amazonka-config-1.4.0: Amazon Config SDK.

Copyright(c) 2013-2016 Brendan Hay
LicenseMozilla Public License, v. 2.0.
MaintainerBrendan Hay <brendan.g.hay@gmail.com>
Stabilityauto-generated
Portabilitynon-portable (GHC extensions)
Safe HaskellNone
LanguageHaskell2010

Network.AWS.Config

Contents

Description

AWS Config

AWS Config provides a way to keep track of the configurations of all the AWS resources associated with your AWS account. You can use AWS Config to get the current and historical configurations of each AWS resource and also to get information about the relationship between the resources. An AWS resource can be an Amazon Compute Cloud (Amazon EC2) instance, an Elastic Block Store (EBS) volume, an Elastic network Interface (ENI), or a security group. For a complete list of resources currently supported by AWS Config, see Supported AWS Resources.

You can access and manage AWS Config through the AWS Management Console, the AWS Command Line Interface (AWS CLI), the AWS Config API, or the AWS SDKs for AWS Config

This reference guide contains documentation for the AWS Config API and the AWS CLI commands that you can use to manage AWS Config.

The AWS Config API uses the Signature Version 4 protocol for signing requests. For more information about how to sign a request with this protocol, see Signature Version 4 Signing Process.

For detailed information about AWS Config features and their associated actions or commands, as well as how to work with AWS Management Console, see What Is AWS Config? in the AWS Config Developer Guide.

Synopsis

Service Configuration

config :: Service Source

API version '2014-11-12' of the Amazon Config SDK configuration.

Errors

Error matchers are designed for use with the functions provided by Control.Exception.Lens. This allows catching (and rethrowing) service specific errors returned by Config.

InvalidTimeRangeException

_InvalidTimeRangeException :: AsError a => Getting (First ServiceError) a ServiceError Source

The specified time range is not valid. The earlier time is not chronologically before the later time.

InvalidSNSTopicARNException

_InvalidSNSTopicARNException :: AsError a => Getting (First ServiceError) a ServiceError Source

The specified Amazon SNS topic does not exist.

InvalidRecordingGroupException

_InvalidRecordingGroupException :: AsError a => Getting (First ServiceError) a ServiceError Source

AWS Config throws an exception if the recording group does not contain a valid list of resource types. Invalid values could also be incorrectly formatted.

ValidationException

_ValidationException :: AsError a => Getting (First ServiceError) a ServiceError Source

The requested action is not valid.

InvalidRoleException

_InvalidRoleException :: AsError a => Getting (First ServiceError) a ServiceError Source

You have provided a null or empty role ARN.

LastDeliveryChannelDeleteFailedException

_LastDeliveryChannelDeleteFailedException :: AsError a => Getting (First ServiceError) a ServiceError Source

You cannot delete the delivery channel you specified because the configuration recorder is running.

InvalidLimitException

_InvalidLimitException :: AsError a => Getting (First ServiceError) a ServiceError Source

The specified limit is outside the allowable range.

InvalidDeliveryChannelNameException

_InvalidDeliveryChannelNameException :: AsError a => Getting (First ServiceError) a ServiceError Source

The specified delivery channel name is not valid.

InvalidParameterValueException

_InvalidParameterValueException :: AsError a => Getting (First ServiceError) a ServiceError Source

One or more of the specified parameters are invalid. Verify that your parameters are valid and try again.

InvalidResultTokenException

_InvalidResultTokenException :: AsError a => Getting (First ServiceError) a ServiceError Source

The result token is invalid.

NoSuchDeliveryChannelException

_NoSuchDeliveryChannelException :: AsError a => Getting (First ServiceError) a ServiceError Source

You have specified a delivery channel that does not exist.

NoSuchConfigRuleException

_NoSuchConfigRuleException :: AsError a => Getting (First ServiceError) a ServiceError Source

One or more AWS Config rules in the request are invalid. Verify that the rule names are correct and try again.

InsufficientPermissionsException

_InsufficientPermissionsException :: AsError a => Getting (First ServiceError) a ServiceError Source

Indicates one of the following errors:

  • The rule cannot be created because the IAM role assigned to AWS Config lacks permissions to perform the config:Put* action.
  • The AWS Lambda function cannot be invoked. Check the function ARN, and check the function's permissions.

ResourceNotDiscoveredException

_ResourceNotDiscoveredException :: AsError a => Getting (First ServiceError) a ServiceError Source

You have specified a resource that is either unknown or has not been discovered.

InvalidNextTokenException

_InvalidNextTokenException :: AsError a => Getting (First ServiceError) a ServiceError Source

The specified next token is invalid. Specify the nextToken string that was returned in the previous response to get the next page of results.

MaxNumberOfConfigRulesExceededException

_MaxNumberOfConfigRulesExceededException :: AsError a => Getting (First ServiceError) a ServiceError Source

Failed to add the AWS Config rule because the account already contains the maximum number of 25 rules. Consider deleting any deactivated rules before adding new rules.

NoAvailableConfigurationRecorderException

_NoAvailableConfigurationRecorderException :: AsError a => Getting (First ServiceError) a ServiceError Source

There are no configuration recorders available to provide the role needed to describe your resources. Create a configuration recorder.

NoSuchBucketException

_NoSuchBucketException :: AsError a => Getting (First ServiceError) a ServiceError Source

The specified Amazon S3 bucket does not exist.

NoAvailableDeliveryChannelException

_NoAvailableDeliveryChannelException :: AsError a => Getting (First ServiceError) a ServiceError Source

There is no delivery channel available to record configurations.

