@turbot/aws-config

The aws-config mod contains resource, control and policy definitions for AWS Config service.

Resource Types

Resource types covered by this mod:

Permissions

Taking a look at permissions and associated grant levels for each permission for Config:

Permission	Grant Level	Help
config:BatchGetAggregateResourceConfig	Metadata
config:BatchGetResourceConfig	Metadata
config:DeleteAggregationAuthorization	Admin	It deletes the authorization granted to the specified configuration aggregator account in a specified region. It is a cross-account permission.
config:DeleteConfigRule	Admin	Admin can delete the specified AWS Config rule and all of its evaluation results.
config:DeleteConfigurationAggregator	Admin
config:DeleteConfigurationRecorder	Admin	Admins manage configuration recorder settings.
config:DeleteConformancePack	Admin
config:DeleteDeliveryChannel	Admin	Admins manage delivery channel settings.
config:DeleteEvaluationResults	Admin
config:DeleteOrganizationConfigRule	Admin
config:DeleteOrganizationConformancePack	Admin
config:DeletePendingAggregationRequest	Admin
config:DeleteRemediationConfiguration	Admin
config:DeleteRemediationExceptions	Admin
config:DeleteResourceConfig	Admin
config:DeleteRetentionConfiguration	Admin
config:DeliverConfigSnapshot	Operator	Operators can schedule config snapshot deliveries to S3.
config:DescribeAggregateComplianceByConfigRules	Metadata
config:DescribeAggregationAuthorizations	Metadata
config:DescribeComplianceByConfigRule	Metadata	Metadata about config rules and resources; allow Metadata to Describe rules.
config:DescribeComplianceByResource	Metadata	Metadata about config rules and resources; allow Metadata to Describe rules.
config:DescribeConfigRuleEvaluationStatus	Metadata	Metadata about config rules and resources; allow Metadata to Describe rules.
config:DescribeConfigRules	Metadata	Metadata about config rules and resources; allow Metadata to Describe rules.
config:DescribeConfigurationAggregatorSourcesStatus	Metadata
config:DescribeConfigurationAggregators	Metadata
config:DescribeConfigurationRecorderStatus	Metadata	Metadata about config settings; allow Metadata to Describe these settings.
config:DescribeConfigurationRecorders	Metadata	Metadata about config settings; allow Metadata to Describe these settings.
config:DescribeConformancePackCompliance	Metadata
config:DescribeConformancePackStatus	Metadata
config:DescribeConformancePacks	Metadata
config:DescribeDeliveryChannelStatus	Metadata	Metadata about config settings; allow Metadata to Describe these settings.
config:DescribeDeliveryChannels	Metadata	Metadata about config settings; allow Metadata to Describe these settings.
config:DescribeOrganizationConfigRuleStatuses	Metadata
config:DescribeOrganizationConfigRules	Metadata
config:DescribeOrganizationConformancePackStatuses	Metadata
config:DescribeOrganizationConformancePacks	Metadata
config:DescribePendingAggregationRequests	Metadata
config:DescribeRemediationConfigurations	Metadata
config:DescribeRemediationExceptions	Metadata
config:DescribeRemediationExecutionStatus	Metadata
config:DescribeRetentionConfigurations	Metadata
config:GetAggregateComplianceDetailsByConfigRule	Metadata
config:GetAggregateConfigRuleComplianceSummary	Metadata
config:GetAggregateDiscoveredResourceCounts	Metadata
config:GetAggregateResourceConfig	Metadata
config:GetComplianceDetailsByConfigRule	Metadata	Metadata about config rules and resources; allow Metadata to Get rules.
config:GetComplianceDetailsByResource	Metadata	Metadata about config rules and resources; allow Metadata to Get rules.
config:GetComplianceSummaryByConfigRule	Metadata	Metadata about config rules and resources; allow Metadata to Get rules.
config:GetComplianceSummaryByResourceType	Metadata	Metadata about config rules and resources; allow Metadata to Get rules.
config:GetConformancePackComplianceDetails	Metadata
config:GetConformancePackComplianceSummary	Metadata
config:GetDiscoveredResourceCounts	Metadata	Metadata about the number of each resource type and the total number of resources that AWS Config is recording in this region for your AWS account.
config:GetOrganizationConfigRuleDetailedStatus	Metadata
config:GetOrganizationConformancePackDetailedStatus	Metadata
config:GetResourceConfigHistory	Metadata	AWS config is only metadata about resources; allow Metadata to Get data.
config:GetResources	Metadata	AWS config is only metadata about resources; allow Metadata to Get data.
config:GetTagKeys	Metadata	AWS config is only metadata about resources; allow Metadata to Get data.
config:ListAggregateDiscoveredResources	Metadata
config:ListDiscoveredResources	Metadata	AWS config is only metadata about resources; allow Metadata to Get data.
config:ListTagsForResource	Metadata
config:PutAggregationAuthorization	Admin	It authorizes the aggregator account and region to collect data from the source account and region.
config:PutConfigRule	Admin	Admin can add or update an AWS Config rule for evaluating whether your AWS resources comply with desired configurations.
config:PutConfigurationAggregator	Admin
config:PutConfigurationRecorder	Admin	Admins manage config recorder settings.
config:PutConformancePack	Admin
config:PutDeliveryChannel	Admin	Admins manage delivery channel settings.
config:PutEvaluations	Operator
config:PutOrganizationConfigRule	Admin
config:PutOrganizationConformancePack	Admin
config:PutRemediationConfigurations	Admin
config:PutRemediationExceptions	Admin
config:PutResourceConfig	Admin
config:PutRetentionConfiguration	Admin	Creates and updates the retention configuration with details about retention period that AWS Config stores your historical information.
config:SelectResourceConfig	Metadata
config:StartConfigRulesEvaluation	Operator	Operator can run an on-demand evaluation for the specified Config rules against the last known configuration state of the resources.
config:StartConfigurationRecorder	Operator	Operators can start config recorders across regions.
config:StartRemediationExecution	Admin
config:StopConfigurationRecorder	Operator	Operators can stop config recorders across regions.
config:TagResource	Operator
config:UntagResource	Operator
iam:ListRoles	Metadata
iam:PassRole	Admin	"Admins need 'iam:PassRole' to attach the applicable service role for Config settings."

