github.com/nevins-b/terraform@v0.3.8-0.20170215184714-bbae22007d5a/website/source/docs/providers/aws/r/config_config_rule.html.markdown (about)

     1  ---
     2  layout: "aws"
     3  page_title: "AWS: aws_config_config_rule"
     4  sidebar_current: "docs-aws-resource-config-config-rule"
     5  description: |-
     6    Provides an AWS Config Rule.
     7  ---
     8  
     9  # aws\_config\_config\_rule
    10  
    11  Provides an AWS Config Rule.
    12  
    13  ~> **Note:** Config Rule requires an existing [Configuration Recorder](/docs/providers/aws/r/config_configuration_recorder.html) to be present. Use of `depends_on` is recommended (as shown below) to avoid race conditions.
    14  
    15  ## Example Usage
    16  
    17  ```
    18  resource "aws_config_config_rule" "r" {
    19    name = "example"
    20    source {
    21      owner = "AWS"
    22      source_identifier = "S3_BUCKET_VERSIONING_ENABLED"
    23    }
    24    depends_on = ["aws_config_configuration_recorder.foo"]
    25  }
    26  
    27  resource "aws_config_configuration_recorder" "foo" {
    28    name = "example"
    29    role_arn = "${aws_iam_role.r.arn}"
    30  }
    31  
    32  resource "aws_iam_role" "r" {
    33    name = "my-awsconfig-role"
    34    assume_role_policy = <<POLICY
    35  {
    36    "Version": "2012-10-17",
    37    "Statement": [
    38      {
    39        "Action": "sts:AssumeRole",
    40        "Principal": {
    41          "Service": "config.amazonaws.com"
    42        },
    43        "Effect": "Allow",
    44        "Sid": ""
    45      }
    46    ]
    47  }
    48  POLICY
    49  }
    50  
    51  resource "aws_iam_role_policy" "p" {
    52    name = "my-awsconfig-policy"
    53    role = "${aws_iam_role.r.id}"
    54    policy = <<POLICY
    55  {
    56    "Version": "2012-10-17",
    57    "Statement": [
    58    	{
    59    		"Action": "config:Put*",
    60    		"Effect": "Allow",
    61    		"Resource": "*"
    62  
    63    	}
    64    ]
    65  }
    66  POLICY
    67  }
    68  ```
    69  
    70  ## Argument Reference
    71  
    72  The following arguments are supported:
    73  
    74  * `name` - (Required) The name of the rule
    75  * `description` - (Optional) Description of the rule
    76  * `input_parameters` - (Optional) A string in JSON format that is passed to the AWS Config rule Lambda function (only valid if `source.owner` is `CUSTOM_LAMBDA`).
    77  * `maximum_execution_frequency` - (Optional) The maximum frequency with which AWS Config runs evaluations for a rule.
    78  * `scope` - (Optional) Scope defines which resources can trigger an evaluation for the rule as documented below.
    79  * `source` - (Required) Source specifies the rule owner, the rule identifier, and the notifications that cause
    80  	the function to evaluate your AWS resources as documented below.
    81  
    82  ### `scope`
    83  
    84  Defines which resources can trigger an evaluation for the rule.
    85  If you do not specify a scope, evaluations are triggered when any resource in the recording group changes.
    86  
    87  * `compliance_resource_id` - (Optional) The IDs of the only AWS resource that you want to trigger an evaluation for the rule.
    88  	If you specify a resource ID, you must specify one resource type for `compliance_resource_types`.
    89  * `compliance_resource_types` - (Optional) A list of resource types of only those AWS resources that you want to trigger an
    90  	evaluation for the rule. e.g. `AWS::EC2::Instance`. You can only specify one type if you also specify
    91  	a resource ID for `compliance_resource_id`. See [relevant part of AWS Docs](http://docs.aws.amazon.com/config/latest/APIReference/API_ResourceIdentifier.html#config-Type-ResourceIdentifier-resourceType) for available types.
    92  * `tag_key` - (Optional, Required if `tag_value` is specified) The tag key that is applied to only those AWS resources that you want you
    93  	want to trigger an evaluation for the rule.
    94  * `tag_value` - (Optional) The tag value applied to only those AWS resources that you want to trigger an evaluation for the rule.
    95  
    96  ### `source`
    97  
    98  Provides the rule owner (AWS or customer), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.
    99  
   100  * `owner` - (Required) Indicates whether AWS or the customer owns and manages the AWS Config rule. 
   101  	The only valid value is `AWS` or `CUSTOM_LAMBDA`. Keep in mind that Lambda function will require `aws_lambda_permission` to allow AWSConfig to execute the function.
   102  * `source_identifier` - (Required) For AWS Config managed rules, a predefined identifier from a list. For example,
   103  	`IAM_PASSWORD_POLICY` is a managed rule. To reference a managed rule, see [Using AWS Managed Config Rules](http://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html).
   104  	For custom rules, the identifier is the ARN of the rule's AWS Lambda function, such as `arn:aws:lambda:us-east-1:123456789012:function:custom_rule_name`.
   105  * `source_detail` - (Optional) Provides the source and type of the event that causes AWS Config to evaluate your AWS resources. Only valid if `owner` is `CUSTOM_LAMBDA`.
   106  	* `event_source` - (Optional) The source of the event, such as an AWS service, that triggers AWS Config
   107  		to evaluate your AWS resources. The only valid value is `aws.config`.
   108  	* `maximum_execution_frequency` - (Optional) The frequency that you want AWS Config to run evaluations for a rule that
   109  		is triggered periodically. If specified, requires `message_type` to be `ScheduledNotification`.
   110  	* `message_type` - (Optional) The type of notification that triggers AWS Config to run an evaluation for a rule. You can specify the following notification types:
   111  	    * `ConfigurationItemChangeNotification` - Triggers an evaluation when AWS
   112  	    	Config delivers a configuration item as a result of a resource change.
   113  	    * `OversizedConfigurationItemChangeNotification` - Triggers an evaluation
   114  	    	when AWS Config delivers an oversized configuration item. AWS Config may
   115  	    	generate this notification type when a resource changes and the notification
   116  	    	exceeds the maximum size allowed by Amazon SNS.
   117  	    * `ScheduledNotification` - Triggers a periodic evaluation at the frequency
   118  	    	specified for `maximum_execution_frequency`.
   119  	    * `ConfigurationSnapshotDeliveryCompleted` - Triggers a periodic evaluation
   120  	    	when AWS Config delivers a configuration snapshot.
   121  
   122  ## Attributes Reference
   123  
   124  The following attributes are exported:
   125  
   126  * `arn` - The ARN of the config rule
   127  * `rule_id` - The ID of the config rule
   128  
   129  ## Import
   130  
   131  Config Rule can be imported using the name, e.g. 
   132  
   133  ```
   134  $ terraform import aws_config_config_rule.foo example
   135  ```