AWS.Config reference

AggregationAuthorization

Source: src/AWS/Config/AggregationAuthorization.ts

An AWS Config aggregation authorization that grants an aggregator account in a specific region permission to collect AWS Config configuration and compliance data from this account.

The authorization’s identity is the (account, region) pair — changing either replaces it.

AggregationAuthorization: Authorizing an Aggregator

import * as Config from "alchemy/AWS/Config";

const authorization = yield* Config.AggregationAuthorization(
  "OrgAggregator",
  {
    authorizedAccountId: "123456789012",
    authorizedAwsRegion: "us-east-1",
  },
);

BatchGetResourceConfig

Source: src/AWS/Config/BatchGetResourceConfig.ts

Runtime binding for config:BatchGetResourceConfig — fetch the current configuration item for up to 100 recorded resources identified by resource keys. Keys the recorder has not discovered come back in unprocessedResourceKeys.

Provide Config.BatchGetResourceConfigHttp on the hosting Lambda Function to satisfy the requirement.

BatchGetResourceConfig: Reading Resource Configurations

// init — grants config:BatchGetResourceConfig
const batchGetResourceConfig = yield* AWS.Config.BatchGetResourceConfig();

// runtime
const result = yield* batchGetResourceConfig({
  resourceKeys: [
    { resourceType: "AWS::S3::Bucket", resourceId: "my-bucket" },
  ],
});
console.log(result.baseConfigurationItems);

ConfigRule

Source: src/AWS/Config/ConfigRule.ts

An AWS Config rule that evaluates whether your AWS resources comply with a desired configuration — either an AWS-managed rule, a custom Lambda rule, or a Guard custom-policy rule.

The account/region must have an AWS Config configuration recorder before rules can be created (see AWS.Config.ConfigurationRecorder).

ConfigRule: Creating Rules

AWS-managed rule

import * as Config from "alchemy/AWS/Config";

const rule = yield* Config.ConfigRule("BucketVersioning", {
  source: {
    owner: "AWS",
    sourceIdentifier: "S3_BUCKET_VERSIONING_ENABLED",
  },
});

Managed rule with input parameters and scope

const rule = yield* Config.ConfigRule("RequiredTags", {
  description: "All buckets must carry a team tag",
  source: { owner: "AWS", sourceIdentifier: "REQUIRED_TAGS" },
  inputParameters: { tag1Key: "team" },
  scope: { complianceResourceTypes: ["AWS::S3::Bucket"] },
});

ConfigRule: Periodic Evaluation

const rule = yield* Config.ConfigRule("RootMfa", {
  source: {
    owner: "AWS",
    sourceIdentifier: "ROOT_ACCOUNT_MFA_ENABLED",
  },
  maximumExecutionFrequency: "TwentyFour_Hours",
});

ConfigurationRecorder

Source: src/AWS/Config/ConfigurationRecorder.ts

The AWS Config configuration recorder that detects and records changes to your AWS resource configurations.

AWS allows only one customer managed configuration recorder per account per region — treat this resource as an account-region singleton. Starting the recorder (recording: true) requires a delivery channel (see AWS.Config.DeliveryChannel) and incurs per-configuration-item charges.

ConfigurationRecorder: Creating the Recorder

Recorder with the Config service-linked role

import * as Config from "alchemy/AWS/Config";

const recorder = yield* Config.ConfigurationRecorder("Recorder", {
  roleArn: `arn:aws:iam::${accountId}:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig`,
  recordingGroup: { allSupported: true },
});

Record only specific resource types

const recorder = yield* Config.ConfigurationRecorder("Recorder", {
  roleArn: serviceLinkedRoleArn,
  recordingGroup: {
    resourceTypes: ["AWS::S3::Bucket", "AWS::EC2::SecurityGroup"],
  },
});

ConfigurationRecorder: Recording State

const channel = yield* Config.DeliveryChannel("Channel", {
  s3BucketName: bucket.bucketName,
});
const recorder = yield* Config.ConfigurationRecorder("Recorder", {
  roleArn: serviceLinkedRoleArn,
  recording: true,
});

DeleteResourceConfig

Source: src/AWS/Config/DeleteResourceConfig.ts

Runtime binding for config:DeleteResourceConfig — delete the recorded configuration of a custom (third-party) resource previously recorded via PutResourceConfig.

