aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS Config Organizational Custom Rules using Guard Custom policy

Open
#1,273 4 comments 4 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::Config::OrganizationConfigRule

### Resource name

_No response_

### Description

We can create an organizational config rule (organization-custom-policy-rule-metadata) using the CLI
```
$ aws configservice put-organization-config-rule --organization-config-rule-name test-1 --organization-custom-policy-rule-metadata PolicyRuntime="guard-2.x.x",PolicyText="let var=5",OrganizationConfigRuleTriggerTypes=ConfigurationItemChangeNotification
```

It's also possible with some SDKs like boto3:
```
response = client.put_organization_config_rule(
OrganizationConfigRuleName='test-rule-2',
OrganizationCustomPolicyRuleMetadata={
'OrganizationConfigRuleTriggerTypes': ['ConfigurationItemChangeNotification'],
'PolicyRuntime': 'guard-2.x.x',
'PolicyText': 'let test = 123'
}
)
```

Unfortunately it's not supported by CloudFormation.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by comparing the CloudFormation representation of AWS::Config::OrganizationConfigRule with the AWS Config put-organization-config-rule CLI and boto3 examples in the issue. Determine the CloudFormation metadata needed for organization-custom-policy-rule-metadata, and consider the work complete when this Guard custom policy rule can be expressed and deployed through CloudFormation.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.