Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon Config Custom Rules

Amazon Config Custom Rules are rules that you create from scratch. There are two ways to create Amazon Config custom rules: with Lambda functions (Amazon Lambda Developer Guide) and with Guard (Guard GitHub Repository), a policy-as-code language.

Amazon Config custom rules created with Lambda are called Amazon Config Custom Lambda Rules and Amazon Config custom rules created with Guard are called Amazon Config Custom Policy Rules.

Amazon Config Custom Policy Rules

Rules written using Guard can be created from the Amazon Config console or by using the Amazon Config rule APIs. Amazon Config Custom Policy rules allow you to create Amazon Config Custom rules without needing to use Java or Python to develop Lambda functions to manage your custom rules. Amazon Config Custom Policy rules are initiated by configuration changes. For more information about Guard, see the Guard GitHub Repository.

Amazon Config Custom Lambda Rules

Custom Lambda rules provide you with the option to use Java or Python to create a Lambda function for a Amazon Config Custom rule. A Lambda function is custom code that you upload to Amazon Lambda, and it is invoked by events that are published to it by an event source. If the Lambda function is associated with an Amazon Config rule, Amazon Config invokes it when the rule is initiated. The Lambda function then evaluates the configuration information that is sent by Amazon Config, and it returns the evaluation results. For more information about Lambda functions, see Function and Event Sources in the Amazon Lambda Developer Guide.

Cost Considerations

For details about the costs associated with resource recording, see Amazon Config pricing.

Recommendation: Add logic to handle the evaluation of deleted resources for custom lambda rules

When creating Amazon Config custom lambda rules, it is highly recommended that you add logic to handle the evaluation of deleted resources.

When evaluation results are marked as NOT_APPLICABLE, they will be marked for deletion and cleaned up. If they're NOT marked as NOT_APPLICABLE, the evaluation results will remain unchanged until the rule is deleted, which can cause an unexpected spike in the creation of configuration items (CIs) for AWS::Config::ResourceCompliance upon rule deletion.

For information on how to set Amazon Config custom lambda rules to return NOT_APPLICABLE for deleted resources, see Managing deleted resources with Amazon Config custom lambda rules.

Recommendation: Provide the resources in scope for custom lambda rules

Amazon Config Custom Lambda Rules can cause a high number of Lambda function invocations if the rule is not scoped to one or more resource types. To avoid increased activity associated with your account, it is highly recommended to provide resources in scope for your Custom Lambda rules. If no resource types are selected, the rule will invoke the Lambda function for all resources in the account.

Recommendation: Stop recording resource compliance before deleting rules

It is highly recommended that you stop recording for the AWS::Config::ResourceCompliance resource type before you delete rules in your account. Deleting rules creates CIs for AWS::Config::ResourceCompliance and can affect your Amazon Config configuration recorder costs. If you are deleting rules which evaluate a large number of resource types, this can lead to a spike in the number of CIs recorded.

Best practice:

Trigger Types

After you add a rule to your account, Amazon Config compares your resources to the conditions of the rule. After this initial evaluation, Amazon Config continues to run evaluations each time one is triggered. The evaluation triggers are defined as part of the rule, and they can include the following types.

Evaluation Modes

There are two evaluation modes for Amazon Config rules.

Managing deleted resources with Amazon Config custom lambda rules

Rules reporting on deleted resources should return the evaluation result of NOT_APPLICABLE in order to avoid unnecessary rule evaluations.

When you delete a resource, Amazon Config creates a configurationItem with ResourceDeleted for the configurationItemStatus. You can use this metadata to check if a rule reports on a deleted resource. For more information on configuration items, see Concepts | Configuration Items.

Include the following code snippets to check for deleted resources and set the evaluation result of an Amazon Config custom lambda rule to NOT_APPLICABLE if it reports on a deleted resource:

Custom Lambda Rules (Node.js)

// Check whether the resource has been deleted. If the resource was deleted, then the evaluation returns not applicable.
function isApplicable(configurationItem, event) {
    checkDefined(configurationItem, 'configurationItem');
    checkDefined(event, 'event');
    const status = configurationItem.configurationItemStatus;
    const eventLeftScope = event.eventLeftScope;
    return (status === 'OK' || status === 'ResourceDiscovered') && eventLeftScope === false;
}

Custom Lambda Rules (Python)

# Check whether the resource has been deleted. If the resource was deleted, then the evaluation returns not applicable.
def is_applicable(configurationItem, event):
    try:
        check_defined(configurationItem, 'configurationItem')
        check_defined(event, 'event')
    except:
        return True
    status = configurationItem['configurationItemStatus']
    eventLeftScope = event['eventLeftScope']
    if status == 'ResourceDeleted':
        print("Resource Deleted, setting Compliance Status to NOT_APPLICABLE.")
    return (status == 'OK' or status == 'ResourceDiscovered') and not eventLeftScope