InvalidConfigurationRecorderNameException

_InvalidConfigurationRecorderNameException :: AsError a => Getting (First ServiceError) a ServiceError Source

You have provided a configuration recorder name that is not valid.

NoRunningConfigurationRecorderException

_NoRunningConfigurationRecorderException :: AsError a => Getting (First ServiceError) a ServiceError Source

There is no configuration recorder running.

MaxNumberOfConfigurationRecordersExceededException

_MaxNumberOfConfigurationRecordersExceededException :: AsError a => Getting (First ServiceError) a ServiceError Source

You have reached the limit on the number of recorders you can create.

InsufficientDeliveryPolicyException

_InsufficientDeliveryPolicyException :: AsError a => Getting (First ServiceError) a ServiceError Source

Your Amazon S3 bucket policy does not permit AWS Config to write to it.

MaxNumberOfDeliveryChannelsExceededException

_MaxNumberOfDeliveryChannelsExceededException :: AsError a => Getting (First ServiceError) a ServiceError Source

You have reached the limit on the number of delivery channels you can create.

NoSuchConfigurationRecorderException

_NoSuchConfigurationRecorderException :: AsError a => Getting (First ServiceError) a ServiceError Source

You have specified a configuration recorder that does not exist.

InvalidS3KeyPrefixException

_InvalidS3KeyPrefixException :: AsError a => Getting (First ServiceError) a ServiceError Source

The specified Amazon S3 key prefix is not valid.

ResourceInUseException

_ResourceInUseException :: AsError a => Getting (First ServiceError) a ServiceError Source

The rule is currently being deleted. Wait for a while and try again.

Waiters

Waiters poll by repeatedly sending a request until some remote success condition configured by the Wait specification is fulfilled. The Wait specification determines how many attempts should be made, in addition to delay and retry strategies.

Operations

Some AWS operations return results that are incomplete and require subsequent requests in order to obtain the entire result set. The process of sending subsequent requests to continue where a previous request left off is called pagination. For example, the ListObjects operation of Amazon S3 returns up to 1000 objects at a time, and you must send subsequent requests with the appropriate Marker in order to retrieve the next page of results.

Operations that have an AWSPager instance can transparently perform subsequent requests, correctly setting Markers and other request facets to iterate through the entire result set of a truncated API operation. Operations which support this have an additional note in the documentation.

Many operations have the ability to filter results on the server side. See the individual operation parameters for details.

