Config Rules - Empty IAM Groups Check

Upcoming Features

A Config rule that checks whether IAM groups have at least one IAM user.

CloudFormation |AWS CLI |

Items

1

Size

0.5 KB

AWSTemplateFormatVersion: '2010-09-09'
Description: ''
Resources:
  ConfigRule:
    Type: 'AWS::Config::ConfigRule'
    Properties:
      ConfigRuleName: iam-group-has-users-check
      Description: A Config rule that checks whether IAM groups have at least one IAM user.
      Scope:
        ComplianceResourceTypes:
          - 'AWS::IAM::Group'
      Source:
        Owner: AWS
        SourceIdentifier: IAM_GROUP_HAS_USERS_CHECK
Parameters: {}
Metadata: {}
Conditions: {}

* Required field

Configuration Source: AWS Documentation

Additional Documentation:

AWS Documentation: Setting up AWS Config Managed Rules
AWS Documentation: AWS Config Managed Rules Overview
CloudFormation Reference Guide: Create an AWS Config Rule
AWS CLI Command Reference Guide: Create an AWS Config Rule

A configuration package to enable AWS security logging and activity monitoring services: AWS CloudTrail, AWS Config, and Amazon GuardDuty. The package also includes an S3 bucket to store CloudTrail and Config history logs, as well as an optional CloudWatch log group to receive CloudTrail logs.

Configuration Package

Configuration to enable AWS Config including support configuration such as S3 Buckets and Iam Roles as required. AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations.

Configuration Item

A configuration package to monitor IAM related API activity as well as configuration compliance rules to ensure the security of Amazon IAM configuration. The package includes Config Rules, CloudWatch Alarms, and CloudWatch Event Rules, and uses SNS to deliver email notifications. The package also includes configuration to enable the required AWS logging services: AWS CloudTrail, Config, and CloudWatch log groups.

Configuration Package