@pulumi/aws
Version:
A Pulumi package for creating and managing Amazon Web Services (AWS) cloud resources.
196 lines • 7.47 kB
JavaScript
;
// *** WARNING: this file was generated by pulumi-language-nodejs. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
Object.defineProperty(exports, "__esModule", { value: true });
exports.Rule = void 0;
const pulumi = require("@pulumi/pulumi");
const utilities = require("../utilities");
/**
* Provides an AWS Config Rule.
*
* > **Note:** Config Rule requires an existing Configuration Recorder to be present. Use of `dependsOn` is recommended (as shown below) to avoid race conditions.
*
* ## Example Usage
*
* ### AWS Managed Rules
*
* AWS managed rules can be used by setting the source owner to `AWS` and the source identifier to the name of the managed rule. More information about AWS managed rules can be found in the [AWS Config Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html).
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const assumeRole = aws.iam.getPolicyDocument({
* statements: [{
* effect: "Allow",
* principals: [{
* type: "Service",
* identifiers: ["config.amazonaws.com"],
* }],
* actions: ["sts:AssumeRole"],
* }],
* });
* const rRole = new aws.iam.Role("r", {
* name: "my-awsconfig-role",
* assumeRolePolicy: assumeRole.then(assumeRole => assumeRole.json),
* });
* const foo = new aws.cfg.Recorder("foo", {
* name: "example",
* roleArn: rRole.arn,
* });
* const r = new aws.cfg.Rule("r", {
* name: "example",
* source: {
* owner: "AWS",
* sourceIdentifier: "S3_BUCKET_VERSIONING_ENABLED",
* },
* }, {
* dependsOn: [foo],
* });
* const p = aws.iam.getPolicyDocument({
* statements: [{
* effect: "Allow",
* actions: ["config:Put*"],
* resources: ["*"],
* }],
* });
* const pRolePolicy = new aws.iam.RolePolicy("p", {
* name: "my-awsconfig-policy",
* role: rRole.id,
* policy: p.then(p => p.json),
* });
* ```
*
* ### Custom Rules
*
* Custom rules can be used by setting the source owner to `CUSTOM_LAMBDA` and the source identifier to the Amazon Resource Name (ARN) of the Lambda Function. The AWS Config service must have permissions to invoke the Lambda Function, e.g., via the `aws.lambda.Permission` resource. More information about custom rules can be found in the [AWS Config Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules.html).
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const example = new aws.cfg.Recorder("example", {});
* const exampleFunction = new aws.lambda.Function("example", {});
* const examplePermission = new aws.lambda.Permission("example", {
* action: "lambda:InvokeFunction",
* "function": exampleFunction.arn,
* principal: "config.amazonaws.com",
* statementId: "AllowExecutionFromConfig",
* });
* const exampleRule = new aws.cfg.Rule("example", {source: {
* owner: "CUSTOM_LAMBDA",
* sourceIdentifier: exampleFunction.arn,
* }}, {
* dependsOn: [
* example,
* examplePermission,
* ],
* });
* ```
*
* ### Custom Policies
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const example = new aws.cfg.Rule("example", {
* name: "example",
* source: {
* owner: "CUSTOM_POLICY",
* sourceDetails: [{
* messageType: "ConfigurationItemChangeNotification",
* }],
* customPolicyDetails: {
* policyRuntime: "guard-2.x.x",
* policyText: `\x09 rule tableisactive when
* \x09\x09 resourceType == "AWS::DynamoDB::Table" {
* \x09\x09 configuration.tableStatus == ['ACTIVE']
* \x09 }
* \x09
* \x09 rule checkcompliance when
* \x09\x09 resourceType == "AWS::DynamoDB::Table"
* \x09\x09 tableisactive {
* \x09\x09\x09 supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus == "ENABLED"
* \x09 }
* `,
* },
* },
* });
* ```
*
* ## Import
*
* Using `pulumi import`, import Config Rule using the name. For example:
*
* ```sh
* $ pulumi import aws:cfg/rule:Rule foo example
* ```
*/
class Rule extends pulumi.CustomResource {
/**
* Get an existing Rule resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name, id, state, opts) {
return new Rule(name, state, { ...opts, id: id });
}
/**
* Returns true if the given object is an instance of Rule. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj) {
if (obj === undefined || obj === null) {
return false;
}
return obj['__pulumiType'] === Rule.__pulumiType;
}
constructor(name, argsOrState, opts) {
let resourceInputs = {};
opts = opts || {};
if (opts.id) {
const state = argsOrState;
resourceInputs["arn"] = state?.arn;
resourceInputs["description"] = state?.description;
resourceInputs["evaluationModes"] = state?.evaluationModes;
resourceInputs["inputParameters"] = state?.inputParameters;
resourceInputs["maximumExecutionFrequency"] = state?.maximumExecutionFrequency;
resourceInputs["name"] = state?.name;
resourceInputs["region"] = state?.region;
resourceInputs["ruleId"] = state?.ruleId;
resourceInputs["scope"] = state?.scope;
resourceInputs["source"] = state?.source;
resourceInputs["tags"] = state?.tags;
resourceInputs["tagsAll"] = state?.tagsAll;
}
else {
const args = argsOrState;
if (args?.source === undefined && !opts.urn) {
throw new Error("Missing required property 'source'");
}
resourceInputs["description"] = args?.description;
resourceInputs["evaluationModes"] = args?.evaluationModes;
resourceInputs["inputParameters"] = args?.inputParameters;
resourceInputs["maximumExecutionFrequency"] = args?.maximumExecutionFrequency;
resourceInputs["name"] = args?.name;
resourceInputs["region"] = args?.region;
resourceInputs["scope"] = args?.scope;
resourceInputs["source"] = args?.source;
resourceInputs["tags"] = args?.tags;
resourceInputs["arn"] = undefined /*out*/;
resourceInputs["ruleId"] = undefined /*out*/;
resourceInputs["tagsAll"] = undefined /*out*/;
}
opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
super(Rule.__pulumiType, name, resourceInputs, opts);
}
}
exports.Rule = Rule;
/** @internal */
Rule.__pulumiType = 'aws:cfg/rule:Rule';
//# sourceMappingURL=rule.js.map