Amazonka.Config.PutOrganizationConfigRule

Adds or updates an Config rule for your entire organization to evaluate if your Amazon Web Services resources comply with your desired configurations. For information on how many organization Config rules you can have per account, see Service Limits in the Config Developer Guide.

Only a management account and a delegated administrator can create or update an organization Config rule. When calling this API with a delegated administrator, you must ensure Organizations ListDelegatedAdministrator permissions are added. An organization can have up to 3 delegated administrators.

This API enables organization service access through the EnableAWSServiceAccess action and creates a service-linked role AWSServiceRoleForConfigMultiAccountSetup in the management or delegated administrator account of your organization. The service-linked role is created only when the role does not exist in the caller account. Config verifies the existence of role with GetRole action.

To use this API with delegated administrator, register a delegated administrator by calling Amazon Web Services Organization register-delegated-administrator for config-multiaccountsetup.amazonaws.com.

There are two types of rules: Config Custom Rules and Config Managed Rules. You can use PutOrganizationConfigRule to create both Config custom rules and Config managed rules.

Custom rules are rules that you can create using either Guard or Lambda functions. Guard (Guard GitHub Repository) is a policy-as-code language that allows you to write policies that are enforced by Config Custom Policy rules. Lambda uses custom code that you upload to evaluate a custom rule. If you are adding a new Custom Lambda rule, you first need to create an Lambda function in the management account or a delegated administrator that the rule invokes to evaluate your resources. You also need to create an IAM role in the managed account that can be assumed by the Lambda function. When you use PutOrganizationConfigRule to add a Custom Lambda rule to Config, you must specify the Amazon Resource Name (ARN) that Lambda assigns to the function.

Managed rules are predefined, customizable rules created by Config. For a list of managed rules, see List of Config Managed Rules. If you are adding an Config managed rule, you must specify the rule's identifier for the RuleIdentifier key.

Prerequisite: Ensure you call EnableAllFeatures API to enable all features in an organization.

Make sure to specify one of either OrganizationCustomPolicyRuleMetadata for Custom Policy rules, OrganizationCustomRuleMetadata for Custom Lambda rules, or OrganizationManagedRuleMetadata for managed rules.

Creating a Request

data PutOrganizationConfigRule

See: newPutOrganizationConfigRule smart constructor.

Constructors

PutOrganizationConfigRule'

Fields

• excludedAccounts :: Maybe [Text]

  A comma-separated list of accounts that you want to exclude from an organization Config rule.

• organizationCustomPolicyRuleMetadata :: Maybe OrganizationCustomPolicyRuleMetadata

  An OrganizationCustomPolicyRuleMetadata object. This object specifies metadata for your organization's Config Custom Policy rule. The metadata includes the runtime system in use, which accounts have debug logging enabled, and other custom rule metadata, such as resource type, resource ID of Amazon Web Services resource, and organization trigger types that initiate Config to evaluate Amazon Web Services resources against a rule.

• organizationCustomRuleMetadata :: Maybe OrganizationCustomRuleMetadata

  An OrganizationCustomRuleMetadata object. This object specifies organization custom rule metadata such as resource type, resource ID of Amazon Web Services resource, Lambda function ARN, and organization trigger types that trigger Config to evaluate your Amazon Web Services resources against a rule. It also provides the frequency with which you want Config to run evaluations for the rule if the trigger type is periodic.

• organizationManagedRuleMetadata :: Maybe OrganizationManagedRuleMetadata

  An OrganizationManagedRuleMetadata object. This object specifies organization managed rule metadata such as resource type and ID of Amazon Web Services resource along with the rule identifier. It also provides the frequency with which you want Config to run evaluations for the rule if the trigger type is periodic.

• organizationConfigRuleName :: Text

  The name that you assign to an organization Config rule.

Instances

ToJSON PutOrganizationConfigRule

Defined in Amazonka.Config.PutOrganizationConfigRule

Methods

toJSON :: PutOrganizationConfigRule -> Value

toEncoding :: PutOrganizationConfigRule -> Encoding

toJSONList :: [PutOrganizationConfigRule] -> Value

toEncodingList :: [PutOrganizationConfigRule] -> Encoding

ToHeaders PutOrganizationConfigRule

Defined in Amazonka.Config.PutOrganizationConfigRule

Methods

toHeaders :: PutOrganizationConfigRule -> [Header]

ToPath PutOrganizationConfigRule

Defined in Amazonka.Config.PutOrganizationConfigRule

Methods

toPath :: PutOrganizationConfigRule -> ByteString

ToQuery PutOrganizationConfigRule

Defined in Amazonka.Config.PutOrganizationConfigRule

Methods

toQuery :: PutOrganizationConfigRule -> QueryString

AWSRequest PutOrganizationConfigRule

Defined in Amazonka.Config.PutOrganizationConfigRule

Associated Types

type AWSResponse PutOrganizationConfigRule

Methods

request :: (Service -> Service) -> PutOrganizationConfigRule -> Request PutOrganizationConfigRule

response :: MonadResource m => (ByteStringLazy -> IO ByteStringLazy) -> Service -> Proxy PutOrganizationConfigRule -> ClientResponse ClientBody -> m (Either Error (ClientResponse (AWSResponse PutOrganizationConfigRule)))

