pulumi-aws-kotlin/com.pulumi.aws.cfg.kotlin/OrganizationCustomPolicyRuleArgs

OrganizationCustomPolicyRuleArgs

data class OrganizationCustomPolicyRuleArgs(val debugLogDeliveryAccounts: Output<List<String>>? = null, val description: Output<String>? = null, val excludedAccounts: Output<List<String>>? = null, val inputParameters: Output<String>? = null, val maximumExecutionFrequency: Output<String>? = null, val name: Output<String>? = null, val policyRuntime: Output<String>? = null, val policyText: Output<String>? = null, val resourceIdScope: Output<String>? = null, val resourceTypesScopes: Output<List<String>>? = null, val tagKeyScope: Output<String>? = null, val tagValueScope: Output<String>? = null, val triggerTypes: Output<List<String>>? = null) : ConvertibleToJava<OrganizationCustomPolicyRuleArgs>

Manages a Config Organization Custom Policy Rule. More information about these rules can be found in the Enabling AWS Config Rules Across all Accounts in Your Organization and AWS Config Managed Rules documentation. For working with Organization Managed Rules (those invoking an AWS managed rule), see the aws_config_organization_managed__rule resource.

NOTE: This resource must be created in the Organization master account and rules will include the master account unless its ID is added to the excluded_accounts argument.

Example Usage

Basic Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const example = new aws.cfg.OrganizationCustomPolicyRule("example", {
    name: "example_rule_name",
    policyRuntime: "guard-2.x.x",
    policyText: `let status = ['ACTIVE']
rule tableisactive when
    resourceType == "AWS::DynamoDB::Table" {
    configuration.tableStatus == %status
}
rule checkcompliance when
    resourceType == "AWS::DynamoDB::Table"
    tableisactive {
        let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
        %pitr == "ENABLED"
    }
`,
    resourceTypesScopes: ["AWS::DynamoDB::Table"],
});

import pulumi
import pulumi_aws as aws
example = aws.cfg.OrganizationCustomPolicyRule("example",
    name="example_rule_name",
    policy_runtime="guard-2.x.x",
    policy_text="""let status = ['ACTIVE']
rule tableisactive when
    resourceType == "AWS::DynamoDB::Table" {
    configuration.tableStatus == %status
}
rule checkcompliance when
    resourceType == "AWS::DynamoDB::Table"
    tableisactive {
        let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
        %pitr == "ENABLED"
    }
""",
    resource_types_scopes=["AWS::DynamoDB::Table"])

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
    var example = new Aws.Cfg.OrganizationCustomPolicyRule("example", new()
    {
        Name = "example_rule_name",
        PolicyRuntime = "guard-2.x.x",
        PolicyText = @"let status = ['ACTIVE']
rule tableisactive when
    resourceType == ""AWS::DynamoDB::Table"" {
    configuration.tableStatus == %status
}
rule checkcompliance when
    resourceType == ""AWS::DynamoDB::Table""
    tableisactive {
        let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
        %pitr == ""ENABLED""
    }
",
        ResourceTypesScopes = new[]
        {
            "AWS::DynamoDB::Table",
        },
    });
});

package main
import (
	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/cfg"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cfg.NewOrganizationCustomPolicyRule(ctx, "example", &cfg.OrganizationCustomPolicyRuleArgs{
			Name:          pulumi.String("example_rule_name"),
			PolicyRuntime: pulumi.String("guard-2.x.x"),
			PolicyText: pulumi.String(`let status = ['ACTIVE']
rule tableisactive when
    resourceType == "AWS::DynamoDB::Table" {
    configuration.tableStatus == %status
}
rule checkcompliance when
    resourceType == "AWS::DynamoDB::Table"
    tableisactive {
        let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
        %pitr == "ENABLED"
    }
`),
			ResourceTypesScopes: pulumi.StringArray{
				pulumi.String("AWS::DynamoDB::Table"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.cfg.OrganizationCustomPolicyRule;
import com.pulumi.aws.cfg.OrganizationCustomPolicyRuleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var example = new OrganizationCustomPolicyRule("example", OrganizationCustomPolicyRuleArgs.builder()
            .name("example_rule_name")
            .policyRuntime("guard-2.x.x")
            .policyText("""
let status = ['ACTIVE']
rule tableisactive when
    resourceType == "AWS::DynamoDB::Table" {
    configuration.tableStatus == %status
}
rule checkcompliance when
    resourceType == "AWS::DynamoDB::Table"
    tableisactive {
        let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
        %pitr == "ENABLED"
    }
            """)
            .resourceTypesScopes("AWS::DynamoDB::Table")
            .build());
    }
}