GetResourceConfigHistory

module Network.AWS.Config.GetResourceConfigHistory

DescribeComplianceByConfigRule

module Network.AWS.Config.DescribeComplianceByConfigRule

StopConfigurationRecorder

module Network.AWS.Config.StopConfigurationRecorder

DescribeConfigRules

module Network.AWS.Config.DescribeConfigRules

PutConfigRule

module Network.AWS.Config.PutConfigRule

DeleteConfigRule

module Network.AWS.Config.DeleteConfigRule

GetComplianceDetailsByResource

module Network.AWS.Config.GetComplianceDetailsByResource

DeliverConfigSnapshot

module Network.AWS.Config.DeliverConfigSnapshot

DescribeConfigRuleEvaluationStatus

module Network.AWS.Config.DescribeConfigRuleEvaluationStatus

DescribeComplianceByResource

module Network.AWS.Config.DescribeComplianceByResource

PutEvaluations

module Network.AWS.Config.PutEvaluations

DescribeConfigurationRecorders

module Network.AWS.Config.DescribeConfigurationRecorders

StartConfigurationRecorder

module Network.AWS.Config.StartConfigurationRecorder

GetComplianceSummaryByConfigRule

module Network.AWS.Config.GetComplianceSummaryByConfigRule

DescribeConfigurationRecorderStatus

module Network.AWS.Config.DescribeConfigurationRecorderStatus

PutConfigurationRecorder

module Network.AWS.Config.PutConfigurationRecorder

GetComplianceSummaryByResourceType

module Network.AWS.Config.GetComplianceSummaryByResourceType

DescribeDeliveryChannelStatus

module Network.AWS.Config.DescribeDeliveryChannelStatus

PutDeliveryChannel

module Network.AWS.Config.PutDeliveryChannel

GetComplianceDetailsByConfigRule

module Network.AWS.Config.GetComplianceDetailsByConfigRule

DeleteDeliveryChannel

module Network.AWS.Config.DeleteDeliveryChannel

ListDiscoveredResources

module Network.AWS.Config.ListDiscoveredResources

DescribeDeliveryChannels

module Network.AWS.Config.DescribeDeliveryChannels

Types

ChronologicalOrder

data ChronologicalOrder Source

Constructors

Forward 
Reverse 

Instances

ComplianceType

data ComplianceType Source

Constructors

Compliant 
InsufficientData 
NonCompliant 
NotApplicable 

Instances

ConfigRuleState

data ConfigRuleState Source

Constructors

Active 
Deleting 

Instances

ConfigurationItemStatus

data ConfigurationItemStatus Source

Constructors

Deleted 
Discovered 
Failed 
OK 

Instances

DeliveryStatus

data DeliveryStatus Source

Constructors

DSFailure 
DSNotApplicable 
DSSuccess 

Instances

EventSource

data EventSource Source

Constructors

AWS_Config 

Instances

MaximumExecutionFrequency

data MaximumExecutionFrequency Source

Constructors

OneHour 
SixHours 
ThreeHours 
TwelveHours 
TwentyFourHours 

Instances

MessageType

data MessageType Source

Constructors

ConfigurationItemChangeNotification 
ConfigurationSnapshotDeliveryCompleted 

Instances

Owner

data Owner Source

Constructors

AWS 
CustomLambda 

Instances

RecorderStatus

data RecorderStatus Source

Constructors

Failure 
Pending 
Success 

Instances

ResourceType

data ResourceType Source

Constructors

AWSCloudTrailTrail 
AWSEC2CustomerGateway 
AWSEC2EIP 
AWSEC2Host 
AWSEC2Instance 
AWSEC2InternetGateway 
AWSEC2NetworkACL 
AWSEC2NetworkInterface 
AWSEC2RouteTable 
AWSEC2SecurityGroup 
AWSEC2Subnet 
AWSEC2VPC 
AWSEC2VPNConnection 
AWSEC2VPNGateway 
AWSEC2Volume 
AWSIAMGroup 
AWSIAMPolicy 
AWSIAMRole 
AWSIAMUser 

Instances

Compliance

data Compliance Source

Indicates whether an AWS resource or AWS Config rule is compliant and provides the number of contributors that affect the compliance.

See: compliance smart constructor.

Instances

compliance :: Compliance Source

Creates a value of Compliance with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

cComplianceContributorCount :: Lens' Compliance (Maybe ComplianceContributorCount) Source

The number of AWS resources or AWS Config rules that cause a result of NON_COMPLIANT, up to a maximum number.

cComplianceType :: Lens' Compliance (Maybe ComplianceType) Source

Indicates whether an AWS resource or AWS Config rule is compliant.

A resource is compliant if it complies with all of the AWS Config rules that evaluate it, and it is noncompliant if it does not comply with one or more of these rules.

A rule is compliant if all of the resources that the rule evaluates comply with it, and it is noncompliant if any of these resources do not comply.

AWS Config returns the INSUFFICIENT_DATA value when no evaluation results are available for the AWS resource or Config rule.

For the Compliance data type, AWS Config supports only COMPLIANT, NON_COMPLIANT, and INSUFFICIENT_DATA values. AWS Config does not support the NOT_APPLICABLE value for the Compliance data type.

ComplianceByConfigRule

data ComplianceByConfigRule Source

Indicates whether an AWS Config rule is compliant. A rule is compliant if all of the resources that the rule evaluated comply with it, and it is noncompliant if any of these resources do not comply.

See: complianceByConfigRule smart constructor.

Instances

complianceByConfigRule :: ComplianceByConfigRule Source

Creates a value of ComplianceByConfigRule with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

cbcrCompliance :: Lens' ComplianceByConfigRule (Maybe Compliance) Source

Indicates whether the AWS Config rule is compliant.

cbcrConfigRuleName :: Lens' ComplianceByConfigRule (Maybe Text) Source

The name of the AWS Config rule.

ComplianceByResource

data ComplianceByResource Source

Indicates whether an AWS resource that is evaluated according to one or more AWS Config rules is compliant. A resource is compliant if it complies with all of the rules that evaluate it, and it is noncompliant if it does not comply with one or more of these rules.

See: complianceByResource smart constructor.

Instances

complianceByResource :: ComplianceByResource Source

Creates a value of ComplianceByResource with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

cbrResourceId :: Lens' ComplianceByResource (Maybe Text) Source

The ID of the AWS resource that was evaluated.

cbrResourceType :: Lens' ComplianceByResource (Maybe Text) Source

The type of the AWS resource that was evaluated.

cbrCompliance :: Lens' ComplianceByResource (Maybe Compliance) Source

Indicates whether the AWS resource complies with all of the AWS Config rules that evaluated it.

ComplianceContributorCount

data ComplianceContributorCount Source

The number of AWS resources or AWS Config rules responsible for the current compliance of the item, up to a maximum number.

See: complianceContributorCount smart constructor.

Instances

complianceContributorCount :: ComplianceContributorCount Source

Creates a value of ComplianceContributorCount with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

cccCappedCount :: Lens' ComplianceContributorCount (Maybe Int) Source

The number of AWS resources or AWS Config rules responsible for the current compliance of the item.

cccCapExceeded :: Lens' ComplianceContributorCount (Maybe Bool) Source

Indicates whether the maximum count is reached.

ComplianceSummary

data ComplianceSummary Source

The number of AWS Config rules or AWS resources that are compliant and noncompliant, up to a maximum.

See: complianceSummary smart constructor.

Instances

complianceSummary :: ComplianceSummary Source

Creates a value of ComplianceSummary with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

csComplianceSummaryTimestamp :: Lens' ComplianceSummary (Maybe UTCTime) Source

The time that AWS Config created the compliance summary.

csCompliantResourceCount :: Lens' ComplianceSummary (Maybe ComplianceContributorCount) Source

The number of AWS Config rules or AWS resources that are compliant, up to a maximum of 25 for rules and 100 for resources.

csNonCompliantResourceCount :: Lens' ComplianceSummary (Maybe ComplianceContributorCount) Source

The number of AWS Config rules or AWS resources that are noncompliant, up to a maximum of 25 for rules and 100 for resources.

ComplianceSummaryByResourceType

data ComplianceSummaryByResourceType Source

The number of AWS resources of a specific type that are compliant or noncompliant, up to a maximum of 100 for each compliance.

See: complianceSummaryByResourceType smart constructor.

