Organization
Manages a Config Organization Custom Policy Rule. More information about these rules can be found in the Enabling AWS Config Rules Across all Accounts in Your Organization and AWS Config Managed Rules documentation. For working with Organization Managed Rules (those invoking an AWS managed rule), see the aws_config_organization_managed__rule resource.
NOTE: This resource must be created in the Organization master account and rules will include the master account unless its ID is added to the
excluded_accountsargument.
Example Usage
Basic Usage
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const example = new aws.cfg.OrganizationCustomPolicyRule("example", {
name: "example_rule_name",
policyRuntime: "guard-2.x.x",
policyText: `let status = ['ACTIVE']
rule tableisactive when
resourceType == "AWS::DynamoDB::Table" {
configuration.tableStatus == %status
}
rule checkcompliance when
resourceType == "AWS::DynamoDB::Table"
tableisactive {
let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
%pitr == "ENABLED"
}
`,
resourceTypesScopes: ["AWS::DynamoDB::Table"],
});import pulumi
import pulumi_aws as aws
example = aws.cfg.OrganizationCustomPolicyRule("example",
name="example_rule_name",
policy_runtime="guard-2.x.x",
policy_text="""let status = ['ACTIVE']
rule tableisactive when
resourceType == "AWS::DynamoDB::Table" {
configuration.tableStatus == %status
}
rule checkcompliance when
resourceType == "AWS::DynamoDB::Table"
tableisactive {
let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
%pitr == "ENABLED"
}
""",
resource_types_scopes=["AWS::DynamoDB::Table"])using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
var example = new Aws.Cfg.OrganizationCustomPolicyRule("example", new()
{
Name = "example_rule_name",
PolicyRuntime = "guard-2.x.x",
PolicyText = @"let status = ['ACTIVE']
rule tableisactive when
resourceType == ""AWS::DynamoDB::Table"" {
configuration.tableStatus == %status
}
rule checkcompliance when
resourceType == ""AWS::DynamoDB::Table""
tableisactive {
let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
%pitr == ""ENABLED""
}
",
ResourceTypesScopes = new[]
{
"AWS::DynamoDB::Table",
},
});
});package main
import (
"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/cfg"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := cfg.NewOrganizationCustomPolicyRule(ctx, "example", &cfg.OrganizationCustomPolicyRuleArgs{
Name: pulumi.String("example_rule_name"),
PolicyRuntime: pulumi.String("guard-2.x.x"),
PolicyText: pulumi.String(`let status = ['ACTIVE']
rule tableisactive when
resourceType == "AWS::DynamoDB::Table" {
configuration.tableStatus == %status
}
rule checkcompliance when
resourceType == "AWS::DynamoDB::Table"
tableisactive {
let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
%pitr == "ENABLED"
}
`),
ResourceTypesScopes: pulumi.StringArray{
pulumi.String("AWS::DynamoDB::Table"),
},
})
if err != nil {
return err
}
return nil
})
}package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.cfg.OrganizationCustomPolicyRule;
import com.pulumi.aws.cfg.OrganizationCustomPolicyRuleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new OrganizationCustomPolicyRule("example", OrganizationCustomPolicyRuleArgs.builder()
.name("example_rule_name")
.policyRuntime("guard-2.x.x")
.policyText("""
let status = ['ACTIVE']
rule tableisactive when
resourceType == "AWS::DynamoDB::Table" {
configuration.tableStatus == %status
}
rule checkcompliance when
resourceType == "AWS::DynamoDB::Table"
tableisactive {
let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
%pitr == "ENABLED"
}
""")
.resourceTypesScopes("AWS::DynamoDB::Table")
.build());
}
}resources:
example:
type: aws:cfg:OrganizationCustomPolicyRule
properties:
name: example_rule_name
policyRuntime: guard-2.x.x
policyText: |
let status = ['ACTIVE']
rule tableisactive when
resourceType == "AWS::DynamoDB::Table" {
configuration.tableStatus == %status
}
rule checkcompliance when
resourceType == "AWS::DynamoDB::Table"
tableisactive {
let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus
%pitr == "ENABLED"
}
resourceTypesScopes:
- AWS::DynamoDB::TableImport
Using pulumi import, import a Config Organization Custom Policy Rule using the name argument. For example:
$ pulumi import aws:cfg/organizationCustomPolicyRule:OrganizationCustomPolicyRule example example_rule_nameConstructors
Properties
List of AWS account identifiers to exclude from the rule
Description of the rule
List of AWS account identifiers to exclude from the rule
A string in JSON format that is passed to the AWS Config Rule Lambda Function
Maximum frequency with which AWS Config runs evaluations for a rule, if the rule is triggered at a periodic frequency. Defaults to TwentyFour_Hours for periodic frequency triggered rules. Valid values: One_Hour, Three_Hours, Six_Hours, Twelve_Hours, or TwentyFour_Hours.
runtime system for your organization AWS Config Custom Policy rules
policy definition containing the logic for your organization AWS Config Custom Policy rule
Identifier of the AWS resource to evaluate
List of types of AWS resources to evaluate
Tag key of AWS resources to evaluate
Tag value of AWS resources to evaluate
List of notification types that trigger AWS Config to run an evaluation for the rule. Valid values: ConfigurationItemChangeNotification, OversizedConfigurationItemChangeNotification The following arguments are optional: