Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Service configurations for resource groups

Resource groups enable you to manage collections of your Amazon resources as a unit. Some Amazon services support this by performing requested operations on all members of the group. Such services can store the settings to be applied to group members as a configuration in the form of a JSON data structure that is attached to the group.

This topic describes the available configuration settings for supported Amazon services.

How to access the service configuration attached to a resource group

Services that support service-linked groups typically set the configuration for you when you use the tools provided by that service, such as that service's management console or its Amazon CLI and Amazon SDK operations. Some services fully manage their service-linked groups and you can't modify them in any way except as allowed by the console or commands provided by the owning Amazon service. However, in some cases, you can interact with the service configuration by using the following API operations in the Amazon SDKs or their Amazon CLI equivalents:

JSON syntax of a service configuration

A resource group can contain a configuration that defines service-specific settings that apply to the resources that are members of that group.

A configuration is expressed as a JSON object. At the top-most level, a configuration is an array of group configuration items. Each group configuration item contains two elements: a Type for the configuration and a set of Parameters defined by that type. Each parameter contains a Name and an array of one or more Values. The following example with placeholders shows the basic syntax for a configuration for a single sample resource type. This example shows a type with two parameters, and each parameter with two values. The actual valid types, parameters, and values are discussed in the next section.

[
    {
        "Type": "configuration-type",
        "Parameters": [
            {
                "Name": "parameter1-name",
                "Values": [
                    "value1",
                    "value2"
                ]
            },
            {
                "Name": "parameter2-name",
                "Values": [
                    "value3",
                    "value4"
                ]
            }
        ]
    }
]

Supported configuration types and parameters

Resource Groups supports using the following configuration types. Each configuration type has a set of parameters that are valid for that type.

AWS::ResourceGroups::Generic

This configuration type specifies settings that enforce membership requirements on the resource group, rather than configuring the behavior of a specific resource type for an Amazon service. This configuration type is automatically added by those service-linked groups that need it, such as the AWS::EC2::CapacityReservationPool and AWS::EC2::HostManagment types.

The following Parameters are valid for the AWS::ResourceGroups::Generic service-linked group Type.

AWS::AppRegistry::Application

This Configuration type specifies that the resource group represents an application created by Amazon Service Catalog AppRegistry.

Resource groups of this type are fully managed by the AppRegistry service, and can't be created, updated, or deleted by users other than by using the tools provided by AppRegistry.

For more information, see Using AppRegistry in the Service Catalog User Guide.

When AppRegistry creates a service-linked resource group of this type, it also automatically creates a separate, additional Amazon CloudFormation service-linked group for each Amazon CloudFormation stack associated with the application.

AppRegistry automatically names the service-linked groups of this type that its creates with the prefix AWS_AppRegistry_Application- followed by the name of the application: AWS_AppRegistry_Application-MyAppName

The following parameters are supported for the AWS::AppRegistry::Application service-linked group type.

This application resource group automatically includes as group members the resource groups created for the Amazon CloudFormation stacks that are associated with the AppRegistry application. You can use the ListGroupResources operation to see those child groups.

The following example shows what the configuration section of a AWS::AppRegistry::Application service-linked group looks like.

[
    {
        "Type": "AWS::AppRegistry::Application",
        "Parameters":[
            {
                "Name": "Name",
                "Values": [
                    "MyApplication"
                ]
            },
            {
                "Name": "Arn",
                "Values": [
                    "arn:aws-cn:servicecatalog:us-east-1:123456789012:/applications/<application-id>"
                ]
            }
        ]
    }
]

AWS::CloudFormation::Stack

This Configuration type specifies that the group represents an Amazon CloudFormation stack and its members are the Amazon resources created by that stack.

Resource groups of this type are automatically created for you when you associate a Amazon CloudFormation stack with the AppRegistry service. You can't create, update, or delete these groups except by using the tools provided by AppRegistry.

AppRegistry automatically names the service-linked groups of this type that its creates with the prefix AWS_CloudFormation_Stack- followed by the name of the stack: AWS_CloudFormation_Stack-MyStackName

For more information, see Using AppRegistry in the Service Catalog User Guide.

AppRegistry automatically creates a service-linked resource group of this type for every Amazon CloudFormation stack that you associate with the AppRegistry application. These resource groups become child members of the parent resource group for the AppRegistry application.

The members of this Amazon CloudFormation resource group are the Amazon resources created as part of the stack.

The following parameters are supported for the AWS::CloudFormation::Stack service-linked group type.

The following example shows what the configuration section of an AWS::CloudFormation::Stack service-linked group looks like.