Instances

complianceSummaryByResourceType :: ComplianceSummaryByResourceType Source

Creates a value of ComplianceSummaryByResourceType with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

csbrtResourceType :: Lens' ComplianceSummaryByResourceType (Maybe Text) Source

The type of AWS resource.

csbrtComplianceSummary :: Lens' ComplianceSummaryByResourceType (Maybe ComplianceSummary) Source

The number of AWS resources that are compliant or noncompliant, up to a maximum of 100 for each compliance.

ConfigExportDeliveryInfo

data ConfigExportDeliveryInfo Source

A list that contains the status of the delivery of either the snapshot or the configuration history to the specified Amazon S3 bucket.

See: configExportDeliveryInfo smart constructor.

Instances

configExportDeliveryInfo :: ConfigExportDeliveryInfo Source

Creates a value of ConfigExportDeliveryInfo with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

cediLastErrorCode :: Lens' ConfigExportDeliveryInfo (Maybe Text) Source

The error code from the last attempted delivery.

cediLastAttemptTime :: Lens' ConfigExportDeliveryInfo (Maybe UTCTime) Source

The time of the last attempted delivery.

cediLastSuccessfulTime :: Lens' ConfigExportDeliveryInfo (Maybe UTCTime) Source

The time of the last successful delivery.

cediLastStatus :: Lens' ConfigExportDeliveryInfo (Maybe DeliveryStatus) Source

Status of the last attempted delivery.

cediLastErrorMessage :: Lens' ConfigExportDeliveryInfo (Maybe Text) Source

The error message from the last attempted delivery.

cediNextDeliveryTime :: Lens' ConfigExportDeliveryInfo (Maybe UTCTime) Source

The time that the next delivery occurs.

ConfigRule

data ConfigRule Source

An AWS Lambda function that evaluates configuration items to assess whether your AWS resources comply with your desired configurations. This function can run when AWS Config detects a configuration change to an AWS resource, or when it delivers a configuration snapshot of the resources in the account.

For more information about developing and using AWS Config rules, see Evaluating AWS Resource Configurations with AWS Config in the AWS Config Developer Guide.

See: configRule smart constructor.

Instances

configRule Source

Arguments

:: Source

crSource

-> ConfigRule 

Creates a value of ConfigRule with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

crInputParameters :: Lens' ConfigRule (Maybe Text) Source

A string in JSON format that is passed to the AWS Config rule Lambda function.

crConfigRuleName :: Lens' ConfigRule (Maybe Text) Source

The name that you assign to the AWS Config rule. The name is required if you are adding a new rule.

crMaximumExecutionFrequency :: Lens' ConfigRule (Maybe MaximumExecutionFrequency) Source

The maximum frequency at which the AWS Config rule runs evaluations.

If your rule is periodic, meaning it runs an evaluation when AWS Config delivers a configuration snapshot, then it cannot run evaluations more frequently than AWS Config delivers the snapshots. For periodic rules, set the value of the MaximumExecutionFrequency key to be equal to or greater than the value of the deliveryFrequency key, which is part of ConfigSnapshotDeliveryProperties. To update the frequency with which AWS Config delivers your snapshots, use the PutDeliveryChannel action.

crConfigRuleId :: Lens' ConfigRule (Maybe Text) Source

The ID of the AWS Config rule.

crScope :: Lens' ConfigRule (Maybe Scope) Source

Defines which resources can trigger an evaluation for the rule. The scope can include one or more resource types, a combination of one resource type and one resource ID, or a combination of a tag key and value. Specify a scope to constrain the resources that can trigger an evaluation for the rule. If you do not specify a scope, evaluations are triggered when any resource in the recording group changes.

crConfigRuleState :: Lens' ConfigRule (Maybe ConfigRuleState) Source

Indicates whether the AWS Config rule is active or currently being deleted by AWS Config.

AWS Config sets the state of a rule to DELETING temporarily after you use the DeleteConfigRule request to delete the rule. After AWS Config finishes deleting a rule, the rule and all of its evaluations are erased and no longer available.

You cannot add a rule to AWS Config that has the state set to DELETING. If you want to delete a rule, you must use the DeleteConfigRule request.

crDescription :: Lens' ConfigRule (Maybe Text) Source

The description that you provide for the AWS Config rule.

crConfigRuleARN :: Lens' ConfigRule (Maybe Text) Source

The Amazon Resource Name (ARN) of the AWS Config rule.

crSource :: Lens' ConfigRule Source Source

Provides the rule owner (AWS or customer), the rule identifier, and the events that cause the function to evaluate your AWS resources.

ConfigRuleEvaluationStatus

data ConfigRuleEvaluationStatus Source

Status information for your AWS managed Config rules. The status includes information such as the last time the rule ran, the last time it failed, and the related error for the last failure.

This action does not return status information about customer managed Config rules.

See: configRuleEvaluationStatus smart constructor.