Generic PutOrganizationConfigRule

Defined in Amazonka.Config.PutOrganizationConfigRule

Associated Types

type Rep PutOrganizationConfigRule :: Type -> Type

Methods

from :: PutOrganizationConfigRule -> Rep PutOrganizationConfigRule x

to :: Rep PutOrganizationConfigRule x -> PutOrganizationConfigRule

Read PutOrganizationConfigRule

Defined in Amazonka.Config.PutOrganizationConfigRule

Methods

readsPrec :: Int -> ReadS PutOrganizationConfigRule

readList :: ReadS [PutOrganizationConfigRule]

readPrec :: ReadPrec PutOrganizationConfigRule

readListPrec :: ReadPrec [PutOrganizationConfigRule]

Show PutOrganizationConfigRule

Defined in Amazonka.Config.PutOrganizationConfigRule

Methods

showsPrec :: Int -> PutOrganizationConfigRule -> ShowS

show :: PutOrganizationConfigRule -> String

showList :: [PutOrganizationConfigRule] -> ShowS

NFData PutOrganizationConfigRule

Defined in Amazonka.Config.PutOrganizationConfigRule

Methods

rnf :: PutOrganizationConfigRule -> ()

Eq PutOrganizationConfigRule

Defined in Amazonka.Config.PutOrganizationConfigRule

Methods

(==) :: PutOrganizationConfigRule -> PutOrganizationConfigRule -> Bool

(/=) :: PutOrganizationConfigRule -> PutOrganizationConfigRule -> Bool

Hashable PutOrganizationConfigRule

Defined in Amazonka.Config.PutOrganizationConfigRule

Methods

hashWithSalt :: Int -> PutOrganizationConfigRule -> Int

hash :: PutOrganizationConfigRule -> Int

type AWSResponse PutOrganizationConfigRule

Defined in Amazonka.Config.PutOrganizationConfigRule

type AWSResponse PutOrganizationConfigRule = PutOrganizationConfigRuleResponse

type Rep PutOrganizationConfigRule

Defined in Amazonka.Config.PutOrganizationConfigRule

type Rep PutOrganizationConfigRule = D1 ('MetaData "PutOrganizationConfigRule" "Amazonka.Config.PutOrganizationConfigRule" "amazonka-config-2.0-7GF0fBbVw65uROwJwpcE3" 'False) (C1 ('MetaCons "PutOrganizationConfigRule'" 'PrefixI 'True) ((S1 ('MetaSel ('Just "excludedAccounts") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe [Text])) :*: S1 ('MetaSel ('Just "organizationCustomPolicyRuleMetadata") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe OrganizationCustomPolicyRuleMetadata))) :*: (S1 ('MetaSel ('Just "organizationCustomRuleMetadata") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe OrganizationCustomRuleMetadata)) :*: (S1 ('MetaSel ('Just "organizationManagedRuleMetadata") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe OrganizationManagedRuleMetadata)) :*: S1 ('MetaSel ('Just "organizationConfigRuleName") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text)))))

newPutOrganizationConfigRule

Arguments

:: Text

PutOrganizationConfigRule

-> PutOrganizationConfigRule

Create a value of PutOrganizationConfigRule with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

PutOrganizationConfigRule, putOrganizationConfigRule_excludedAccounts - A comma-separated list of accounts that you want to exclude from an organization Config rule.

PutOrganizationConfigRule, putOrganizationConfigRule_organizationCustomPolicyRuleMetadata - An OrganizationCustomPolicyRuleMetadata object. This object specifies metadata for your organization's Config Custom Policy rule. The metadata includes the runtime system in use, which accounts have debug logging enabled, and other custom rule metadata, such as resource type, resource ID of Amazon Web Services resource, and organization trigger types that initiate Config to evaluate Amazon Web Services resources against a rule.

PutOrganizationConfigRule, putOrganizationConfigRule_organizationCustomRuleMetadata - An OrganizationCustomRuleMetadata object. This object specifies organization custom rule metadata such as resource type, resource ID of Amazon Web Services resource, Lambda function ARN, and organization trigger types that trigger Config to evaluate your Amazon Web Services resources against a rule. It also provides the frequency with which you want Config to run evaluations for the rule if the trigger type is periodic.

PutOrganizationConfigRule, putOrganizationConfigRule_organizationManagedRuleMetadata - An OrganizationManagedRuleMetadata object. This object specifies organization managed rule metadata such as resource type and ID of Amazon Web Services resource along with the rule identifier. It also provides the frequency with which you want Config to run evaluations for the rule if the trigger type is periodic.

PutOrganizationConfigRule, putOrganizationConfigRule_organizationConfigRuleName - The name that you assign to an organization Config rule.