resources:
  example:
    type: aws:cfg:OrganizationCustomPolicyRule
    properties:
      name: example_rule_name
      policyRuntime: guard-2.x.x
      policyText: |
        let status = ['ACTIVE']
        rule tableisactive when
            resourceType == "AWS::DynamoDB::Table" {
            configuration.tableStatus == %status
        }
        rule checkcompliance when
            resourceType == "AWS::DynamoDB::Table"
            tableisactive {
                let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
                %pitr == "ENABLED"
            }
      resourceTypesScopes:
        - AWS::DynamoDB::Table

Import

Using pulumi import, import a Config Organization Custom Policy Rule using the name argument. For example:

$ pulumi import aws:cfg/organizationCustomPolicyRule:OrganizationCustomPolicyRule example example_rule_name

Constructors

OrganizationCustomPolicyRuleArgs

fun OrganizationCustomPolicyRuleArgs(debugLogDeliveryAccounts: Output<List<String>>? = null, description: Output<String>? = null, excludedAccounts: Output<List<String>>? = null, inputParameters: Output<String>? = null, maximumExecutionFrequency: Output<String>? = null, name: Output<String>? = null, policyRuntime: Output<String>? = null, policyText: Output<String>? = null, resourceIdScope: Output<String>? = null, resourceTypesScopes: Output<List<String>>? = null, tagKeyScope: Output<String>? = null, tagValueScope: Output<String>? = null, triggerTypes: Output<List<String>>? = null)

Functions

toJava

open override fun toJava(): OrganizationCustomPolicyRuleArgs

Properties

debugLogDeliveryAccounts

val debugLogDeliveryAccounts: Output<List<String>>? = null

List of AWS account identifiers to exclude from the rule

description

val description: Output<String>? = null

Description of the rule

excludedAccounts

val excludedAccounts: Output<List<String>>? = null

List of AWS account identifiers to exclude from the rule

inputParameters

val inputParameters: Output<String>? = null

A string in JSON format that is passed to the AWS Config Rule Lambda Function

maximumExecutionFrequency

val maximumExecutionFrequency: Output<String>? = null

Maximum frequency with which AWS Config runs evaluations for a rule, if the rule is triggered at a periodic frequency. Defaults to TwentyFour_Hours for periodic frequency triggered rules. Valid values: One_Hour, Three_Hours, Six_Hours, Twelve_Hours, or TwentyFour_Hours.

name

val name: Output<String>? = null

name of the rule

policyRuntime

val policyRuntime: Output<String>? = null

runtime system for your organization AWS Config Custom Policy rules

policyText

val policyText: Output<String>? = null

policy definition containing the logic for your organization AWS Config Custom Policy rule

resourceIdScope

val resourceIdScope: Output<String>? = null

Identifier of the AWS resource to evaluate

resourceTypesScopes

val resourceTypesScopes: Output<List<String>>? = null

List of types of AWS resources to evaluate

tagKeyScope

val tagKeyScope: Output<String>? = null

Tag key of AWS resources to evaluate

tagValueScope

val tagValueScope: Output<String>? = null

Tag value of AWS resources to evaluate

triggerTypes

val triggerTypes: Output<List<String>>? = null

List of notification types that trigger AWS Config to run an evaluation for the rule. Valid values: ConfigurationItemChangeNotification, OversizedConfigurationItemChangeNotification The following arguments are optional: