Components of an Amazon Config Rule

Follow the steps in Installing the Amazon CLI.

Follow the steps in Setting Up Amazon Config with the Console or Setting Up Amazon Config with the Amazon CLI. For information about the Amazon Regions where Amazon Config is supported, select your Region from the Amazon Regional Services list.

Install the RDK, using the recommended method with pip:

pip install rdk

Install the RDKLib, using the recommended method with pip:

pip install rdklib

To create a rule that is triggered by a change to specified resource type, run the following command:

rdk create YOUR_RULE_NAME --runtime python3.6-lib --resource-types AWS::Resource::Type

The following example creates a rule that is triggered by a change to the AWS::IAM::User resource type:

rdk create MFA_ENABLED_RULE --runtime python3.6-lib --resource-types AWS::IAM::User

The following are the flags you can use with the rdk create command for change-triggered rules:

rdk create RULE_NAME 
    --runtime pythonX.X-lib // Python runtime version
    --input-parameters REQUIRED_PARAMETERS // Parameters that are required for a rule to do its evaluation
    --optional-parameters OPTIONAL_PARAMETERS // Parameters that are optional for a rule to do its evaluation
    --resource-types AWS::Resource::Type // Resource type(s) that the rule targets

After running rdk create, you should see a new directory with the rule name and 3 files in it:

The next step is writing the rule logic. You will only need to edit the RULE_NAME.py file. If you open the RULE_NAME.py file, you will see a template where you can add rule logic. The following is the template that was generated for MFA_ENABLED_RULE:

from rdklib import Evaluator, Evaluation, ConfigRule, ComplianceType
                            
APPLICABLE_RESOURCES = ['AWS::IAM::User']
                            
class MFA_ENABLED_RULE(ConfigRule):

    def evaluate_change(self, event, client_factory, configuration_item, valid_rule_parameters):
        ###############################
        # Add your custom logic here. #
        ###############################                       
                            
        return [Evaluation(ComplianceType.NOT_APPLICABLE)]
                            
    #def evaluate_periodic(self, event, client_factory, valid_rule_parameters):
    #    pass
                            
    def evaluate_parameters(self, rule_parameters):
        valid_rule_parameters = rule_parameters
        return valid_rule_parameters
                                                        
################################
# DO NOT MODIFY ANYTHING BELOW #
################################
def lambda_handler(event, context):
    my_rule = MFA_ENABLED_RULE()
    evaluator = Evaluator(my_rule, APPLICABLE_RESOURCES)
    return evaluator.handle(event, context)

The following example is an edited version of the MFA_ENABLED_RULE template with the rule logic. The rule checks if IAM users have multi-factor authentication (MFA) enabled. The rule is NON_COMPLIANT if an IAM user does not have MFA not enabled. For more information on rule logic and the methods provided in the template, see Rule logic.

from rdklib import ComplianceType, ConfigRule, Evaluation, Evaluator

APPLICABLE_RESOURCES = ["AWS::IAM::User"]

class MFA_ENABLED_RULE(ConfigRule):
        
    def evaluate_change(self, event, client_factory, configuration_item, valid_rule_parameters):
    
        username = configuration_item.get("resourceName")
        
        iam_client = client_factory.build_client("iam")
        
        response = iam_client.list_mfa_devices(UserName=username)
        
        # Scenario:1 IAM user has MFA enabled.
        if response["MFADevices"]:
            return [Evaluation(ComplianceType.COMPLIANT)]
            
        # Scenario:2 IAM user has MFA not enabled.
        annotation = "MFA needs to be enabled for user."
        return [Evaluation(ComplianceType.NON_COMPLIANT, annotation=annotation)]
        
    def evaluate_parameters(self, rule_parameters):
        valid_rule_parameters = rule_parameters
        return valid_rule_parameters

################################
# DO NOT MODIFY ANYTHING BELOW #
################################
def lambda_handler(event, context):
    my_rule = MFA_ENABLED_RULE()
    evaluator = Evaluator(my_rule, APPLICABLE_RESOURCES)
    return evaluator.handle(event, context)

The next step is installing the RDKlib layer in Amazon with either the Amazon Console or Amazon CLI. RDKLib is designed to work as an Amazon Lambda Layer. It allows you to use the library without needing to include it in your deployment package.