Learn More About Guardrails

Recommended Version

Version

5.8.0

Released On

Sep 01, 2023

Depends On

@turbot/aws ^5.0.0
@turbot/turbot ^5.22.0
@turbot/turbot-iam ^5.1.0
@turbot/aws-iam ^5.1.0

Resource Types

Control Types

Policy Types

Release Notes

5.8.0 (2023-09-01)

What's new?

Rebranded to a Turbot Guardrails Mod. To maintain compatibility, none of the existing resource types, control types or policy types have changed, your existing configurations and settings will continue to work as before.

Bug fixes

We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

Policy Types

Added

AWS > Config > Configuration Recorder > Approved > Custom
AWS > Config > Delivery Channel > Approved > Custom
AWS > Config > Rule > Approved > Custom

Action Types

Added

AWS > Config > Configuration Recorder > Skip alarm for Active control
AWS > Config > Configuration Recorder > Skip alarm for Active control [90 days]
AWS > Config > Configuration Recorder > Skip alarm for Approved control
AWS > Config > Configuration Recorder > Skip alarm for Approved control [90 days]
AWS > Config > Delivery Channel > Skip alarm for Active control
AWS > Config > Delivery Channel > Skip alarm for Active control [90 days]
AWS > Config > Delivery Channel > Skip alarm for Approved control
AWS > Config > Delivery Channel > Skip alarm for Approved control [90 days]
AWS > Config > Rule > Skip alarm for Active control
AWS > Config > Rule > Skip alarm for Active control [90 days]
AWS > Config > Rule > Skip alarm for Approved control
AWS > Config > Rule > Skip alarm for Approved control [90 days]

5.7.0 (2021-07-09)

What's new?

We've improved the details tables in the Tags controls to be more helpful, especially when a resource's tags are not set correctly as expected. Previously, to understand why the Tags controls were in an Alarm state, you would need to find and read the control's process logs. This felt like too much work for a simple task, so now these details are visible directly from the control page.

5.6.0 (2021-06-22)

What's new?

AWS/Config/Admin now includes conformance pack, organization config rule, and remediation permissions.

Bug fixes

We've made improvements to GraphQL queries in the AWS > Config > Configuration Recording > Source policy. You won’t notice any difference, but the policy should run lighter and quicker than before.

