AWS::Config::DeliveryChannel - Amazon CloudFormation
SyntaxPropertiesReturn valuesExamples
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

AWS::Config::DeliveryChannel

Specifies a delivery channel object to deliver configuration information to an Amazon S3 bucket and Amazon SNS topic.

Before you can create a delivery channel, you must create a configuration recorder. You can use this action to change the Amazon S3 bucket or an Amazon SNS topic of the existing delivery channel. To change the Amazon S3 bucket or an Amazon SNS topic, call this action and specify the changed values for the S3 bucket and the SNS topic. If you specify a different value for either the S3 bucket or the SNS topic, this action will keep the existing value for the parameter that is not changed.

Note

In the China (Beijing) Region, when you call this action, the Amazon S3 bucket must also be in the China (Beijing) Region. In all the other regions, Amazon Config supports cross-region and cross-account delivery channels.

You can have only one delivery channel per region per Amazon account, and the delivery channel is required to use Amazon Config.

Note

Amazon Config does not support the delivery channel to an Amazon S3 bucket bucket where object lock is enabled. For more information, see How S3 Object Lock works.

When you create the delivery channel, you can specify; how often Amazon Config delivers configuration snapshots to your Amazon S3 bucket (for example, 24 hours), the S3 bucket to which Amazon Config sends configuration snapshots and configuration history files, and the Amazon SNS topic to which Amazon Config sends notifications about configuration changes, such as updated resources, Amazon Config rule evaluations, and when Amazon Config delivers the configuration snapshot to your S3 bucket. For more information, see Deliver Configuration Items in the Amazon Config Developer Guide.

Note

To enable Amazon Config, you must create a configuration recorder and a delivery channel. If you want to create the resources separately, you must create a configuration recorder before you can create a delivery channel. Amazon Config uses the configuration recorder to capture configuration changes to your resources. For more information, see AWS::Config::ConfigurationRecorder.

For more information, see Managing the Delivery Channel in the Amazon Config Developer Guide.

Syntax

To declare this entity in your Amazon CloudFormation template, use the following syntax:

JSON

{
  "Type" : "AWS::Config::DeliveryChannel",
  "Properties" : {
      "ConfigSnapshotDeliveryProperties" : ConfigSnapshotDeliveryProperties,
      "Name" : String,
      "S3BucketName" : String,
      "S3KeyPrefix" : String,
      "S3KmsKeyArn" : String,
      "SnsTopicARN" : String
    }
}

YAML

Type: AWS::Config::DeliveryChannel
Properties:
  ConfigSnapshotDeliveryProperties: 
    ConfigSnapshotDeliveryProperties
  Name: String
  S3BucketName: String
  S3KeyPrefix: String
  S3KmsKeyArn: String
  SnsTopicARN: String

Properties

ConfigSnapshotDeliveryProperties

The options for how often Amazon Config delivers configuration snapshots to the Amazon S3 bucket.

Required: No

Type: ConfigSnapshotDeliveryProperties

Update requires: No interruption

Name

A name for the delivery channel. If you don't specify a name, Amazon CloudFormation generates a unique physical ID and uses that ID for the delivery channel name. For more information, see Name Type.

Updates are not supported. To change the name, you must run two separate updates. In the first update, delete this resource, and then recreate it with a new name in the second update.

Required: No

Type: String

Minimum: 1

Maximum: 256

Update requires: Replacement

S3BucketName

The name of the Amazon S3 bucket to which Amazon Config delivers configuration snapshots and configuration history files.

If you specify a bucket that belongs to another Amazon Web Services account, that bucket must have policies that grant access permissions to Amazon Config. For more information, see Permissions for the Amazon S3 Bucket in the Amazon Config Developer Guide.

Required: Yes

Type: String

Update requires: No interruption

S3KeyPrefix

The prefix for the specified Amazon S3 bucket.

Required: No

Type: String

Update requires: No interruption

S3KmsKeyArn

The Amazon Resource Name (ARN) of the Amazon Key Management Service (Amazon KMS ) Amazon KMS key (KMS key) used to encrypt objects delivered by Amazon Config. Must belong to the same Region as the destination S3 bucket.

Required: No

Type: String

Update requires: No interruption

SnsTopicARN

The Amazon Resource Name (ARN) of the Amazon SNS topic to which Amazon Config sends notifications about configuration changes.

If you choose a topic from another account, the topic must have policies that grant access permissions to Amazon Config. For more information, see Permissions for the Amazon SNS Topic in the Amazon Config Developer Guide.

Required: No

Type: String

Update requires: No interruption

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the delivery channel name, such as default.

For more information about using the Ref function, see Ref.

Fn::GetAtt

Examples

Delivery Channel

The following example creates a delivery channel that sends notifications to the specified Amazon SNS topic. The delivery channel also sends configuration changes and snapshots to the specified S3 bucket.

JSON

"DeliveryChannel": {
  "Type": "AWS::Config::DeliveryChannel",
  "Properties": {
    "ConfigSnapshotDeliveryProperties": {
      "DeliveryFrequency": "Six_Hours"
    },
    "S3BucketName": {"Ref": "ConfigBucket"},
    "SnsTopicARN": {"Ref": "ConfigTopic"}
  }
}

YAML

DeliveryChannel: 
  Type: AWS::Config::DeliveryChannel
  Properties: 
    ConfigSnapshotDeliveryProperties: 
      DeliveryFrequency: "Six_Hours"
    S3BucketName: 
      Ref: ConfigBucket
    SnsTopicARN: 
      Ref: ConfigTopic