The next step is providing a role for the Lambda function to assume. By default, Lambda functions attempt to assume the AWSServiceRoleForConfig role, which is not allowed. You need to create a role with the AWS_ConfigRole managed policy. The role must have a trust relationship with Amazon Config and all roles under the /rdk/ path should assume the role. The following is an example trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "config.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::account-ID:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringLike": {
          "aws:PrincipalArn": "arn:aws:iam::account-ID:role/rdk/*"
        }
      }
    }
  ]
}

Using this trust policy, run the following command:

aws iam create-role --role-name your-role-name --assume-role-policy-document file://trust-policy.json

Now, run the following command to update the input parameter for ExecutionRoleName and provide the role name:

rdk modify YOUR_RULE_NAME --input-parameters '{"ExecutionRoleName":"your-role-name"}'

You can also use rdk modify to update the change-triggered rule details using the following flags:

rdk modify RULE_NAME 
    --input-parameters REQUIRED_PARAMETERS // Parameters that are required for a rule to do its evaluation
    --optional-parameters OPTIONAL_PARAMETERS // Parameters that are optional for a rule to do its evaluation
    --resource-types AWS::Resource::Type // Resource type(s) that the rule targets

The final step is deploying your rule. To deploy your rule, run the following command with the ARN of the Lambda layer from step 3:

rdk deploy YOUR_RULE_NAME --rdklib-layer-arn YOUR_RDKLIB_LAYER_ARN

The rule is now deployed. You can use the Amazon Config Console to check if the rule is working as expected.

To create a rule that is triggered periodically for a specified resource type, run the following command:

rdk create YOUR_RULE_NAME --runtime python3.6-lib --resource-types AWS::Resource::Type --maximum-frequency EXECUTION_FREQUENCY

The following example creates a rule that is triggered every 24 hours for the AWS::IAM::User resource type:

rdk create MFA_ENABLED_RULE --runtime python3.6-lib --resource-types AWS::IAM::User --maximum-frequency TwentyFour_Hours

The following are the flags you can use with the rdk create command for periodic rules:

rdk create RULE_NAME 
    --runtime pythonX.X-lib // Python runtime version
    --input-parameters REQUIRED_PARAMETERS // Parameters that are required for a rule to do its evaluation
    --optional-parameters OPTIONAL_PARAMETERS // Parameters that are optional for a rule to do its evaluation
    --resource-types AWS::Resource::Type // Resource type(s) that the rule targets
    --maximum-frequency EXECUTION_FREQUENCY // How often the rule should be run on a periodic trigger.
 One of ['One_Hour','Three_Hours','Six_Hours','Twelve_Hours','TwentyFour_Hours']

After running rdk create, you should see a new directory with the rule name and 3 files in it:

The next step is writing the rule logic. You will only need to edit the RULE_NAME.py file. If you open the RULE_NAME.py file, you will see a template where you can add rule logic. The following is the template that was generated for MFA_ENABLED_RULE:

from rdklib import Evaluator, Evaluation, ConfigRule, ComplianceType
                            
APPLICABLE_RESOURCES = ['AWS::IAM::User']
                            
class MFA_ENABLED_RULE(ConfigRule):

    def evaluate_change(self, event, client_factory, configuration_item, valid_rule_parameters):
        ###############################
        # Add your custom logic here. #
        ###############################                       
                            
        return [Evaluation(ComplianceType.NOT_APPLICABLE)]
                            
    #def evaluate_periodic(self, event, client_factory, valid_rule_parameters):
    #    pass
                            
    def evaluate_parameters(self, rule_parameters):
        valid_rule_parameters = rule_parameters
        return valid_rule_parameters
                                                        
################################
# DO NOT MODIFY ANYTHING BELOW #
################################
def lambda_handler(event, context):
    my_rule = MFA_ENABLED_RULE()
    evaluator = Evaluator(my_rule, APPLICABLE_RESOURCES)
    return evaluator.handle(event, context)

