@pulumi/aws/cfg/organizationConformancePack.d.ts

A Pulumi package for creating and managing Amazon Web Services (AWS) cloud resources.

import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
 * Manages a Config Organization Conformance Pack. More information can be found in the [Managing Conformance Packs Across all Accounts in Your Organization](https://docs.aws.amazon.com/config/latest/developerguide/conformance-pack-organization-apis.html) and [AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html) documentation. Example conformance pack templates may be found in the [AWS Config Rules Repository](https://github.com/awslabs/aws-config-rules/tree/master/aws-config-conformance-packs).
 *
 * > **NOTE:** This resource must be created in the Organization master account or a delegated administrator account, and the Organization must have all features enabled. Every Organization account except those configured in the `excludedAccounts` argument must have a Configuration Recorder with proper IAM permissions before the Organization Conformance Pack will successfully create or update. See also the `aws.cfg.Recorder` resource.
 *
 * ## Example Usage
 *
 * ### Using Template Body
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as aws from "@pulumi/aws";
 *
 * const exampleOrganization = new aws.organizations.Organization("example", {
 *     awsServiceAccessPrincipals: ["config-multiaccountsetup.amazonaws.com"],
 *     featureSet: "ALL",
 * });
 * const example = new aws.cfg.OrganizationConformancePack("example", {
 *     name: "example",
 *     inputParameters: [{
 *         parameterName: "AccessKeysRotatedParameterMaxAccessKeyAge",
 *         parameterValue: "90",
 *     }],
 *     templateBody: `Parameters:
 *   AccessKeysRotatedParameterMaxAccessKeyAge:
 *     Type: String
 * Resources:
 *   IAMPasswordPolicy:
 *     Properties:
 *       ConfigRuleName: IAMPasswordPolicy
 *       Source:
 *         Owner: AWS
 *         SourceIdentifier: IAM_PASSWORD_POLICY
 *     Type: AWS::Config::ConfigRule
 * `,
 * }, {
 *     dependsOn: [
 *         exampleAwsConfigConfigurationRecorder,
 *         exampleOrganization,
 *     ],
 * });
 * ```
 *
 * ### Using Template S3 URI
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as aws from "@pulumi/aws";
 *
 * const exampleOrganization = new aws.organizations.Organization("example", {
 *     awsServiceAccessPrincipals: ["config-multiaccountsetup.amazonaws.com"],
 *     featureSet: "ALL",
 * });
 * const exampleBucket = new aws.s3.Bucket("example", {bucket: "example"});
 * const exampleBucketObjectv2 = new aws.s3.BucketObjectv2("example", {
 *     bucket: exampleBucket.id,
 *     key: "example-key",
 *     content: `Resources:
 *   IAMPasswordPolicy:
 *     Properties:
 *       ConfigRuleName: IAMPasswordPolicy
 *       Source:
 *         Owner: AWS
 *         SourceIdentifier: IAM_PASSWORD_POLICY
 *     Type: AWS::Config::ConfigRule
 * `,
 * });
 * const example = new aws.cfg.OrganizationConformancePack("example", {
 *     name: "example",
 *     templateS3Uri: pulumi.interpolate`s3://${exampleBucket.bucket}/${exampleBucketObjectv2.key}`,
 * }, {
 *     dependsOn: [
 *         exampleAwsConfigConfigurationRecorder,
 *         exampleOrganization,
 *     ],
 * });
 * ```
 *
 * ## Import
 *
 * Using `pulumi import`, import Config Organization Conformance Packs using the `name`. For example:
 *
 * ```sh
 * $ pulumi import aws:cfg/organizationConformancePack:OrganizationConformancePack example example
 * ```
 */
export declare class OrganizationConformancePack extends pulumi.CustomResource {
    /**
     * Get an existing OrganizationConformancePack resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: OrganizationConformancePackState, opts?: pulumi.CustomResourceOptions): OrganizationConformancePack;
    /**
     * Returns true if the given object is an instance of OrganizationConformancePack.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is OrganizationConformancePack;
    /**
     * Amazon Resource Name (ARN) of the organization conformance pack.
     */
    readonly arn: pulumi.Output<string>;
    /**
     * Amazon S3 bucket where AWS Config stores conformance pack templates. Delivery bucket must begin with `awsconfigconforms` prefix. Maximum length of 63.
     */
    readonly deliveryS3Bucket: pulumi.Output<string | undefined>;
    /**
     * The prefix for the Amazon S3 bucket. Maximum length of 1024.
     */
    readonly deliveryS3KeyPrefix: pulumi.Output<string | undefined>;
    /**
     * Set of AWS accounts to be excluded from an organization conformance pack while deploying a conformance pack. Maximum of 1000 accounts.
