIdScope - (Optional) Identifier of the AWS resource to evaluate
  • resourceTypesScope - (Optional) List of types of AWS resources to evaluate
  • tagKeyScope - (Optional, Required if tagValueScope is configured) Tag key of AWS resources to evaluate
  • tagValueScope - (Optional) Tag value of AWS resources to evaluate

Attributes Reference

In addition to all arguments above, the following attributes are exported:

  • arn - Amazon Resource Name (ARN) of the rule

Timeouts

Configuration options:

  • create - (Default 5M)
  • delete - (Default 5M)
  • update - (Default 5M)

Import

Config Organization Managed Rules can be imported using the name, e.g.,

$ terraform import aws_config_organization_managed_rule.example example