ConfigRule

Source: src/AWS/Config/ConfigRule.ts

An AWS Config rule that evaluates whether your AWS resources comply with a desired configuration — either an AWS-managed rule, a custom Lambda rule, or a Guard custom-policy rule.

The account/region must have an AWS Config configuration recorder before rules can be created (see AWS.Config.ConfigurationRecorder).

Creating Rules

AWS-managed rule

import * as Config from "alchemy/AWS/Config";

const rule = yield* Config.ConfigRule("BucketVersioning", {
  source: {
    owner: "AWS",
    sourceIdentifier: "S3_BUCKET_VERSIONING_ENABLED",
  },
});

Managed rule with input parameters and scope

const rule = yield* Config.ConfigRule("RequiredTags", {
  description: "All buckets must carry a team tag",
  source: { owner: "AWS", sourceIdentifier: "REQUIRED_TAGS" },
  inputParameters: { tag1Key: "team" },
  scope: { complianceResourceTypes: ["AWS::S3::Bucket"] },
});

Periodic Evaluation

const rule = yield* Config.ConfigRule("RootMfa", {
  source: {
    owner: "AWS",
    sourceIdentifier: "ROOT_ACCOUNT_MFA_ENABLED",
  },
  maximumExecutionFrequency: "TwentyFour_Hours",
});