Checks whether the active access keys are rotated within the number of days specified in `maxAge`.

AccessKeysRotated

The maximum number of days within which the access keys must be rotated.

maxAge

configRuleName

A description about this AWS Config rule.

description

The modes the AWS Config rule can be evaluated in.

The valid values are distinct objects.

evaluationModes

Input parameter values that are passed to the AWS Config rule.

inputParameters

The maximum frequency at which the AWS Config rule runs evaluations.

maximumExecutionFrequency

Defines which resources trigger an evaluation for an AWS Config rule.

ruleScope

Checks whether your CloudFormation stacks' actual configuration differs, or has drifted, from its expected configuration.

CloudFormationStackDriftDetectionCheck

Whether to check only the stack where this rule is deployed.

ownStackOnly

The IAM role to use for this rule.

It must have permissions to detect drift
for AWS CloudFormation stacks. Ensure to attach `config.amazonaws.com` trusted
permissions and `ReadOnlyAccess` policy permissions. For specific policy permissions,
refer to https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html.

role

Checks whether your CloudFormation stacks are sending event notifications to a SNS topic.

Optionally checks whether specified SNS topics are used.

CloudFormationStackNotificationCheck

A list of allowed topics.

At most 5 topics.

topics

Defines an EventBridge event rule which triggers for rule compliance events.

onComplianceChange

Defines an EventBridge event rule which triggers for rule events.

Use
`rule.addEventPattern(pattern)` to specify a filter.

onEvent

Defines an EventBridge event rule which triggers for rule re-evaluation status events.

onReEvaluationStatus

CustomPolicy

The policy definition containing the logic for your AWS Config Custom Policy rule.

policyText

The boolean expression for enabling debug logging for your AWS Config Custom Policy rule.

enableDebugLog

CustomRule

lambdaFunction

Whether to run the rule on configuration changes.

configurationChanges

Whether to run the rule on a fixed frequency.

periodic

ManagedRule

identifier

An object that represents the authorizations granted to aggregator accounts and regions.

CfnAggregationAuthorization

The 12-digit account ID of the account authorized to aggregate data.

authorizedAccountId

The region authorized to collect aggregated data.

authorizedAwsRegion

CfnConfigRule

Provides the rule owner ( `AWS` for managed rules, `CUSTOM_POLICY` for Custom Policy rules, and `CUSTOM_LAMBDA` for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.

source

Indicates whether an AWS resource or AWS Config rule is compliant and provides the number of contributors that affect the compliance.

compliance

A name for the AWS Config rule.

If you don't specify a name, CloudFormation generates a unique physical ID and uses that ID for the rule name. For more information, see [Name Type](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-name.html) .

The description that you provide for the AWS Config rule.

The modes the AWS Config rule can be evaluated in.

The valid values are distinct objects. By default, the value is Detective evaluation mode only.

A string, in JSON format, that is passed to the AWS Config rule Lambda function.

The maximum frequency with which AWS Config runs evaluations for a rule.

You can specify a value for `MaximumExecutionFrequency` when:

- You are using an AWS managed rule that is triggered at a periodic frequency.
- Your custom rule is triggered when AWS Config delivers the configuration snapshot. For more information, see [ConfigSnapshotDeliveryProperties](https://docs.aws.amazon.com/config/latest/APIReference/API_ConfigSnapshotDeliveryProperties.html) .

> By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the `MaximumExecutionFrequency` parameter.

Defines which resources can trigger an evaluation for the rule.

The scope can include one or more resource types, a combination of one resource type and one resource ID, or a combination of a tag key and value. Specify a scope to constrain the resources that can trigger an evaluation for the rule. If you do not specify a scope, evaluations are triggered when any resource in the recording group changes.

scope

The details about the configuration aggregator, including information about source accounts, regions, and metadata of the aggregator.

CfnConfigurationAggregator

Provides a list of source accounts and regions to be aggregated.

accountAggregationSources

configurationAggregatorName

Provides an organization and list of regions to be aggregated.

organizationAggregationSource

The `AWS::Config::ConfigurationRecorder` resource type describes the AWS resource types that AWS Config records for configuration changes.

The configuration recorder stores the configuration changes of the specified resources in your account as configuration items.

> To enable AWS Config , you must create a configuration recorder and a delivery channel.
>
> AWS Config uses the delivery channel to deliver the configuration changes to your Amazon S3 bucket or Amazon  topic. For more information, see [AWS::Config::DeliveryChannel](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-config-deliverychannel.html) .

AWS CloudFormation starts the recorder as soon as the delivery channel is available.