Provide Config.DeleteResourceConfigHttp on the hosting Lambda Function to satisfy the requirement.

DeleteResourceConfig: Recording Custom Resources

// init — grants config:DeleteResourceConfig
const deleteResourceConfig = yield* AWS.Config.DeleteResourceConfig();

// runtime
yield* deleteResourceConfig({
  ResourceType: "MyCompany::Service::Widget",
  ResourceId: "widget-1",
});

DeliverConfigSnapshot

Source: src/AWS/Config/DeliverConfigSnapshot.ts

Runtime binding for config:DeliverConfigSnapshot — trigger an on-demand delivery of a configuration snapshot to the bound DeliveryChannel’s S3 bucket; the channel name is injected automatically. Requires a running configuration recorder.

Provide Config.DeliverConfigSnapshotHttp on the hosting Lambda Function to satisfy the requirement.

DeliverConfigSnapshot: Delivering Snapshots

// init — grants config:DeliverConfigSnapshot
const deliverSnapshot = yield* AWS.Config.DeliverConfigSnapshot(channel);

// runtime
const result = yield* deliverSnapshot();
console.log(result.configSnapshotId);

DeliveryChannel

Source: src/AWS/Config/DeliveryChannel.ts

The AWS Config delivery channel that delivers configuration snapshots and configuration history to an S3 bucket (and optionally notifies an SNS topic).

AWS allows only one delivery channel per account per region — treat this resource as an account-region singleton. A configuration recorder must exist before the channel can be created (see AWS.Config.ConfigurationRecorder).

DeliveryChannel: Creating the Channel

Deliver configuration history to S3

import * as Config from "alchemy/AWS/Config";

const channel = yield* Config.DeliveryChannel("Channel", {
  s3BucketName: bucket.bucketName,
});

Periodic snapshots with a key prefix

const channel = yield* Config.DeliveryChannel("Channel", {
  s3BucketName: bucket.bucketName,
  s3KeyPrefix: "config",
  snapshotDeliveryFrequency: "TwentyFour_Hours",
});

DescribeComplianceByConfigRule

Source: src/AWS/Config/DescribeComplianceByConfigRule.ts

Runtime binding for config:DescribeComplianceByConfigRule — read whether your Config rules are compliant (and how many resources violate each noncompliant rule).

Provide Config.DescribeComplianceByConfigRuleHttp on the hosting Lambda Function to satisfy the requirement.

DescribeComplianceByConfigRule: Reading Compliance

// init — grants config:DescribeComplianceByConfigRule
const describeComplianceByConfigRule = yield* AWS.Config.DescribeComplianceByConfigRule();

// runtime
const result = yield* describeComplianceByConfigRule();
for (const rule of result.ComplianceByConfigRules ?? []) {
  console.log(rule.ConfigRuleName, rule.Compliance?.ComplianceType);
}

DescribeComplianceByResource

Source: src/AWS/Config/DescribeComplianceByResource.ts

Runtime binding for config:DescribeComplianceByResource — read whether evaluated resources comply with the Config rules that evaluate them.

Provide Config.DescribeComplianceByResourceHttp on the hosting Lambda Function to satisfy the requirement.

DescribeComplianceByResource: Reading Compliance

// init — grants config:DescribeComplianceByResource
const describeComplianceByResource = yield* AWS.Config.DescribeComplianceByResource();

// runtime
const result = yield* describeComplianceByResource({
  ResourceType: "AWS::S3::Bucket",
});
console.log(result.ComplianceByResources);

DescribeConfigRuleEvaluationStatus

Source: src/AWS/Config/DescribeConfigRuleEvaluationStatus.ts

Runtime binding for config:DescribeConfigRuleEvaluationStatus — read the evaluation status (last invocation, last failure, first-evaluation flag) of your Config rules.

Provide Config.DescribeConfigRuleEvaluationStatusHttp on the hosting Lambda Function to satisfy the requirement.