Instances

configRuleEvaluationStatus :: ConfigRuleEvaluationStatus Source

Creates a value of ConfigRuleEvaluationStatus with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

cresLastErrorCode :: Lens' ConfigRuleEvaluationStatus (Maybe Text) Source

The error code that AWS Config returned when the rule last failed.

cresLastFailedEvaluationTime :: Lens' ConfigRuleEvaluationStatus (Maybe UTCTime) Source

The time that AWS Config last failed to evaluate your AWS resources against the rule.

cresFirstActivatedTime :: Lens' ConfigRuleEvaluationStatus (Maybe UTCTime) Source

The time that you first activated the AWS Config rule.

cresLastSuccessfulEvaluationTime :: Lens' ConfigRuleEvaluationStatus (Maybe UTCTime) Source

The time that AWS Config last successfully evaluated your AWS resources against the rule.

cresConfigRuleName :: Lens' ConfigRuleEvaluationStatus (Maybe Text) Source

The name of the AWS Config rule.

cresLastErrorMessage :: Lens' ConfigRuleEvaluationStatus (Maybe Text) Source

The error message that AWS Config returned when the rule last failed.

cresConfigRuleId :: Lens' ConfigRuleEvaluationStatus (Maybe Text) Source

The ID of the AWS Config rule.

cresLastFailedInvocationTime :: Lens' ConfigRuleEvaluationStatus (Maybe UTCTime) Source

The time that AWS Config last failed to invoke the AWS Config rule to evaluate your AWS resources.

cresFirstEvaluationStarted :: Lens' ConfigRuleEvaluationStatus (Maybe Bool) Source

Indicates whether AWS Config has evaluated your resources against the rule at least once.

  • true - AWS Config has evaluated your AWS resources against the rule at least once.
  • false - AWS Config has not once finished evaluating your AWS resources against the rule.

cresLastSuccessfulInvocationTime :: Lens' ConfigRuleEvaluationStatus (Maybe UTCTime) Source

The time that AWS Config last successfully invoked the AWS Config rule to evaluate your AWS resources.

cresConfigRuleARN :: Lens' ConfigRuleEvaluationStatus (Maybe Text) Source

The Amazon Resource Name (ARN) of the AWS Config rule.

ConfigSnapshotDeliveryProperties

data ConfigSnapshotDeliveryProperties Source

Options for how AWS Config delivers configuration snapshots to the Amazon S3 bucket in your delivery channel.

See: configSnapshotDeliveryProperties smart constructor.

Instances

configSnapshotDeliveryProperties :: ConfigSnapshotDeliveryProperties Source

Creates a value of ConfigSnapshotDeliveryProperties with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

csdpDeliveryFrequency :: Lens' ConfigSnapshotDeliveryProperties (Maybe MaximumExecutionFrequency) Source

The frequency with which a AWS Config recurringly delivers configuration snapshots.

ConfigStreamDeliveryInfo

data ConfigStreamDeliveryInfo Source

A list that contains the status of the delivery of the configuration stream notification to the Amazon SNS topic.

See: configStreamDeliveryInfo smart constructor.

Instances

configStreamDeliveryInfo :: ConfigStreamDeliveryInfo Source

Creates a value of ConfigStreamDeliveryInfo with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

csdiLastErrorCode :: Lens' ConfigStreamDeliveryInfo (Maybe Text) Source

The error code from the last attempted delivery.

csdiLastStatusChangeTime :: Lens' ConfigStreamDeliveryInfo (Maybe UTCTime) Source

The time from the last status change.

csdiLastStatus :: Lens' ConfigStreamDeliveryInfo (Maybe DeliveryStatus) Source

Status of the last attempted delivery.

Note Providing an SNS topic on a DeliveryChannel for AWS Config is optional. If the SNS delivery is turned off, the last status will be Not_Applicable.

csdiLastErrorMessage :: Lens' ConfigStreamDeliveryInfo (Maybe Text) Source

The error message from the last attempted delivery.

ConfigurationItem

data ConfigurationItem Source

A list that contains detailed configurations of a specified resource.

Currently, the list does not contain information about non-AWS components (for example, applications on your Amazon EC2 instances).

See: configurationItem smart constructor.

Instances

configurationItem :: ConfigurationItem Source

Creates a value of ConfigurationItem with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

ciResourceId :: Lens' ConfigurationItem (Maybe Text) Source

The ID of the resource (for example., 'sg-xxxxxx').

ciResourceType :: Lens' ConfigurationItem (Maybe ResourceType) Source

The type of AWS resource.

ciConfigurationStateId :: Lens' ConfigurationItem (Maybe Text) Source

An identifier that indicates the ordering of the configuration items of a resource.

ciArn :: Lens' ConfigurationItem (Maybe Text) Source

The Amazon Resource Name (ARN) of the resource.

ciResourceName :: Lens' ConfigurationItem (Maybe Text) Source

The custom name of the resource, if available.

ciResourceCreationTime :: Lens' ConfigurationItem (Maybe UTCTime) Source

The time stamp when the resource was created.

ciConfigurationItemStatus :: Lens' ConfigurationItem (Maybe ConfigurationItemStatus) Source

The configuration item status.

ciConfigurationItemCaptureTime :: Lens' ConfigurationItem (Maybe UTCTime) Source

The time when the configuration recording was initiated.

ciAccountId :: Lens' ConfigurationItem (Maybe Text) Source

The 12 digit AWS account ID associated with the resource.

ciAvailabilityZone :: Lens' ConfigurationItem (Maybe Text) Source

The Availability Zone associated with the resource.

ciRelationships :: Lens' ConfigurationItem [Relationship] Source

A list of related AWS resources.

ciVersion :: Lens' ConfigurationItem (Maybe Text) Source

The version number of the resource configuration.

ciAwsRegion :: Lens' ConfigurationItem (Maybe Text) Source

The region where the resource resides.

ciRelatedEvents :: Lens' ConfigurationItem [Text] Source

A list of CloudTrail event IDs.

A populated field indicates that the current configuration was initiated by the events recorded in the CloudTrail log. For more information about CloudTrail, see What is AWS CloudTrail?.