To stop the recorder and delete it, delete the configuration recorder from your stack. To stop the recorder without deleting it, call the [StopConfigurationRecorder](https://docs.aws.amazon.com/config/latest/APIReference/API_StopConfigurationRecorder.html) action of the AWS Config API directly.

For more information, see [Configuration Recorder](https://docs.aws.amazon.com/config/latest/developerguide/config-concepts.html#config-recorder) in the AWS Config Developer Guide.

CfnConfigurationRecorder

Amazon Resource Name (ARN) of the IAM role assumed by AWS Config and used by the configuration recorder.

For more information, see [Permissions for the IAM Role Assigned](https://docs.aws.amazon.com/config/latest/developerguide/iamrole-permissions.html) to AWS Config in the AWS Config Developer Guide.

> *Pre-existing AWS Config role*
>
> If you have used an AWS service that uses AWS Config , such as AWS Security Hub CSPM or AWS Control Tower , and an AWS Config role has already been created, make sure that the IAM role that you use when setting up AWS Config keeps the same minimum permissions as the already created AWS Config role. You must do this so that the other AWS service continues to run as expected.
>
> For example, if AWS Control Tower has an IAM role that allows AWS Config to read Amazon Simple Storage Service ( Amazon S3 ) objects, make sure that the same permissions are granted within the IAM role you use when setting up AWS Config . Otherwise, it may interfere with how AWS Control Tower operates. For more information about IAM roles for AWS Config , see [*Identity and Access Management for AWS Config*](https://docs.aws.amazon.com/config/latest/developerguide/security-iam.html) in the *AWS Config Developer Guide* .

roleArn

The name of the configuration recorder. AWS Config automatically assigns the name of "default" when creating the configuration recorder.

You cannot change the name of the configuration recorder after it has been created. To change the configuration recorder name, you must delete it and create a new configuration recorder with a new name.

name

Specifies which resource types AWS Config records for configuration changes.

> *High Number of AWS Config Evaluations*
>
> You may notice increased activity in your account during your initial month recording with AWS Config when compared to subsequent months. During the initial bootstrapping process, AWS Config runs evaluations on all the resources in your account that you have selected for AWS Config to record.
>
> If you are running ephemeral workloads, you may see increased activity from AWS Config as it records configuration changes associated with creating and deleting these temporary resources. An *ephemeral workload* is a temporary use of computing resources that are loaded and run when needed. Examples include Amazon Elastic Compute Cloud ( Amazon EC2 ) Spot Instances, Amazon EMR jobs, and AWS Auto Scaling . If you want to avoid the increased activity from running ephemeral workloads, you can run these types of workloads in a separate account with AWS Config turned off to avoid increased configuration recording and rule evaluations.

recordingGroup

Specifies the default recording frequency for the configuration recorder. AWS Config supports *Continuous recording* and *Daily recording* .

- Continuous recording allows you to record configuration changes continuously whenever a change occurs.
- Daily recording allows you to receive a configuration item (CI) representing the most recent state of your resources over the last 24-hour period, only if it’s different from the previous CI recorded.

> *Some resource types require continuous recording*
>
> AWS Firewall Manager depends on continuous recording to monitor your resources. If you are using Firewall Manager, it is recommended that you set the recording frequency to Continuous.

You can also override the recording frequency for specific resource types.

recordingMode

A conformance pack is a collection of AWS Config rules and remediation actions that can be easily deployed in an account and a region.

ConformancePack creates a service linked role in your account. The service linked role is created only when the role does not exist in your account.

CfnConformancePack

Name of the conformance pack you want to create.

conformancePackName

A list of ConformancePackInputParameter objects.

conformancePackInputParameters

The name of the Amazon S3 bucket where AWS Config stores conformance pack templates.

deliveryS3Bucket

deliveryS3KeyPrefix

A string containing full conformance pack template body.

Structure containing the template body with a minimum length of 1 byte and a maximum length of 51,200 bytes.

> You can only use a YAML template with two resource types: config rule ( `AWS::Config::ConfigRule` ) and a remediation action ( `AWS::Config::RemediationConfiguration` ).

templateBody

Location of file containing the template body (s3://bucketname/prefix).

The uri must point to the conformance pack template (max size: 300 KB) that is located in an Amazon S3 bucket.

> You must have access to read Amazon S3 bucket.

templateS3Uri

An object that contains the name or Amazon Resource Name (ARN) of the AWS Systems Manager document (SSM document) and the version of the SSM document that is used to create a conformance pack.

templateSsmDocumentDetails

Specifies a delivery channel object to deliver configuration information to an Amazon S3 bucket and Amazon  topic.