DescribeConfigRuleEvaluationStatus: Rule Evaluation Status

// init — grants config:DescribeConfigRuleEvaluationStatus
const describeConfigRuleEvaluationStatus = yield* AWS.Config.DescribeConfigRuleEvaluationStatus();

// runtime
const result = yield* describeConfigRuleEvaluationStatus();
for (const status of result.ConfigRulesEvaluationStatus ?? []) {
  console.log(status.ConfigRuleName, status.LastSuccessfulInvocationTime);
}

GetComplianceDetailsByConfigRule

Source: src/AWS/Config/GetComplianceDetailsByConfigRule.ts

Runtime binding for config:GetComplianceDetailsByConfigRule — read the per-resource evaluation results (who was evaluated, when, and the verdict) of the bound ConfigRule; the rule name is injected automatically.

Provide Config.GetComplianceDetailsByConfigRuleHttp on the hosting Lambda Function to satisfy the requirement.

GetComplianceDetailsByConfigRule: Reading Compliance

// init — grants config:GetComplianceDetailsByConfigRule
const getComplianceDetails =
  yield* AWS.Config.GetComplianceDetailsByConfigRule(rule);

// runtime
const result = yield* getComplianceDetails({
  ComplianceTypes: ["NON_COMPLIANT"],
});
console.log(result.EvaluationResults);

GetComplianceDetailsByResource

Source: src/AWS/Config/GetComplianceDetailsByResource.ts

Runtime binding for config:GetComplianceDetailsByResource — read the per-rule evaluation results (who evaluated the resource, when, and the verdict) for one resource.

Provide Config.GetComplianceDetailsByResourceHttp on the hosting Lambda Function to satisfy the requirement.

GetComplianceDetailsByResource: Reading Compliance

// init — grants config:GetComplianceDetailsByResource
const getComplianceDetailsByResource = yield* AWS.Config.GetComplianceDetailsByResource();

// runtime
const result = yield* getComplianceDetailsByResource({
  ResourceType: "AWS::S3::Bucket",
  ResourceId: "my-bucket",
});
console.log(result.EvaluationResults);

GetComplianceSummaryByConfigRule

Source: src/AWS/Config/GetComplianceSummaryByConfigRule.ts

Runtime binding for config:GetComplianceSummaryByConfigRule — read the account-wide count of compliant vs. noncompliant Config rules.

Provide Config.GetComplianceSummaryByConfigRuleHttp on the hosting Lambda Function to satisfy the requirement.

GetComplianceSummaryByConfigRule: Reading Compliance

// init — grants config:GetComplianceSummaryByConfigRule
const getComplianceSummaryByConfigRule = yield* AWS.Config.GetComplianceSummaryByConfigRule();

// runtime
const result = yield* getComplianceSummaryByConfigRule();
console.log(result.ComplianceSummary?.NonCompliantResourceCount);

GetComplianceSummaryByResourceType

Source: src/AWS/Config/GetComplianceSummaryByResourceType.ts

Runtime binding for config:GetComplianceSummaryByResourceType — read the count of compliant vs. noncompliant resources, optionally grouped by resource type.

Provide Config.GetComplianceSummaryByResourceTypeHttp on the hosting Lambda Function to satisfy the requirement.

GetComplianceSummaryByResourceType: Reading Compliance

// init — grants config:GetComplianceSummaryByResourceType
const getComplianceSummaryByResourceType = yield* AWS.Config.GetComplianceSummaryByResourceType();

// runtime
const result = yield* getComplianceSummaryByResourceType();
console.log(result.ComplianceSummariesByResourceType);

GetDiscoveredResourceCounts

Source: src/AWS/Config/GetDiscoveredResourceCounts.ts

Runtime binding for config:GetDiscoveredResourceCounts — count the resources AWS Config has discovered, grouped by resource type.

Provide Config.GetDiscoveredResourceCountsHttp on the hosting Lambda Function to satisfy the requirement.

GetDiscoveredResourceCounts: Discovering Resources

// init — grants config:GetDiscoveredResourceCounts
const getDiscoveredResourceCounts = yield* AWS.Config.GetDiscoveredResourceCounts();

// runtime
const result = yield* getDiscoveredResourceCounts();
console.log(result.totalDiscoveredResources, result.resourceCounts);

GetResourceConfigHistory

Source: src/AWS/Config/GetResourceConfigHistory.ts

Runtime binding for config:GetResourceConfigHistory — read the list of configuration items (change history) AWS Config recorded for a resource, newest first.

