remediation_configurations

Creates, updates, deletes, gets or lists a remediation_configurations resource.

Overview

Name	remediation_configurations
Type	Resource
Id	aws.config.remediation_configurations

Fields

The following fields are returned by SELECT queries:

describe_remediation_configurations

Name	Datatype	Description
remediation_configurations	array	Returns a remediation configuration object.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_remediation_configurations	select	region		Returns the details of one or more remediation configurations.
put_remediation_configurations	replace	region, RemediationConfigurations		Adds or updates the remediation configuration with a specific Config rule with the selected target or action. The API creates the RemediationConfiguration object for the Config rule. The Config rule must already exist for you to add a remediation configuration. The target (SSM document) must exist and have permissions to use the target. Be aware of backward incompatible changes If you make backward incompatible changes to the SSM document, you must call this again to ensure the remediations can run. This API does not support adding remediation configurations for service-linked Config Rules such as Organization Config rules, the rules deployed by conformance packs, and rules deployed by Amazon Web Services Security Hub. Required fields For manual remediation configuration, you need to provide a value for automationAssumeRole or use a value in the assumeRolefield to remediate your resources. The SSM automation document can use either as long as it maps to a valid parameter. However, for automatic remediation configuration, the only valid assumeRole field value is AutomationAssumeRole and you need to provide a value for AutomationAssumeRole to remediate your resources. Auto remediation can be initiated even for compliant resources If you enable auto remediation for a specific Config rule using the PutRemediationConfigurations API or the Config console, it initiates the remediation process for all non-compliant resources for that specific rule. The auto remediation process relies on the compliance data snapshot which is captured on a periodic basis. Any non-compliant resource that is updated between the snapshot schedule will continue to be remediated based on the last known compliance data snapshot. This means that in some cases auto remediation can be initiated even for compliant resources, since the bootstrap processor uses a database that can have stale evaluation results based on the last known compliance data snapshot.
delete_remediation_configuration	delete	region		Deletes the remediation configuration.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_remediation_configurations

Returns the details of one or more remediation configurations.

SELECT
remediation_configurations
FROM aws.config.remediation_configurations
WHERE region = '{{ region }}' -- required
;

REPLACE examples

put_remediation_configurations

Adds or updates the remediation configuration with a specific Config rule with the selected target or action. The API creates the RemediationConfiguration object for the Config rule. The Config rule must already exist for you to add a remediation configuration. The target (SSM document) must exist and have permissions to use the target. Be aware of backward incompatible changes If you make backward incompatible changes to the SSM document, you must call this again to ensure the remediations can run. This API does not support adding remediation configurations for service-linked Config Rules such as Organization Config rules, the rules deployed by conformance packs, and rules deployed by Amazon Web Services Security Hub. Required fields For manual remediation configuration, you need to provide a value for automationAssumeRole or use a value in the assumeRolefield to remediate your resources. The SSM automation document can use either as long as it maps to a valid parameter. However, for automatic remediation configuration, the only valid assumeRole field value is AutomationAssumeRole and you need to provide a value for AutomationAssumeRole to remediate your resources. Auto remediation can be initiated even for compliant resources If you enable auto remediation for a specific Config rule using the PutRemediationConfigurations API or the Config console, it initiates the remediation process for all non-compliant resources for that specific rule. The auto remediation process relies on the compliance data snapshot which is captured on a periodic basis. Any non-compliant resource that is updated between the snapshot schedule will continue to be remediated based on the last known compliance data snapshot. This means that in some cases auto remediation can be initiated even for compliant resources, since the bootstrap processor uses a database that can have stale evaluation results based on the last known compliance data snapshot.

REPLACE aws.config.remediation_configurations
SET 
RemediationConfigurations = '{{ RemediationConfigurations }}'
WHERE 
region = '{{ region }}' --required
AND RemediationConfigurations = '{{ RemediationConfigurations }}' --required
RETURNING
failed_batches;

DELETE examples

delete_remediation_configuration

Deletes the remediation configuration.

DELETE FROM aws.config.remediation_configurations
WHERE region = '{{ region }}' --required
;