Before you can create a delivery channel, you must create a configuration recorder. You can use this action to change the Amazon S3 bucket or an Amazon  topic of the existing delivery channel. To change the Amazon S3 bucket or an Amazon  topic, call this action and specify the changed values for the S3 bucket and the SNS topic. If you specify a different value for either the S3 bucket or the SNS topic, this action will keep the existing value for the parameter that is not changed.

> In the China (Beijing) Region, when you call this action, the Amazon S3 bucket must also be in the China (Beijing) Region. In all the other regions, AWS Config supports cross-region and cross-account delivery channels.

You can have only one delivery channel per region per AWS account, and the delivery channel is required to use AWS Config .

> AWS Config does not support the delivery channel to an Amazon S3 bucket bucket where object lock is enabled. For more information, see [How S3 Object Lock works](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html) .

When you create the delivery channel, you can specify; how often AWS Config delivers configuration snapshots to your Amazon S3 bucket (for example, 24 hours), the S3 bucket to which AWS Config sends configuration snapshots and configuration history files, and the Amazon  topic to which AWS Config sends notifications about configuration changes, such as updated resources, AWS Config rule evaluations, and when AWS Config delivers the configuration snapshot to your S3 bucket. For more information, see [Deliver Configuration Items](https://docs.aws.amazon.com/config/latest/developerguide/how-does-config-work.html#delivery-channel) in the AWS Config Developer Guide.

> To enable AWS Config , you must create a configuration recorder and a delivery channel. If you want to create the resources separately, you must create a configuration recorder before you can create a delivery channel. AWS Config uses the configuration recorder to capture configuration changes to your resources. For more information, see [AWS::Config::ConfigurationRecorder](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-config-configurationrecorder.html) .

For more information, see [Managing the Delivery Channel](https://docs.aws.amazon.com/config/latest/developerguide/manage-delivery-channel.html) in the AWS Config Developer Guide.

CfnDeliveryChannel

The name of the Amazon S3 bucket to which AWS Config delivers configuration snapshots and configuration history files.

If you specify a bucket that belongs to another AWS account , that bucket must have policies that grant access permissions to AWS Config . For more information, see [Permissions for the Amazon S3 Bucket](https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-policy.html) in the *AWS Config Developer Guide* .

s3BucketName

The options for how often AWS Config delivers configuration snapshots to the Amazon S3 bucket.

configSnapshotDeliveryProperties

A name for the delivery channel.

If you don't specify a name, CloudFormation generates a unique physical ID and uses that ID for the delivery channel name. For more information, see [Name Type](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-name.html) .

Updates are not supported. To change the name, you must run two separate updates. In the first update, delete this resource, and then recreate it with a new name in the second update.

The prefix for the specified Amazon S3 bucket.

s3KeyPrefix

The Amazon Resource Name (ARN) of the AWS Key Management Service ( AWS  ) AWS KMS key (KMS key) used to encrypt objects delivered by AWS Config .

Must belong to the same Region as the destination S3 bucket.

s3KmsKeyArn

The Amazon Resource Name (ARN) of the Amazon SNS topic to which AWS Config sends notifications about configuration changes.

If you choose a topic from another account, the topic must have policies that grant access permissions to AWS Config . For more information, see [Permissions for the Amazon SNS Topic](https://docs.aws.amazon.com/config/latest/developerguide/sns-topic-policy.html) in the *AWS Config Developer Guide* .

snsTopicArn

Adds or updates an AWS Config rule for your entire organization to evaluate if your AWS resources comply with your desired configurations.

For information on how many organization AWS Config rules you can have per account, see [*Service Limits*](https://docs.aws.amazon.com/config/latest/developerguide/configlimits.html) in the *AWS Config Developer Guide* .

Only a management account and a delegated administrator can create or update an organization AWS Config rule. When calling the `OrganizationConfigRule` resource with a delegated administrator, you must ensure AWS Organizations `ListDelegatedAdministrator` permissions are added. An organization can have up to 3 delegated administrators.

The `OrganizationConfigRule` resource enables organization service access through the `EnableAWSServiceAccess` action and creates a service-linked role `AWSServiceRoleForConfigMultiAccountSetup` in the management or delegated administrator account of your organization. The service-linked role is created only when the role does not exist in the caller account. AWS Config verifies the existence of role with `GetRole` action.

To use the `OrganizationConfigRule` resource with delegated administrator, register a delegated administrator by calling AWS Organization `register-delegated-administrator` for `config-multiaccountsetup.amazonaws.com` .

There are two types of rules: *AWS Config Managed Rules* and *AWS Config Custom Rules* . You can use `PutOrganizationConfigRule` to create both AWS Config Managed Rules and AWS Config Custom Rules.