     */
    readonly excludedAccounts: pulumi.Output<string[] | undefined>;
    /**
     * Set of configuration blocks describing input parameters passed to the conformance pack template. Documented below. When configured, the parameters must also be included in the `templateBody` or in the template stored in Amazon S3 if using `templateS3Uri`.
     */
    readonly inputParameters: pulumi.Output<outputs.cfg.OrganizationConformancePackInputParameter[] | undefined>;
    /**
     * The name of the organization conformance pack. Must begin with a letter and contain from 1 to 128 alphanumeric characters and hyphens.
     */
    readonly name: pulumi.Output<string>;
    /**
     * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
     */
    readonly region: pulumi.Output<string>;
    /**
     * A string containing full conformance pack template body. Maximum length of 51200. Drift detection is not possible with this argument.
     */
    readonly templateBody: pulumi.Output<string | undefined>;
    /**
     * Location of file, e.g., `s3://bucketname/prefix`, containing the template body. The uri must point to the conformance pack template that is located in an Amazon S3 bucket in the same region as the conformance pack. Maximum length of 1024. Drift detection is not possible with this argument.
     */
    readonly templateS3Uri: pulumi.Output<string | undefined>;
    /**
     * Create a OrganizationConformancePack resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args?: OrganizationConformancePackArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering OrganizationConformancePack resources.
 */
export interface OrganizationConformancePackState {
    /**
     * Amazon Resource Name (ARN) of the organization conformance pack.
     */
    arn?: pulumi.Input<string>;
    /**
     * Amazon S3 bucket where AWS Config stores conformance pack templates. Delivery bucket must begin with `awsconfigconforms` prefix. Maximum length of 63.
     */
    deliveryS3Bucket?: pulumi.Input<string>;
    /**
     * The prefix for the Amazon S3 bucket. Maximum length of 1024.
     */
    deliveryS3KeyPrefix?: pulumi.Input<string>;
    /**
     * Set of AWS accounts to be excluded from an organization conformance pack while deploying a conformance pack. Maximum of 1000 accounts.
     */
    excludedAccounts?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Set of configuration blocks describing input parameters passed to the conformance pack template. Documented below. When configured, the parameters must also be included in the `templateBody` or in the template stored in Amazon S3 if using `templateS3Uri`.
     */
    inputParameters?: pulumi.Input<pulumi.Input<inputs.cfg.OrganizationConformancePackInputParameter>[]>;
    /**
     * The name of the organization conformance pack. Must begin with a letter and contain from 1 to 128 alphanumeric characters and hyphens.
     */
    name?: pulumi.Input<string>;
    /**
     * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
     */
    region?: pulumi.Input<string>;
    /**
     * A string containing full conformance pack template body. Maximum length of 51200. Drift detection is not possible with this argument.
     */
    templateBody?: pulumi.Input<string>;
    /**
     * Location of file, e.g., `s3://bucketname/prefix`, containing the template body. The uri must point to the conformance pack template that is located in an Amazon S3 bucket in the same region as the conformance pack. Maximum length of 1024. Drift detection is not possible with this argument.
     */
    templateS3Uri?: pulumi.Input<string>;
}
/**
 * The set of arguments for constructing a OrganizationConformancePack resource.
 */
export interface OrganizationConformancePackArgs {
    /**
     * Amazon S3 bucket where AWS Config stores conformance pack templates. Delivery bucket must begin with `awsconfigconforms` prefix. Maximum length of 63.
     */
    deliveryS3Bucket?: pulumi.Input<string>;
    /**
     * The prefix for the Amazon S3 bucket. Maximum length of 1024.
     */
    deliveryS3KeyPrefix?: pulumi.Input<string>;
    /**
     * Set of AWS accounts to be excluded from an organization conformance pack while deploying a conformance pack. Maximum of 1000 accounts.
     */
    excludedAccounts?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Set of configuration blocks describing input parameters passed to the conformance pack template. Documented below. When configured, the parameters must also be included in the `templateBody` or in the template stored in Amazon S3 if using `templateS3Uri`.
     */
    inputParameters?: pulumi.Input<pulumi.Input<inputs.cfg.OrganizationConformancePackInputParameter>[]>;
    /**
     * The name of the organization conformance pack. Must begin with a letter and contain from 1 to 128 alphanumeric characters and hyphens.
     */
    name?: pulumi.Input<string>;
    /**
     * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
     */
    region?: pulumi.Input<string>;
    /**
     * A string containing full conformance pack template body. Maximum length of 51200. Drift detection is not possible with this argument.
     */
    templateBody?: pulumi.Input<string>;
    /**
     * Location of file, e.g., `s3://bucketname/prefix`, containing the template body. The uri must point to the conformance pack template that is located in an Amazon S3 bucket in the same region as the conformance pack. Maximum length of 1024. Drift detection is not possible with this argument.
     */
    templateS3Uri?: pulumi.Input<string>;
}