AWS::Config::OrganizationConfigRule
Adds or updates an Amazon Config rule for your entire organization to evaluate if your Amazon resources comply with your desired configurations. For information on how many organization Amazon Config rules you can have per account, see Service Limits in the Amazon Config Developer Guide.
Only a management account and a delegated administrator can create or update an organization Amazon Config rule.
When calling the OrganizationConfigRule
resource with a delegated administrator, you must ensure Amazon OrganizationsListDelegatedAdministrator
permissions are added. An organization can have up to 3 delegated administrators.
The OrganizationConfigRule
resource enables organization service access through the EnableAWSServiceAccess
action and creates a service-linked
role AWSServiceRoleForConfigMultiAccountSetup
in the management or delegated administrator account of your organization.
The service-linked role is created only when the role does not exist in the caller account.
Amazon Config verifies the existence of role with GetRole
action.
To use the OrganizationConfigRule
resource with delegated administrator, register a delegated administrator by calling Amazon Organization
register-delegated-administrator
for config-multiaccountsetup.amazonaws.com
.
There are two types of rules: Amazon Config Managed Rules and Amazon Config Custom Rules.
You can use PutOrganizationConfigRule
to create both Amazon Config Managed Rules and Amazon Config Custom Rules.
Amazon Config Managed Rules are predefined,
customizable rules created by Amazon Config. For a list of managed rules, see
List of Amazon Config
Managed Rules. If you are adding an Amazon Config managed rule, you must specify the rule's identifier for the RuleIdentifier
key.
Amazon Config Custom Rules are rules that you create from scratch. There are two ways to create Amazon Config custom rules: with Lambda functions
(Amazon Lambda Developer Guide) and with Guard (Guard GitHub
Repository
If you are adding a new Amazon Config Custom Lambda rule, you first need to create an Amazon Lambda function in the management account or a delegated
administrator that the rule invokes to evaluate your resources. You also need to create an IAM role in the managed account that can be assumed by the Lambda function.
When you use PutOrganizationConfigRule
to add a Custom Lambda rule to Amazon Config, you must
specify the Amazon Resource Name (ARN) that Amazon Lambda assigns to the function.
Syntax
To declare this entity in your Amazon CloudFormation template, use the following syntax:
JSON
{ "Type" : "AWS::Config::OrganizationConfigRule", "Properties" : { "ExcludedAccounts" :
[ String, ... ]
, "OrganizationConfigRuleName" :String
, "OrganizationCustomPolicyRuleMetadata" :OrganizationCustomPolicyRuleMetadata
, "OrganizationCustomRuleMetadata" :OrganizationCustomRuleMetadata
, "OrganizationManagedRuleMetadata" :OrganizationManagedRuleMetadata
} }
YAML
Type: AWS::Config::OrganizationConfigRule Properties: ExcludedAccounts:
- String
OrganizationConfigRuleName:String
OrganizationCustomPolicyRuleMetadata:OrganizationCustomPolicyRuleMetadata
OrganizationCustomRuleMetadata:OrganizationCustomRuleMetadata
OrganizationManagedRuleMetadata:OrganizationManagedRuleMetadata
Properties
ExcludedAccounts
-
A comma-separated list of accounts excluded from organization Amazon Config rule.
Required: No
Type: Array of String
Minimum:
0
Maximum:
1000
Update requires: No interruption
OrganizationConfigRuleName
-
The name that you assign to organization Amazon Config rule.
Required: Yes
Type: String
Pattern:
[A-Za-z0-9-_]+
Minimum:
1
Maximum:
64
Update requires: Replacement
OrganizationCustomPolicyRuleMetadata
-
An object that specifies metadata for your organization's Amazon Config Custom Policy rule. The metadata includes the runtime system in use, which accounts have debug logging enabled, and other custom rule metadata, such as resource type, resource ID of Amazon resource, and organization trigger types that initiate Amazon Config to evaluate Amazon resources against a rule.
Required: No
Type: OrganizationCustomPolicyRuleMetadata
Update requires: No interruption
OrganizationCustomRuleMetadata
-
An
OrganizationCustomRuleMetadata
object.Required: No
Type: OrganizationCustomRuleMetadata
Update requires: No interruption
OrganizationManagedRuleMetadata
-
An
OrganizationManagedRuleMetadata
object.Required: No
Type: OrganizationManagedRuleMetadata
Update requires: No interruption
Return values
Ref
When you pass the logical ID of this resource to the intrinsic Ref
function, Ref
returns the OrganizationConfigRuleName.
For more information about using the Ref
function, see Ref
.
Fn::GetAtt
Examples
Managed Rule
The following example creates a managed organization config rule.
JSON
{ "BasicOrganizationConfigRule": { "Type": "AWS::Config::OrganizationConfigRule", "Properties": { "OrganizationConfigRuleName": "OrganizationConfigRuleName", "OrganizationManagedRuleMetadata": { "RuleIdentifier": "CLOUD_TRAIL_ENABLED", "Description": "Cloudtrail enabled rule" }, "ExcludedAccounts": [ "accountId" ] } } }
YAML
BasicOrganizationConfigRule: Type: "AWS::Config::OrganizationConfigRule" Properties: OrganizationConfigRuleName: "OrganizationConfigRuleName" OrganizationManagedRuleMetadata: RuleIdentifier: "CLOUD_TRAIL_ENABLED" Description: "Cloudtrail enabled rule" ExcludedAccounts: - "accountId"
Custom Rule
The following example creates a custom organization config rule.
JSON
{ "BasicOrganizationConfigRule": { "Type": "AWS::Config::OrganizationConfigRule", "Properties": { "OrganizationConfigRuleName": "OrganizationConfigRuleName", "OrganizationCustomRuleMetadata": { "LambdaFunctionArn": "CustomRuleLambdaArn", "OrganizationConfigRuleTriggerTypes": [ "ScheduledNotification" ] }, "ExcludedAccounts": [ "accountId" ] } } }
YAML
BasicOrganizationConfigRule: Type: "AWS::Config::OrganizationConfigRule" Properties: OrganizationConfigRuleName: "OrganizationConfigRuleName" OrganizationCustomRuleMetadata: LambdaFunctionArn: "CustomRuleLambdaArn" OrganizationConfigRuleTriggerTypes: - "ScheduledNotification" ExcludedAccounts: - "accountId"