AWS Config Managed Rules are predefined, customizable rules created by AWS Config . For a list of managed rules, see [List of AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html) . If you are adding an AWS Config managed rule, you must specify the rule's identifier for the `RuleIdentifier` key.

AWS Config Custom Rules are rules that you create from scratch. There are two ways to create AWS Config custom rules: with Lambda functions ( [AWS Lambda Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/gettingstarted-concepts.html#gettingstarted-concepts-function) ) and with Guard ( [Guard GitHub Repository](https://docs.aws.amazon.com/https://github.com/aws-cloudformation/cloudformation-guard) ), a policy-as-code language. AWS Config custom rules created with AWS Lambda are called *AWS Config Custom Lambda Rules* and AWS Config custom rules created with Guard are called *AWS Config Custom Policy Rules* .

If you are adding a new AWS Config Custom Lambda rule, you first need to create an AWS Lambda function in the management account or a delegated administrator that the rule invokes to evaluate your resources. You also need to create an IAM role in the managed account that can be assumed by the Lambda function. When you use `PutOrganizationConfigRule` to add a Custom Lambda rule to AWS Config , you must specify the Amazon Resource Name (ARN) that AWS Lambda assigns to the function.

CfnOrganizationConfigRule

The name that you assign to organization AWS Config rule.

organizationConfigRuleName

A comma-separated list of accounts excluded from organization AWS Config rule.

excludedAccounts

An object that specifies metadata for your organization's AWS Config Custom Policy rule.

The metadata includes the runtime system in use, which accounts have debug logging enabled, and other custom rule metadata, such as resource type, resource ID of AWS resource, and organization trigger types that initiate AWS Config to evaluate AWS resources against a rule.

organizationCustomPolicyRuleMetadata

An `OrganizationCustomRuleMetadata` object.

organizationCustomRuleMetadata

An `OrganizationManagedRuleMetadata` object.

organizationManagedRuleMetadata

OrganizationConformancePack deploys conformance packs across member accounts in an AWS Organizations .

OrganizationConformancePack enables organization service access for `config-multiaccountsetup.amazonaws.com` through the `EnableAWSServiceAccess` action and creates a service linked role in the master account of your organization. The service linked role is created only when the role does not exist in the master account.

CfnOrganizationConformancePack

The name you assign to an organization conformance pack.

organizationConformancePackName

A list of `ConformancePackInputParameter` objects.

The name of the Amazon S3 bucket where AWS Config stores conformance pack templates.

> This field is optional.

Any folder structure you want to add to an Amazon S3 bucket.

> This field is optional.

A comma-separated list of accounts excluded from organization conformance pack.

A string containing full conformance pack template body.

Structure containing the template body with a minimum length of 1 byte and a maximum length of 51,200 bytes.

Location of file containing the template body.

The uri must point to the conformance pack template (max size: 300 KB).

An object that represents the details about the remediation configuration that includes the remediation action, parameters, and data to execute the action.

CfnRemediationConfiguration

Target ID is the name of the SSM document.

targetId

The type of the target.

Target executes remediation. For example, SSM document.

targetType

The remediation is triggered automatically.

automatic

executionControls

The maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.

For example, if you specify MaximumAutomaticAttempts as 5 with RetryAttemptSeconds as 50 seconds, AWS Config will put a RemediationException on your behalf for the failing resource after the 5th failed attempt within 50 seconds.

maximumAutomaticAttempts

An object of the RemediationParameterValue. For more information, see [RemediationParameterValue](https://docs.aws.amazon.com/config/latest/APIReference/API_RemediationParameterValue.html) .

> The type is a map of strings to RemediationParameterValue.

parameters

resourceType

Time window to determine whether or not to add a remediation exception to prevent infinite remediation attempts.

If `MaximumAutomaticAttempts` remediation attempts have been made under `RetryAttemptSeconds` , a remediation exception will be added to the resource. If you do not select a number, the default is 60 seconds.

For example, if you specify `RetryAttemptSeconds` as 50 seconds and `MaximumAutomaticAttempts` as 5, AWS Config will run auto-remediations 5 times within 50 seconds before adding a remediation exception to the resource.

retryAttemptSeconds

Version of the target. For example, version of the SSM document.

> If you make backward incompatible changes to the SSM document, you must call PutRemediationConfiguration API again to ensure the remediations can run.

targetVersion

CfnStoredQuery

The expression of the query.

For example, `SELECT resourceId, resourceType, supplementaryConfiguration.BucketVersioningConfiguration.status WHERE resourceType = 'AWS::S3::Bucket' AND supplementaryConfiguration.BucketVersioningConfiguration.status = 'Off'.`

queryExpression

queryName

queryDescription

An array of key-value pairs to apply to this resource.

AWS Config

L2 Constructs6