conformance_packs

Creates, updates, deletes, gets or lists a conformance_packs resource.

Overview

Name	`conformance_packs`
Type	Resource
Id	`aws.config.conformance_packs`

Fields

The following fields are returned by SELECT queries:

describe_conformance_packs

Name	Datatype	Description
`conformance_pack_arn`	`string`	Amazon Resource Name (ARN) of the conformance pack.
`conformance_pack_id`	`string`	ID of the conformance pack.
`conformance_pack_input_parameters`	`array`	A list of ConformancePackInputParameter objects.
`conformance_pack_name`	`string`	Name of the conformance pack. (pattern: <code>[a-zA-Z][-a-zA-Z0-9]*</code>)
`created_by`	`string`	The Amazon Web Services service that created the conformance pack.
`delivery_s3_bucket`	`string`	The name of the Amazon S3 bucket where Config stores conformance pack templates. This field is optional.
`delivery_s3_key_prefix`	`string`	The prefix for the Amazon S3 bucket. This field is optional.
`last_update_requested_time`	`string (date-time)`	The last time a conformation pack update was requested.
`template_ssm_document_details`	`object`	An object that contains the name or Amazon Resource Name (ARN) of the Amazon Web Services Systems Manager document (SSM document) and the version of the SSM document that is used to create a conformance pack.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Description
`describe_conformance_packs`	`select`	`region`	Returns a list of one or more conformance packs.
`put_conformance_pack`	`replace`	`region`, `ConformancePackName`	Creates or updates a conformance pack. A conformance pack is a collection of Config rules that can be easily deployed in an account and a region and across an organization. For information on how many conformance packs you can have per account, see Service Limits in the Config Developer Guide. When you use PutConformancePack to deploy conformance packs in your account, the operation can create Config rules and remediation actions without requiring config:PutConfigRule or config:PutRemediationConfigurations permissions in your account IAM policies. This API uses the AWSServiceRoleForConfigConforms service-linked role in your account to create conformance pack resources. This service-linked role includes the permissions to create Config rules and remediation configurations, even if your account IAM policies explicitly deny these actions. This API creates a service-linked role AWSServiceRoleForConfigConforms in your account. The service-linked role is created only when the role does not exist in your account. You must specify only one of the follow parameters: TemplateS3Uri, TemplateBody or TemplateSSMDocumentDetails. Tags are added at creation and cannot be updated with this operation PutConformancePack is an idempotent API. Subsequent requests won't create a duplicate resource if one was already created. If a following request has different tags values, Config will ignore these differences and treat it as an idempotent request of the previous. In this case, tags will not be updated, even if they are different. Use TagResource and UntagResource to update tags after creation.
`delete_conformance_pack`	`delete`	`region`	Deletes the specified conformance pack and all the Config rules, remediation actions, and all evaluation results within that conformance pack. Config sets the conformance pack to DELETE_IN_PROGRESS until the deletion is complete. You cannot update a conformance pack while it is in this state. Recommendation: Consider excluding the AWS::Config::ResourceCompliance resource type from recording before deleting rules Deleting rules creates configuration items (CIs) for AWS::Config::ResourceCompliance that can affect your costs for the configuration recorder. If you are deleting rules which evaluate a large number of resource types, this can lead to a spike in the number of CIs recorded. To avoid the associated costs, you can opt to disable recording for the AWS::Config::ResourceCompliance resource type before deleting rules, and re-enable recording after the rules have been deleted. However, since deleting rules is an asynchronous process, it might take an hour or more to complete. During the time when recording is disabled for AWS::Config::ResourceCompliance, rule evaluations will not be recorded in the associated resource’s history.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
`region`	`string`	AWS region (default: us-east-1)

`SELECT` examples

describe_conformance_packs

Returns a list of one or more conformance packs.

SELECT
conformance_pack_arn,
conformance_pack_id,
conformance_pack_input_parameters,
conformance_pack_name,
created_by,
delivery_s3_bucket,
delivery_s3_key_prefix,
last_update_requested_time,
template_ssm_document_details
FROM aws.config.conformance_packs
WHERE region = '{{ region }}' -- required
;

`REPLACE` examples

put_conformance_pack

Creates or updates a conformance pack. A conformance pack is a collection of Config rules that can be easily deployed in an account and a region and across an organization. For information on how many conformance packs you can have per account, see Service Limits in the Config Developer Guide. When you use PutConformancePack to deploy conformance packs in your account, the operation can create Config rules and remediation actions without requiring config:PutConfigRule or config:PutRemediationConfigurations permissions in your account IAM policies. This API uses the AWSServiceRoleForConfigConforms service-linked role in your account to create conformance pack resources. This service-linked role includes the permissions to create Config rules and remediation configurations, even if your account IAM policies explicitly deny these actions. This API creates a service-linked role AWSServiceRoleForConfigConforms in your account. The service-linked role is created only when the role does not exist in your account. You must specify only one of the follow parameters: TemplateS3Uri, TemplateBody or TemplateSSMDocumentDetails. Tags are added at creation and cannot be updated with this operation PutConformancePack is an idempotent API. Subsequent requests won't create a duplicate resource if one was already created. If a following request has different tags values, Config will ignore these differences and treat it as an idempotent request of the previous. In this case, tags will not be updated, even if they are different. Use TagResource and UntagResource to update tags after creation.

REPLACE aws.config.conformance_packs
SET 
ConformancePackName = '{{ ConformancePackName }}',
TemplateS3Uri = '{{ TemplateS3Uri }}',
TemplateBody = '{{ TemplateBody }}',
DeliveryS3Bucket = '{{ DeliveryS3Bucket }}',
DeliveryS3KeyPrefix = '{{ DeliveryS3KeyPrefix }}',
ConformancePackInputParameters = '{{ ConformancePackInputParameters }}',
TemplateSSMDocumentDetails = '{{ TemplateSSMDocumentDetails }}',
Tags = '{{ Tags }}'
WHERE 
region = '{{ region }}' --required
AND ConformancePackName = '{{ ConformancePackName }}' --required
RETURNING
conformance_pack_arn;

`DELETE` examples

delete_conformance_pack

Deletes the specified conformance pack and all the Config rules, remediation actions, and all evaluation results within that conformance pack. Config sets the conformance pack to DELETE_IN_PROGRESS until the deletion is complete. You cannot update a conformance pack while it is in this state. Recommendation: Consider excluding the AWS::Config::ResourceCompliance resource type from recording before deleting rules Deleting rules creates configuration items (CIs) for AWS::Config::ResourceCompliance that can affect your costs for the configuration recorder. If you are deleting rules which evaluate a large number of resource types, this can lead to a spike in the number of CIs recorded. To avoid the associated costs, you can opt to disable recording for the AWS::Config::ResourceCompliance resource type before deleting rules, and re-enable recording after the rules have been deleted. However, since deleting rules is an asynchronous process, it might take an hour or more to complete. During the time when recording is disabled for AWS::Config::ResourceCompliance, rule evaluations will not be recorded in the associated resource’s history.

DELETE FROM aws.config.conformance_packs
WHERE region = '{{ region }}' --required
;

Overview​

Fields​

Methods​

Parameters​

SELECT examples​

REPLACE examples​

DELETE examples​