The template defaults to change-triggered rules. Instead, add your logic to the evaluate_periodic method. The following example is an edited version of the MFA_ENABLED_RULE template with the rule logic. The rule checks if IAM users have multi-factor authentication (MFA) enabled. The rule is NON_COMPLIANT if an IAM user does not have MFA not enabled. For more information on rule logic and the methods provided in the template, see Rule logic.

from rdklib import ComplianceType, ConfigRule, Evaluation, Evaluator

APPLICABLE_RESOURCES = ["AWS::IAM::User"]

class MFA_ENABLED_RULE(ConfigRule):l
        
    def evaluate_periodic(self, event, client_factory, valid_rule_parameters):
        evaluations = []
        
        iam_client = client_factory.build_client("iam")
        
        paginator = iam_client.get_paginator("list_users")
        response_iterator = paginator.paginate()
        
        for response in response_iterator:
            for user in response["Users"]:
                username = user["UserName"]
                response = iam_client.list_mfa_devices(UserName=username)
                
                # Scenario:1 IAM user has MFA enabled.
                if response["MFADevices"]:
                    evaluations.append(Evaluation(ComplianceType.COMPLIANT, username, "AWS::IAM::User"))
                    
                # Scenario:2 IAM user has MFA not enabled.
                if not response["MFADevices"]:
                    annotation = "MFA needs to be enabled for user."
                    evaluations.append(
                        Evaluation(ComplianceType.NON_COMPLIANT, username, "AWS::IAM::User", annotation=annotation)
                    )                  
        return evaluations
    
    def evaluate_parameters(self, rule_parameters):
        valid_rule_parameters = rule_parameters
        return valid_rule_parameters

################################
# DO NOT MODIFY ANYTHING BELOW #
################################
def lambda_handler(event, context):
    my_rule = MFA_ENABLED_RULE()
    evaluator = Evaluator(my_rule, APPLICABLE_RESOURCES)
    return evaluator.handle(event, context)

The next step is installing the RDKlib layer in Amazon with either the Amazon Console or Amazon CLI. RDKLib is designed to work as an Amazon Lambda Layer. It allows you to use the library without needing to include it in your deployment package.

The next step is providing a role for the Lambda function to assume. By default, Lambda functions attempt to assume the AWSServiceRoleForConfig role, which is not allowed. You need to create a role with the AWS_ConfigRole managed policy. The role must have a trust relationship with Amazon Config and all roles under the /rdk/ path should assume the role. The following is an example trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "config.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::account-ID:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringLike": {
          "aws:PrincipalArn": "arn:aws:iam::account-ID:role/rdk/*"
        }
      }
    }
  ]
}

Using this trust policy, run the following command:

aws iam create-role --role-name your-role-name --assume-role-policy-document file://trust-policy.json

Now, run the following command to update the input parameter for ExecutionRoleName and provide the role name:

rdk modify YOUR_RULE_NAME --input-parameters '{"ExecutionRoleName":"your-role-name"}'

You can also use rdk modify to update the periodic rule details using the following flags:

rdk modify RULE_NAME 
    --input-parameters REQUIRED_PARAMETERS // Parameters that are required for a rule to do its evaluation
    --optional-parameters OPTIONAL_PARAMETERS // Parameters that are optional for a rule to do its evaluation
    --resource-types AWS::Resource::Type // Resource type(s) that the rule targets
    --maximum-frequency EXECUTION_FREQUENCY // How often the rule should be run on a periodic trigger.
 One of ['One_Hour','Three_Hours','Six_Hours','Twelve_Hours','TwentyFour_Hours']

The final step is deploying your rule. To deploy your rule, run the following command with the ARN of the Lambda layer from step 3:

rdk deploy YOUR_RULE_NAME --rdklib-layer-arn YOUR_RDKLIB_LAYER_ARN

The rule is now deployed. You can use the Amazon Config Console to check if the rule is working as expected.