Provide Config.GetResourceConfigHistoryHttp on the hosting Lambda Function to satisfy the requirement.

GetResourceConfigHistory: Reading Resource Configurations

// init — grants config:GetResourceConfigHistory
const getResourceConfigHistory = yield* AWS.Config.GetResourceConfigHistory();

// runtime
const result = yield* getResourceConfigHistory({
  resourceType: "AWS::S3::Bucket",
  resourceId: "my-bucket",
  limit: 10,
});
console.log(result.configurationItems?.length);

GetResourceEvaluationSummary

Source: src/AWS/Config/GetResourceEvaluationSummary.ts

Runtime binding for config:GetResourceEvaluationSummary — read the status and compliance verdict of a proactive resource evaluation started with StartResourceEvaluation.

Provide Config.GetResourceEvaluationSummaryHttp on the hosting Lambda Function to satisfy the requirement.

GetResourceEvaluationSummary: Proactive Resource Evaluation

// init — grants config:GetResourceEvaluationSummary
const getResourceEvaluationSummary = yield* AWS.Config.GetResourceEvaluationSummary();

// runtime
const result = yield* getResourceEvaluationSummary({
  ResourceEvaluationId: evaluationId,
});
console.log(result.EvaluationStatus?.Status, result.Compliance);

ListDiscoveredResources

Source: src/AWS/Config/ListDiscoveredResources.ts

Runtime binding for config:ListDiscoveredResources — enumerate the resource identifiers (type, id, name) AWS Config has discovered for a resource type, including optionally deleted resources.

Provide Config.ListDiscoveredResourcesHttp on the hosting Lambda Function to satisfy the requirement.

ListDiscoveredResources: Discovering Resources

// init — grants config:ListDiscoveredResources
const listDiscoveredResources = yield* AWS.Config.ListDiscoveredResources();

// runtime
const result = yield* listDiscoveredResources({
  resourceType: "AWS::S3::Bucket",
});
console.log(result.resourceIdentifiers);

ListResourceEvaluations

Source: src/AWS/Config/ListResourceEvaluations.ts

Runtime binding for config:ListResourceEvaluations — enumerate the proactive resource evaluations run in the account, optionally filtered by evaluation mode and time window.

Provide Config.ListResourceEvaluationsHttp on the hosting Lambda Function to satisfy the requirement.

ListResourceEvaluations: Proactive Resource Evaluation

// init — grants config:ListResourceEvaluations
const listResourceEvaluations = yield* AWS.Config.ListResourceEvaluations();

// runtime
const result = yield* listResourceEvaluations({
  Filters: { EvaluationMode: "PROACTIVE" },
});
console.log(result.ResourceEvaluations);

PutEvaluations

Source: src/AWS/Config/PutEvaluations.ts

Runtime binding for config:PutEvaluations — report evaluation results to AWS Config from inside a custom Config rule’s Lambda function, using the resultToken the rule invocation delivered.

Provide Config.PutEvaluationsHttp on the hosting Lambda Function to satisfy the requirement.

PutEvaluations: Reporting Evaluations (Custom Rules)

// init — grants config:PutEvaluations
const putEvaluations = yield* AWS.Config.PutEvaluations();

// runtime
const result = yield* putEvaluations({
  ResultToken: event.resultToken,
  Evaluations: [
    {
      ComplianceResourceType: "AWS::S3::Bucket",
      ComplianceResourceId: "my-bucket",
      ComplianceType: "COMPLIANT",
      OrderingTimestamp: new Date(),
    },
  ],
});
console.log(result.FailedEvaluations);

PutExternalEvaluation

Source: src/AWS/Config/PutExternalEvaluation.ts

Runtime binding for config:PutExternalEvaluation — push an externally computed compliance verdict for one resource into the bound ConfigRule (the rule must use the external evaluation mode); the rule name is injected automatically.

Provide Config.PutExternalEvaluationHttp on the hosting Lambda Function to satisfy the requirement.