An empty field indicates that the current configuration was not initiated by any event.

ciConfiguration :: Lens' ConfigurationItem (Maybe Text) Source

The description of the resource configuration.

ciConfigurationItemMD5Hash :: Lens' ConfigurationItem (Maybe Text) Source

Unique MD5 hash that represents the configuration item's state.

You can use MD5 hash to compare the states of two or more configuration items that are associated with the same resource.

ciTags :: Lens' ConfigurationItem (HashMap Text Text) Source

A mapping of key value tags associated with the resource.

ConfigurationRecorder

data ConfigurationRecorder Source

An object that represents the recording of configuration changes of an AWS resource.

See: configurationRecorder smart constructor.

Instances

configurationRecorder :: ConfigurationRecorder Source

Creates a value of ConfigurationRecorder with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

crName :: Lens' ConfigurationRecorder (Maybe Text) Source

The name of the recorder. By default, AWS Config automatically assigns the name "default" when creating the configuration recorder. You cannot change the assigned name.

crRecordingGroup :: Lens' ConfigurationRecorder (Maybe RecordingGroup) Source

Specifies the types of AWS resource for which AWS Config records configuration changes.

crRoleARN :: Lens' ConfigurationRecorder (Maybe Text) Source

Amazon Resource Name (ARN) of the IAM role used to describe the AWS resources associated with the account.

ConfigurationRecorderStatus

data ConfigurationRecorderStatus Source

The current status of the configuration recorder.

See: configurationRecorderStatus smart constructor.

Instances

configurationRecorderStatus :: ConfigurationRecorderStatus Source

Creates a value of ConfigurationRecorderStatus with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

crsLastErrorCode :: Lens' ConfigurationRecorderStatus (Maybe Text) Source

The error code indicating that the recording failed.

crsLastStopTime :: Lens' ConfigurationRecorderStatus (Maybe UTCTime) Source

The time the recorder was last stopped.

crsLastStatusChangeTime :: Lens' ConfigurationRecorderStatus (Maybe UTCTime) Source

The time when the status was last changed.

crsRecording :: Lens' ConfigurationRecorderStatus (Maybe Bool) Source

Specifies whether the recorder is currently recording or not.

crsLastStatus :: Lens' ConfigurationRecorderStatus (Maybe RecorderStatus) Source

The last (previous) status of the recorder.

crsLastErrorMessage :: Lens' ConfigurationRecorderStatus (Maybe Text) Source

The message indicating that the recording failed due to an error.

crsName :: Lens' ConfigurationRecorderStatus (Maybe Text) Source

The name of the configuration recorder.

crsLastStartTime :: Lens' ConfigurationRecorderStatus (Maybe UTCTime) Source

The time the recorder was last started.

DeliveryChannel

data DeliveryChannel Source

A logical container used for storing the configuration changes of an AWS resource.

See: deliveryChannel smart constructor.

Instances

deliveryChannel :: DeliveryChannel Source

Creates a value of DeliveryChannel with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

dcS3KeyPrefix :: Lens' DeliveryChannel (Maybe Text) Source

The prefix for the specified Amazon S3 bucket.

dcSnsTopicARN :: Lens' DeliveryChannel (Maybe Text) Source

The Amazon Resource Name (ARN) of the SNS topic that AWS Config delivers notifications to.

dcName :: Lens' DeliveryChannel (Maybe Text) Source

The name of the delivery channel. By default, AWS Config automatically assigns the name "default" when creating the delivery channel. You cannot change the assigned name.

dcConfigSnapshotDeliveryProperties :: Lens' DeliveryChannel (Maybe ConfigSnapshotDeliveryProperties) Source

Undocumented member.

dcS3BucketName :: Lens' DeliveryChannel (Maybe Text) Source

The name of the Amazon S3 bucket used to store configuration history for the delivery channel.

DeliveryChannelStatus

data DeliveryChannelStatus Source

The status of a specified delivery channel.

Valid values: Success | Failure

See: deliveryChannelStatus smart constructor.

Instances

deliveryChannelStatus :: DeliveryChannelStatus Source

Creates a value of DeliveryChannelStatus with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

dcsConfigSnapshotDeliveryInfo :: Lens' DeliveryChannelStatus (Maybe ConfigExportDeliveryInfo) Source

A list containing the status of the delivery of the snapshot to the specified Amazon S3 bucket.

dcsConfigStreamDeliveryInfo :: Lens' DeliveryChannelStatus (Maybe ConfigStreamDeliveryInfo) Source

A list containing the status of the delivery of the configuration stream notification to the specified Amazon SNS topic.

dcsConfigHistoryDeliveryInfo :: Lens' DeliveryChannelStatus (Maybe ConfigExportDeliveryInfo) Source

A list that contains the status of the delivery of the configuration history to the specified Amazon S3 bucket.

dcsName :: Lens' DeliveryChannelStatus (Maybe Text) Source

The name of the delivery channel.

Evaluation

data Evaluation Source

Identifies an AWS resource and indicates whether it complies with the AWS Config rule that it was evaluated against.

See: evaluation smart constructor.

Instances

evaluation Source

Arguments

:: Text

eComplianceResourceType

-> Text

eComplianceResourceId

-> ComplianceType

eComplianceType

-> UTCTime

eOrderingTimestamp

-> Evaluation 

Creates a value of Evaluation with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

eAnnotation :: Lens' Evaluation (Maybe Text) Source

Supplementary information about how the evaluation determined the compliance.

eComplianceResourceType :: Lens' Evaluation Text Source

The type of AWS resource that was evaluated.

eComplianceResourceId :: Lens' Evaluation Text Source

The ID of the AWS resource that was evaluated.

eComplianceType :: Lens' Evaluation ComplianceType Source

Indicates whether the AWS resource complies with the AWS Config rule that it was evaluated against.