[
    {
        "Type": "AWS::CloudFormation::Stack",
        "Parameters":[
            {
                "Name": "Name",
                "Values": [
                    "MyStack"
                ]
            },
            {
                "Name": "Arn",
                "Values": [
                    "arn:aws-cn:cloudformation:us-east-1:123456789012:stack/MyStack/<stack-id>"
                ]
            }
        ]               
    }
]

AWS::EC2::CapacityReservationPool

This Configuration type specifies that the resource group represents a common pool of capacity provided by the group's members. The members of this resource group are required to be Amazon EC2 capacity reservations. A resource group can include both capacity reservations that you own in your account and capacity reservations that are shared with you from other accounts by using Amazon Resource Access Manager. This lets you launch an Amazon EC2 instance using this resource group as the value for the capacity reservation parameter. When you do this, the instance uses the available reserved capacity in the group. If resource group has no available capacity, the instance launches as a stand alone on-demand instance outside of the pool. For more information, see Working with Capacity Reservation groups in the Amazon EC2 User Guide.

If you configure a service-linked resource group with a Configuration item of this type, then you must also specify separate Configuration items with the following values:

The AWS::EC2::CapacityReservationPool item in a group configuration doesn't support any parameters.

The following example shows what the Configuration section of such a group looks like.

[
    {
        "Type": "AWS::EC2::CapacityReservationPool"
    },
    {
        "Type": "AWS::ResourceGroups::Generic",
        "Parameters": [
            {
                "Name": "allowed-resource-types",
                "Values": [ "AWS::EC2::CapacityReservation" ]
            }
        ]
    }
]

AWS::EC2::HostManagement

This identifier specifies settings for Amazon EC2 host management and Amazon License Manager that are enforced for the group's members. For more information, see Host resource groups in Amazon License Manager.

If you configure a service-linked resource group with a Configuration item of this type, then you must also specify separate Configuration items with the following values:

The following parameters are supported for the AWS::EC2::HostManagement service-linked group type.

The following example illustrates how to include all of the host management settings together in a single configuration.

[
    {
        "Type": "AWS::EC2::HostManagement",
        "Parameters": [
            {
                "Name": "auto-allocate-host",
                "Values": ["true"]
            },
            {
                "Name": "auto-release-host",
                "Values": ["false"]
            },
            {
                "Name": "allowed-host-families",
                "Values": ["c5", "m5"]
            },
            {
                "Name": "allowed-host-based-license-configurations",
                "Values": [
                    "arn:aws-cn:license-manager:us-west-2:123456789012:license-configuration:lic-6eb6586f508a786a2ba41EXAMPLE1111", 
                    "arn:aws-cn:license-manager:us-west-2:123456789012:license-configuration:lic-8a786a26f50ba416eb658EXAMPLE2222"
                ]
            }
        ]
    },
    {
        "Type": "AWS::ResourceGroups::Generic",
        "Parameters": [
            {
                "Name": "allowed-resource-types",
                "Values": ["AWS::EC2::Host"]
            },
            {
                "Name": "deletion-protection",
                "Values": ["UNLESS_EMPTY"]
            }
        ]
    }
]

AWS::NetworkFirewall::RuleGroup

This identifier specifies settings for Amazon Network Firewall rule groups that are enforced for the group's members. Firewall administrators can specify the ARN of a resource group of this type to automatically resolve the IP addresses of the group's members for a firewall rule instead of having to list each address manually. For more information, see Using tag-based resource groups in Amazon Network Firewall.

You can create resource groups of this configuration type by using the Network Firewall console or by running a Amazon CLI command or Amazon SDK operation.

Resource groups of this configuration type have the following restrictions:

The following example illustrates the Configuration and ResourceQuery sections for a group of this type.

{
    "Configuration": [
        {
            "Type": "AWS::NetworkFirewall::RuleGroup",
            "Parameters": []
        }
    ],
    "ResourceQuery": { 
        "Query": "{\"ResourceTypeFilters\":[\"AWS::EC2::Instance\"],\"TagFilters\":[{\"Key\":\"environment\",\"Values\":[\"production\"]}]}",
        "Type": "TAG_FILTERS_1_0"
    }
}

The following example Amazon CLI command creates a resource group with the previous configuration and query.

$ aws resource-groups create-group \
    --name test-group \
    --resource-query '{"Type": "TAG_FILTERS_1_0", "Query": "{\"ResourceTypeFilters\": [\"AWS::EC2::Instance\"], \"TagFilters\": [{\"Key\": \"environment\", \"Values\": [\"production\"]}]}"}' \
    --configuration '[{"Type": "AWS::NetworkFirewall::RuleGroup", "Parameters": []}]'
{
    "Group":{
        "GroupArn":"arn:aws:resource-groups:us-west-2:123456789012:group/test-group",
        "Name":"test-group",
        "OwnerId":"123456789012"
    },
    "Configuration": [
        {
            "Type": "AWS::NetworkFirewall::RuleGroup",
            "Parameters": []
        }
    ],
    "ResourceQuery": { 
        "Query": "{\"ResourceTypeFilters\":[\"AWS::EC2::Instance\"],\"TagFilters\":[{\"Key\":\"environment\",\"Values\":[\"production\"]}]}",
        "Type": "TAG_FILTERS_1_0"
    }
}