organization_conformance_packs

Creates, updates, deletes or gets an organization_conformance_pack resource or lists organization_conformance_packs in a region

Overview

Name	organization_conformance_packs
Type	Resource
Description	Resource schema for AWS::Config::OrganizationConformancePack.
Id	aws.config.organization_conformance_packs

Fields

Name	Datatype	Description
organization_conformance_pack_name	string	The name of the organization conformance pack.
template_s3_uri	string	Location of file containing the template body.
template_body	string	A string containing full conformance pack template body.
delivery_s3_bucket	string	AWS Config stores intermediate files while processing conformance pack template.
delivery_s3_key_prefix	string	The prefix for the delivery S3 bucket.
conformance_pack_input_parameters	array	A list of ConformancePackInputParameter objects.
excluded_accounts	array	A list of AWS accounts to be excluded from an organization conformance pack while deploying a conformance pack.
region	string	AWS region.

Methods

Name	Accessible by	Required Params
create_resource	INSERT	OrganizationConformancePackName, region
delete_resource	DELETE	data__Identifier, region
update_resource	UPDATE	data__Identifier, data__PatchDocument, region
list_resources	SELECT	region
get_resource	SELECT	data__Identifier, region

SELECT examples

Gets all organization_conformance_packs in a region.

SELECT
region,
organization_conformance_pack_name,
template_s3_uri,
template_body,
delivery_s3_bucket,
delivery_s3_key_prefix,
conformance_pack_input_parameters,
excluded_accounts
FROM aws.config.organization_conformance_packs
WHERE region = 'us-east-1';

Gets all properties from an individual organization_conformance_pack.

SELECT
region,
organization_conformance_pack_name,
template_s3_uri,
template_body,
delivery_s3_bucket,
delivery_s3_key_prefix,
conformance_pack_input_parameters,
excluded_accounts
FROM aws.config.organization_conformance_packs
WHERE region = 'us-east-1' AND data__Identifier = '<OrganizationConformancePackName>';

INSERT example

Use the following StackQL query and manifest file to create a new organization_conformance_pack resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO aws.config.organization_conformance_packs (
 OrganizationConformancePackName,
 region
)
SELECT 
'{{ OrganizationConformancePackName }}',
'{{ region }}';

All Properties

/*+ create */
INSERT INTO aws.config.organization_conformance_packs (
 OrganizationConformancePackName,
 TemplateS3Uri,
 TemplateBody,
 DeliveryS3Bucket,
 DeliveryS3KeyPrefix,
 ConformancePackInputParameters,
 ExcludedAccounts,
 region
)
SELECT 
 '{{ OrganizationConformancePackName }}',
 '{{ TemplateS3Uri }}',
 '{{ TemplateBody }}',
 '{{ DeliveryS3Bucket }}',
 '{{ DeliveryS3KeyPrefix }}',
 '{{ ConformancePackInputParameters }}',
 '{{ ExcludedAccounts }}',
 '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: organization_conformance_pack
    props:
      - name: OrganizationConformancePackName
        value: '{{ OrganizationConformancePackName }}'
      - name: TemplateS3Uri
        value: '{{ TemplateS3Uri }}'
      - name: TemplateBody
        value: '{{ TemplateBody }}'
      - name: DeliveryS3Bucket
        value: '{{ DeliveryS3Bucket }}'
      - name: DeliveryS3KeyPrefix
        value: '{{ DeliveryS3KeyPrefix }}'
      - name: ConformancePackInputParameters
        value:
          - ParameterName: '{{ ParameterName }}'
            ParameterValue: '{{ ParameterValue }}'
      - name: ExcludedAccounts
        value:
          - '{{ ExcludedAccounts[0] }}'

DELETE example

/*+ delete */
DELETE FROM aws.config.organization_conformance_packs
WHERE data__Identifier = '<OrganizationConformancePackName>'
AND region = 'us-east-1';

Permissions

To operate on the organization_conformance_packs resource, the following permissions are required:

Create

config:PutOrganizationConformancePack,
config:DescribeOrganizationConformancePackStatuses,
config:GetOrganizationConformancePackDetailedStatus,
config:DescribeOrganizationConformancePacks,
s3:GetObject,
s3:GetBucketAcl,
iam:CreateServiceLinkedRole,
iam:PassRole,
organizations:ListDelegatedAdministrators,
organizations:EnableAWSServiceAccess

Read

config:DescribeOrganizationConformancePacks

Delete

config:DeleteOrganizationConformancePack,
config:DescribeOrganizationConformancePackStatuses,
config:GetOrganizationConformancePackDetailedStatus,
organizations:ListDelegatedAdministrators

Update

config:PutOrganizationConformancePack,
config:DescribeOrganizationConformancePackStatuses,
config:GetOrganizationConformancePackDetailedStatus,
s3:GetObject,
s3:GetBucketAcl,
iam:CreateServiceLinkedRole,
iam:PassRole,
organizations:ListDelegatedAdministrators,
organizations:EnableAWSServiceAccess

List

config:DescribeOrganizationConformancePacks