For the Evaluation data type, AWS Config supports only the COMPLIANT, NON_COMPLIANT, and NOT_APPLICABLE values. AWS Config does not support the INSUFFICIENT_DATA value for this data type.

Similarly, AWS Config does not accept INSUFFICIENT_DATA as the value for ComplianceType from a PutEvaluations request. For example, an AWS Lambda function for a custom Config rule cannot pass an INSUFFICIENT_DATA value to AWS Config.

eOrderingTimestamp :: Lens' Evaluation UTCTime Source

The time of the event in AWS Config that triggered the evaluation. For event-based evaluations, the time indicates when AWS Config created the configuration item that triggered the evaluation. For periodic evaluations, the time indicates when AWS Config delivered the configuration snapshot that triggered the evaluation.

EvaluationResult

data EvaluationResult Source

The details of an AWS Config evaluation. Provides the AWS resource that was evaluated, the compliance of the resource, related timestamps, and supplementary information.

See: evaluationResult smart constructor.

Instances

evaluationResult :: EvaluationResult Source

Creates a value of EvaluationResult with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

erEvaluationResultIdentifier :: Lens' EvaluationResult (Maybe EvaluationResultIdentifier) Source

Uniquely identifies the evaluation result.

erAnnotation :: Lens' EvaluationResult (Maybe Text) Source

Supplementary information about how the evaluation determined the compliance.

erConfigRuleInvokedTime :: Lens' EvaluationResult (Maybe UTCTime) Source

The time when the AWS Config rule evaluated the AWS resource.

erResultRecordedTime :: Lens' EvaluationResult (Maybe UTCTime) Source

The time when AWS Config recorded the evaluation result.

erResultToken :: Lens' EvaluationResult (Maybe Text) Source

An encrypted token that associates an evaluation with an AWS Config rule. The token identifies the rule, the AWS resource being evaluated, and the event that triggered the evaluation.

erComplianceType :: Lens' EvaluationResult (Maybe ComplianceType) Source

Indicates whether the AWS resource complies with the AWS Config rule that evaluated it.

For the EvaluationResult data type, AWS Config supports only the COMPLIANT, NON_COMPLIANT, and NOT_APPLICABLE values. AWS Config does not support the INSUFFICIENT_DATA value for the EvaluationResult data type.

EvaluationResultIdentifier

data EvaluationResultIdentifier Source

Uniquely identifies an evaluation result.

See: evaluationResultIdentifier smart constructor.

Instances

evaluationResultIdentifier :: EvaluationResultIdentifier Source

Creates a value of EvaluationResultIdentifier with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

eriEvaluationResultQualifier :: Lens' EvaluationResultIdentifier (Maybe EvaluationResultQualifier) Source

Identifies an AWS Config rule used to evaluate an AWS resource, and provides the type and ID of the evaluated resource.

eriOrderingTimestamp :: Lens' EvaluationResultIdentifier (Maybe UTCTime) Source

The time of the event that triggered the evaluation of your AWS resources. The time can indicate when AWS Config delivered a configuration item change notification, or it can indicate when AWS Config delivered the configuration snapshot, depending on which event triggered the evaluation.

EvaluationResultQualifier

data EvaluationResultQualifier Source

Identifies an AWS Config rule that evaluated an AWS resource, and provides the type and ID of the resource that the rule evaluated.

See: evaluationResultQualifier smart constructor.

Instances

evaluationResultQualifier :: EvaluationResultQualifier Source

Creates a value of EvaluationResultQualifier with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

erqResourceId :: Lens' EvaluationResultQualifier (Maybe Text) Source

The ID of the evaluated AWS resource.

erqResourceType :: Lens' EvaluationResultQualifier (Maybe Text) Source

The type of AWS resource that was evaluated.

erqConfigRuleName :: Lens' EvaluationResultQualifier (Maybe Text) Source

The name of the AWS Config rule that was used in the evaluation.

RecordingGroup

data RecordingGroup Source

Specifies the types of AWS resource for which AWS Config records configuration changes.

In the recording group, you specify whether all supported types or specific types of resources are recorded.

By default, AWS Config records configuration changes for all supported types of regional resources that AWS Config discovers in the region in which it is running. Regional resources are tied to a region and can be used only in that region. Examples of regional resources are EC2 instances and EBS volumes.

You can also have AWS Config record configuration changes for supported types of global resources (for example, IAM resources). Global resources are not tied to an individual region and can be used in all regions.

The configuration details for any global resource are the same in all regions. If you customize AWS Config in multiple regions to record global resources, it will create multiple configuration items each time a global resource changes: one configuration item for each region. These configuration items will contain identical data. To prevent duplicate configuration items, you should consider customizing AWS Config in only one region to record global resources, unless you want the configuration items to be available in multiple regions.

If you don't want AWS Config to record all resources, you can specify which types of resources it will record with the resourceTypes parameter.

For a list of supported resource types, see Supported resource types.

For more information, see Selecting Which Resources AWS Config Records.

See: recordingGroup smart constructor.

Instances

recordingGroup :: RecordingGroup Source

Creates a value of RecordingGroup with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

rgAllSupported :: Lens' RecordingGroup (Maybe Bool) Source

Specifies whether AWS Config records configuration changes for every supported type of regional resource.