Request Lenses

putOrganizationConfigRule_excludedAccounts :: Lens' PutOrganizationConfigRule (Maybe [Text])

A comma-separated list of accounts that you want to exclude from an organization Config rule.

putOrganizationConfigRule_organizationCustomPolicyRuleMetadata :: Lens' PutOrganizationConfigRule (Maybe OrganizationCustomPolicyRuleMetadata)

An OrganizationCustomPolicyRuleMetadata object. This object specifies metadata for your organization's Config Custom Policy rule. The metadata includes the runtime system in use, which accounts have debug logging enabled, and other custom rule metadata, such as resource type, resource ID of Amazon Web Services resource, and organization trigger types that initiate Config to evaluate Amazon Web Services resources against a rule.

putOrganizationConfigRule_organizationCustomRuleMetadata :: Lens' PutOrganizationConfigRule (Maybe OrganizationCustomRuleMetadata)

An OrganizationCustomRuleMetadata object. This object specifies organization custom rule metadata such as resource type, resource ID of Amazon Web Services resource, Lambda function ARN, and organization trigger types that trigger Config to evaluate your Amazon Web Services resources against a rule. It also provides the frequency with which you want Config to run evaluations for the rule if the trigger type is periodic.

putOrganizationConfigRule_organizationManagedRuleMetadata :: Lens' PutOrganizationConfigRule (Maybe OrganizationManagedRuleMetadata)

An OrganizationManagedRuleMetadata object. This object specifies organization managed rule metadata such as resource type and ID of Amazon Web Services resource along with the rule identifier. It also provides the frequency with which you want Config to run evaluations for the rule if the trigger type is periodic.

putOrganizationConfigRule_organizationConfigRuleName :: Lens' PutOrganizationConfigRule Text

The name that you assign to an organization Config rule.

Destructuring the Response

data PutOrganizationConfigRuleResponse

See: newPutOrganizationConfigRuleResponse smart constructor.

Constructors

PutOrganizationConfigRuleResponse'

Fields

• organizationConfigRuleArn :: Maybe Text

  The Amazon Resource Name (ARN) of an organization Config rule.

• httpStatus :: Int

  The response's http status code.

Instances

Generic PutOrganizationConfigRuleResponse

Defined in Amazonka.Config.PutOrganizationConfigRule

Associated Types

type Rep PutOrganizationConfigRuleResponse :: Type -> Type

Methods

from :: PutOrganizationConfigRuleResponse -> Rep PutOrganizationConfigRuleResponse x

to :: Rep PutOrganizationConfigRuleResponse x -> PutOrganizationConfigRuleResponse

Read PutOrganizationConfigRuleResponse

Defined in Amazonka.Config.PutOrganizationConfigRule

Methods

readsPrec :: Int -> ReadS PutOrganizationConfigRuleResponse

readList :: ReadS [PutOrganizationConfigRuleResponse]

readPrec :: ReadPrec PutOrganizationConfigRuleResponse

readListPrec :: ReadPrec [PutOrganizationConfigRuleResponse]

Show PutOrganizationConfigRuleResponse

Defined in Amazonka.Config.PutOrganizationConfigRule

Methods

showsPrec :: Int -> PutOrganizationConfigRuleResponse -> ShowS

show :: PutOrganizationConfigRuleResponse -> String

showList :: [PutOrganizationConfigRuleResponse] -> ShowS

NFData PutOrganizationConfigRuleResponse

Defined in Amazonka.Config.PutOrganizationConfigRule

Methods

rnf :: PutOrganizationConfigRuleResponse -> ()

Eq PutOrganizationConfigRuleResponse

Defined in Amazonka.Config.PutOrganizationConfigRule

Methods

(==) :: PutOrganizationConfigRuleResponse -> PutOrganizationConfigRuleResponse -> Bool

(/=) :: PutOrganizationConfigRuleResponse -> PutOrganizationConfigRuleResponse -> Bool

type Rep PutOrganizationConfigRuleResponse

Defined in Amazonka.Config.PutOrganizationConfigRule

type Rep PutOrganizationConfigRuleResponse = D1 ('MetaData "PutOrganizationConfigRuleResponse" "Amazonka.Config.PutOrganizationConfigRule" "amazonka-config-2.0-7GF0fBbVw65uROwJwpcE3" 'False) (C1 ('MetaCons "PutOrganizationConfigRuleResponse'" 'PrefixI 'True) (S1 ('MetaSel ('Just "organizationConfigRuleArn") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "httpStatus") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Int)))

newPutOrganizationConfigRuleResponse

Arguments

:: Int

$sel:httpStatus:PutOrganizationConfigRuleResponse'

-> PutOrganizationConfigRuleResponse

Create a value of PutOrganizationConfigRuleResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

PutOrganizationConfigRuleResponse, putOrganizationConfigRuleResponse_organizationConfigRuleArn - The Amazon Resource Name (ARN) of an organization Config rule.

$sel:httpStatus:PutOrganizationConfigRuleResponse', putOrganizationConfigRuleResponse_httpStatus - The response's http status code.

Response Lenses

putOrganizationConfigRuleResponse_organizationConfigRuleArn :: Lens' PutOrganizationConfigRuleResponse (Maybe Text)

The Amazon Resource Name (ARN) of an organization Config rule.

putOrganizationConfigRuleResponse_httpStatus :: Lens' PutOrganizationConfigRuleResponse Int

The response's http status code.