正在添加 Amazon Config Rules

示例 1：添加 Amazon 托管配置规则

以下 put-config-rule 示例提供了 JSON 代码来添加 Amazon 托管配置规则。

aws configservice put-config-rule \
    --config-rule file://RequiredTagsForEC2Instances.json

RequiredTagsForEC2Instances.json 是包含规则配置的 JSON 文件。

RequiredTagsForEC2Instances.json 的内容：

{
    "ConfigRuleName": "RequiredTagsForEC2Instances",
    "Description": "Checks whether the CostCenter and Owner tags are applied to EC2 instances.",
    "Scope": {
        "ComplianceResourceTypes": [
            "AWS::EC2::Instance"
        ]
    },
    "Source": {
        "Owner": "AWS",
        "SourceIdentifier": "REQUIRED_TAGS"
    },
    "InputParameters": "{\"tag1Key\":\"CostCenter\",\"tag2Key\":\"Owner\"}"
}

对于 ComplianceResourceTypes 属性，此 JSON 代码将范围限制为的资源 AWS::EC2::Instance 键入，所以 Amazon Config 将仅根据规则评估 EC2 实例。由于该规则是托管规则，因此 Owner 属性设置为，AWSSourceIdentifier 属性设置为规则标识符。REQUIRED_TAGS对于 InputParameters 属性，指定了规则所需的标签键 CostCenter 和 Owner。

此命令不生成任何输出。要验证规则配置，请运行 描述配置规则 命令，然后指定规则名称。

有关更多信息，请参阅 Amazon 配置管理规则 在 Amazon 配置开发者指南。

示例 2：添加客户管理的配置规则

以下 put-config-rule 示例提供用于添加客户管理的配置规则的 JSON 代码。

aws configservice put-config-rule \
    --config-rule file://InstanceTypesAreT2micro.json

InstanceTypesAreT2micro.json 是包含规则配置的 JSON 文件。

InstanceTypesAreT2micro.json 的内容：

{
    "ConfigRuleName": "InstanceTypesAreT2micro",
    "Description": "Evaluates whether EC2 instances are the t2.micro type.",
    "Scope": {
        "ComplianceResourceTypes": [
            "AWS::EC2::Instance"
        ]
    },
    "Source": {
        "Owner": "CUSTOM_LAMBDA",
        "SourceIdentifier": "arn:aws:lambda:us-west-2:123456789012:function:InstanceTypeCheck",
        "SourceDetails": [
            {
                "EventSource": "aws.config",
                "MessageType": "ConfigurationItemChangeNotification"
            }
        ]
    },
    "InputParameters": "{\"desiredInstanceType\":\"t2.micro\"}"
}

对于 ComplianceResourceTypes 属性，此 JSON 代码将范围限制为的资源 AWS::EC2::Instance 键入，所以 Amazon Config 将仅根据规则评估 EC2 实例。由于此规则是客户管理的规则， Owner 属性设置为 CUSTOM_LAMBDA，以及 SourceIdentifier 属性设置为的 ARN Amazon Lambda 函数。SourceDetails 对象为必填项。为指定的参数 InputParameters 属性被传递给 Amazon 何时 Lambda 函数 Amazon Config 调用它来根据规则评估资源。

此命令不生成任何输出。要验证规则配置，请运行 描述配置规则 命令，然后指定规则名称。

有关更多信息，请参阅 Amazon 配置自定义规则 在 Amazon 配置开发者指南。

class ConfigWrapper:
    """
    Encapsulates AWS Config functions.
    """

    def __init__(self, config_client):
        """
        :param config_client: A Boto3 AWS Config client.
        """
        self.config_client = config_client


    def put_config_rule(self, rule_name):
        """
        Sets a configuration rule that prohibits making Amazon S3 buckets publicly
        readable.

        :param rule_name: The name to give the rule.
        """
        try:
            self.config_client.put_config_rule(
                ConfigRule={
                    "ConfigRuleName": rule_name,
                    "Description": "S3 Public Read Prohibited Bucket Rule",
                    "Scope": {
                        "ComplianceResourceTypes": [
                            "AWS::S3::Bucket",
                        ],
                    },
                    "Source": {
                        "Owner": "AWS",
                        "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED",
                    },
                    "InputParameters": "{}",
                    "ConfigRuleState": "ACTIVE",
                }
            )
            logger.info("Created configuration rule %s.", rule_name)
        except ClientError:
            logger.exception("Couldn't create configuration rule %s.", rule_name)
            raise

    " Create a config rule for S3 bucket public read prohibition
    lo_cfs->putconfigrule(
      io_configrule = NEW /aws1/cl_cfsconfigrule(
        iv_configrulename = iv_rule_name
        iv_description = |S3 Public Read Prohibited Bucket Rule|
        io_scope = NEW /aws1/cl_cfsscope(
          it_complianceresourcetypes = VALUE /aws1/cl_cfscplncresrctypes_w=>tt_complianceresourcetypes(
            ( NEW /aws1/cl_cfscplncresrctypes_w( |AWS::S3::Bucket| ) )
          )
        )
        io_source = NEW /aws1/cl_cfssource(
          iv_owner = |AWS|
          iv_sourceidentifier = |S3_BUCKET_PUBLIC_READ_PROHIBITED|
        )
        iv_inputparameters = '{}'
        iv_configrulestate = |ACTIVE|
      )
    ).
    MESSAGE 'Created AWS Config rule.' TYPE 'I'.