If you set this option to true, when AWS Config adds support for a new type of regional resource, it automatically starts recording resources of that type.

If you set this option to true, you cannot enumerate a list of resourceTypes.

rgIncludeGlobalResourceTypes :: Lens' RecordingGroup (Maybe Bool) Source

Specifies whether AWS Config includes all supported types of global resources (for example, IAM resources) with the resources that it records.

Before you can set this option to true, you must set the allSupported option to true.

If you set this option to true, when AWS Config adds support for a new type of global resource, it automatically starts recording resources of that type.

The configuration details for any global resource are the same in all regions. To prevent duplicate configuration items, you should consider customizing AWS Config in only one region to record global resources.

rgResourceTypes :: Lens' RecordingGroup [ResourceType] Source

A comma-separated list that specifies the types of AWS resources for which AWS Config records configuration changes (for example, 'AWS::EC2::Instance' or 'AWS::CloudTrail::Trail').

Before you can set this option to true, you must set the allSupported option to false.

If you set this option to true, when AWS Config adds support for a new type of resource, it will not record resources of that type unless you manually add that type to your recording group.

For a list of valid resourceTypes values, see the __resourceType Value__ column in Supported AWS Resource Types.

Relationship

data Relationship Source

The relationship of the related resource to the main resource.

See: relationship smart constructor.

Instances

relationship :: Relationship Source

Creates a value of Relationship with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

rResourceId :: Lens' Relationship (Maybe Text) Source

The ID of the related resource (for example, 'sg-xxxxxx').

rResourceType :: Lens' Relationship (Maybe ResourceType) Source

The resource type of the related resource.

rResourceName :: Lens' Relationship (Maybe Text) Source

The custom name of the related resource, if available.

rRelationshipName :: Lens' Relationship (Maybe Text) Source

The type of relationship with the related resource.

ResourceIdentifier

data ResourceIdentifier Source

The details that identify a resource that is discovered by AWS Config, including the resource type, ID, and (if available) the custom resource name.

See: resourceIdentifier smart constructor.

Instances

resourceIdentifier :: ResourceIdentifier Source

Creates a value of ResourceIdentifier with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

riResourceId :: Lens' ResourceIdentifier (Maybe Text) Source

The ID of the resource (for example., 'sg-xxxxxx').

riResourceType :: Lens' ResourceIdentifier (Maybe ResourceType) Source

The type of resource.

riResourceName :: Lens' ResourceIdentifier (Maybe Text) Source

The custom name of the resource (if available).

riResourceDeletionTime :: Lens' ResourceIdentifier (Maybe UTCTime) Source

The time that the resource was deleted.

Scope

data Scope Source

Defines which resources trigger an evaluation for an AWS Config rule. The scope can include one or more resource types, a combination of a tag key and value, or a combination of one resource type and one resource ID. Specify a scope to constrain which resources trigger an evaluation for a rule. Otherwise, evaluations for the rule are triggered when any resource in your recording group changes in configuration.

See: scope smart constructor.

Instances

scope :: Scope Source

Creates a value of Scope with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

sComplianceResourceTypes :: Lens' Scope [Text] Source

The resource types of only those AWS resources that you want to trigger an evaluation for the rule. You can only specify one type if you also specify a resource ID for ComplianceResourceId.

sComplianceResourceId :: Lens' Scope (Maybe Text) Source

The IDs of the only AWS resource that you want to trigger an evaluation for the rule. If you specify a resource ID, you must specify one resource type for ComplianceResourceTypes.

sTagValue :: Lens' Scope (Maybe Text) Source

The tag value applied to only those AWS resources that you want to trigger an evaluation for the rule. If you specify a value for TagValue, you must also specify a value for TagKey.

sTagKey :: Lens' Scope (Maybe Text) Source

The tag key that is applied to only those AWS resources that you want you want to trigger an evaluation for the rule.

Source

data Source Source

Provides the AWS Config rule owner (AWS or customer), the rule identifier, and the events that trigger the evaluation of your AWS resources.

See: source smart constructor.

Instances

source :: Source Source

Creates a value of Source with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

sSourceIdentifier :: Lens' Source (Maybe Text) Source

For AWS managed Config rules, a pre-defined identifier from a list. To reference the list, see Using AWS Managed Config Rules.

For customer managed Config rules, the identifier is the Amazon Resource Name (ARN) of the rule's AWS Lambda function.

sOwner :: Lens' Source (Maybe Owner) Source

Indicates whether AWS or the customer owns and manages the AWS Config rule.

sSourceDetails :: Lens' Source [SourceDetail] Source

Provides the source and type of the event that causes AWS Config to evaluate your AWS resources.

SourceDetail

data SourceDetail Source

Provides the source and type of the event that triggers AWS Config to evaluate your AWS resources against a rule.

See: sourceDetail smart constructor.

Instances

sourceDetail :: SourceDetail Source

Creates a value of SourceDetail with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

sdMessageType :: Lens' SourceDetail (Maybe MessageType) Source

The type of SNS message that triggers AWS Config to run an evaluation. For evaluations that are initiated when AWS Config delivers a configuration item change notification, you must use ConfigurationItemChangeNotification. For evaluations that are initiated when AWS Config delivers a configuration snapshot, you must use ConfigurationSnapshotDeliveryCompleted.

sdEventSource :: Lens' SourceDetail (Maybe EventSource) Source

The source of the event, such as an AWS service, that triggers AWS Config to evaluate your AWS resources.