PutExternalEvaluation: Reporting Evaluations (Custom Rules)

// init — grants config:PutExternalEvaluation
const putExternalEvaluation = yield* AWS.Config.PutExternalEvaluation(rule);

// runtime
yield* putExternalEvaluation({
  ExternalEvaluation: {
    ComplianceResourceType: "AWS::S3::Bucket",
    ComplianceResourceId: "my-bucket",
    ComplianceType: "COMPLIANT",
    OrderingTimestamp: new Date(),
  },
});

PutResourceConfig

Source: src/AWS/Config/PutResourceConfig.ts

Runtime binding for config:PutResourceConfig — record the configuration item of a custom (third-party) resource type with AWS Config, e.g. MyCompany::Service::Widget.

Provide Config.PutResourceConfigHttp on the hosting Lambda Function to satisfy the requirement.

PutResourceConfig: Recording Custom Resources

// init — grants config:PutResourceConfig
const putResourceConfig = yield* AWS.Config.PutResourceConfig();

// runtime
yield* putResourceConfig({
  ResourceType: "MyCompany::Service::Widget",
  SchemaVersionId: "1.0",
  ResourceId: "widget-1",
  Configuration: JSON.stringify({ color: "teal" }),
});

RetentionConfiguration

Source: src/AWS/Config/RetentionConfiguration.ts

The AWS Config retention configuration that controls how long AWS Config retains your recorded configuration items.

AWS allows only one retention configuration per account per region and always names it default — treat this resource as an account-region singleton.

RetentionConfiguration: Configuring Retention

Retain configuration items for one year

import * as Config from "alchemy/AWS/Config";

const retention = yield* Config.RetentionConfiguration("Retention", {
  retentionPeriod: "365 days",
});

Minimum retention

const retention = yield* Config.RetentionConfiguration("Retention", {
  retentionPeriod: "30 days",
});

SelectResourceConfig

Source: src/AWS/Config/SelectResourceConfig.ts

Runtime binding for config:SelectResourceConfig — run a SQL SELECT query (AWS Config advanced query) against the current configuration state of recorded resources.

Provide Config.SelectResourceConfigHttp on the hosting Lambda Function to satisfy the requirement.

SelectResourceConfig: Querying with SQL

// init — grants config:SelectResourceConfig
const selectResourceConfig = yield* AWS.Config.SelectResourceConfig();

// runtime
const result = yield* selectResourceConfig({
  Expression:
    "SELECT resourceId WHERE resourceType = 'AWS::S3::Bucket'",
});
console.log(result.Results);

StartConfigRulesEvaluation

Source: src/AWS/Config/StartConfigRulesEvaluation.ts

Runtime binding for config:StartConfigRulesEvaluation — run an on-demand evaluation of the bound ConfigRule against the last known configuration state of your resources; the rule name is injected automatically.

Provide Config.StartConfigRulesEvaluationHttp on the hosting Lambda Function to satisfy the requirement.

StartConfigRulesEvaluation: Rule Evaluation Status

// init — grants config:StartConfigRulesEvaluation
const startRulesEvaluation =
  yield* AWS.Config.StartConfigRulesEvaluation(rule);

// runtime
yield* startRulesEvaluation();

StartResourceEvaluation

Source: src/AWS/Config/StartResourceEvaluation.ts

Runtime binding for config:StartResourceEvaluation — proactively evaluate a hypothetical resource configuration against your PROACTIVE Config rules before the resource is deployed.

Provide Config.StartResourceEvaluationHttp on the hosting Lambda Function to satisfy the requirement.

StartResourceEvaluation: Proactive Resource Evaluation

// init — grants config:StartResourceEvaluation
const startResourceEvaluation = yield* AWS.Config.StartResourceEvaluation();

// runtime
const result = yield* startResourceEvaluation({
  EvaluationMode: "PROACTIVE",
  ResourceDetails: {
    ResourceId: "my-bucket",
    ResourceType: "AWS::S3::Bucket",
    ResourceConfiguration: JSON.stringify({
      BucketName: "my-bucket",
    }),
    ResourceConfigurationSchemaType: "CFN_RESOURCE_SCHEMA",
  },
});
console.log(result.ResourceEvaluationId);