5.5.1 (2021-01-26)

Bug fixes

Controls run faster now when in the tbd and skipped states thanks to the new Guardrails Precheck feature (not to be confused with TSA PreCheck). With Guardrails Precheck, controls avoid running GraphQL input queries when in tbd and skipped, resulting in faster and lighter control runs.

5.5.0 (2020-09-18)

What's new?

Discovery controls now have their own control category, CMDB > Discovery, to allow for easier filtering separately from other CMDB controls.
We've renamed the service's default regions policy from Regions [Default] to Regions to be consistent with our other regions policies.

Bug fixes

We've made some improvements to our real-time event handling that reduces the risk of creating resources in CMDB with malformed AKAs. There's no noticeable difference, but things should run more reliably now.

5.4.2 (2020-08-17)

Bug fixes

In various Active controls, we were outputting log messages that did not properly show how many days were left until we'd delete the inactive resources (we were still deleting them after the correct number of days). These log messages have been fixed and now contain the correct number of days.

5.4.1 (2020-07-21)

Bug fixes

The EventBridge rules created to capture AWS Config events did not include any configuration recorder events, even if AWS > Config > Configuration Recorder > CMDB was set to Enforce: Enabled. This has been fixed.

5.4.0 (2020-07-17)

What's new?

We’ve improved our event handling configuration and now filter which AWS events Guardrails listens for based on resources’ CMDB policies. If a resource’s CMDB policy is not set to Enforce: Enabled, the EventBridge rules will be configured to not send any events for that resource. This will greatly reduce the amount of unnecessary events that Guardrails listens for and handles today.

Policy Types

Added

AWS > Turbot > Event Handlers > Events > Rules > Custom Event Patterns > @turbot/aws-config

Removed

AWS > Turbot > Event Handlers > Events > Rules > Event Sources > @turbot/aws-config

5.3.4 (2020-07-09)

Bug fixes

The IAM role ARN in the default value for the AWS > Config > Configuration Recording > Configuration Recorder > Role policy was not being calculated correctly for GovCloud and AWS China accounts. This issue has been fixed.

5.3.3 (2020-07-07)

Bug fixes

Using an S3 bucket in the AWS > Config > Configuration Recording > Delivery Channel > S3 Bucket policy that did not exist in the CMDB would cause the AWS > Config > Configuration Recording control to remain stuck in invalid state. We have removed this check to support using S3 buckets in AWS accounts that are not managed in the same workspace.
We've fixed an issue which caused all of the configuration recorders created by the AWS > Config > Configuration Recording control to be disabled by default. This occurred due to the AWS > Config > Configuration Recording > Enabled policy not being properly integrated with the control. This has been fixed and the control now uses the policy to correctly determine if the configuration recorders should be enabled or disabled.

Control Types

Renamed

AWS > Config > Configuration Recorder > Configuration Recording to AWS > Config > Configuration Recording

5.3.2 (2020-06-30)

Bug fixes

Sometimes when updating CMDB for resources with tags that have empty string values, e.g., [{Key: "Empty", Value: ""}, {Key: "Guardrails is great", Value: "true"}], we would not store all of the tags correctly. This has been fixed and now all tags are accounted for.

5.3.1 (2020-06-26)

Bug fixes

Due to invalid terraform mapping, delivery channels created by AWS > Config > Configuration Recorder > Configuration Recording Stack, got upserted into the database with invalid AKA (missing resource name). This issue has now been fixed. Delivery Channels with invalid AKA can be deleted by setting AWS > Guardrails > Resource AKA Migration policy to Enforce: Migrated.

5.3.0 (2020-06-01)

What's new?

Updated AWS > Config > Regions policy default value to now include eu-south-1.

Bug fixes

Links to documentation in the descriptions for several controls and policies were broken. These links have now been fixed.

Policy Types

Added

AWS > Config > Configuration Recorder > Configured
AWS > Config > Configuration Recorder > Configured > Claim Precedence
AWS > Config > Configuration Recorder > Configured > Source

Renamed

AWS > Config > Delivery Channel > Configured > Precedence to AWS > Config > Delivery Channel > Configured > Claim Precedence

5.2.0 (2020-05-08)

What's new?

Updated AWS > Config > Regions policy default value to now include af-south-1.

Bug fixes

Several permissions did not have grant levels assigned, so when this service was enabled, the IAM permission model would be unable to calculate the full permission set across all services. The missing grant levels have been added and permission calculations are now running smoothly again.