CloudFormation guard rules template for AWS Config

The following rules are included: 

  • Recording for Global Resources Enabled

let configurationRecorders = Resources.*[
	Type == "AWS::Config::ConfigurationRecorder"
]

rule config_global_resources when %configurationRecorders !empty {
	%configurationRecorders {
		Properties {
			RecordingGroup exists <<Recording Group is not configured.>>
			when RecordingGroup exists {
				RecordingGroup {
					AllSupported exists <<Recording Group AllSupported property is not configured.>>
					when AllSupported exists {
						AllSupported == true <<Recording Group is not set to record all supported resources.>>
					}
				}
			}
		}
	}
}


Actions



Customize Template

* Required field