Config - Configuration Management

import { cfg } from "@pulumi/aws";

// Create a configuration recorder
const recorder = new cfg.Recorder("config-recorder", {
    roleArn: configRole.arn,
    recordingGroup: {
        allSupported: true,
        includeGlobalResourceTypes: true,
    },
});

// Create a delivery channel to S3
const deliveryChannel = new cfg.DeliveryChannel("config-delivery", {
    s3BucketName: configBucket.id,
    snsTopicArn: configTopic.arn,
});

// Create a managed rule for checking encryption
const s3EncryptionRule = new cfg.Rule("s3-encryption", {
    source: {
        owner: "AWS",
        sourceIdentifier: "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED",
    },
});

class Recorder extends pulumi.CustomResource {
    constructor(name: string, args: RecorderArgs, opts?: pulumi.CustomResourceOptions);

    readonly id: pulumi.Output<string>;
}

interface RecorderArgs {
    roleArn: pulumi.Input<string>;
    name?: pulumi.Input<string>;
    recordingGroup?: pulumi.Input<RecordingGroup>;
}

interface RecordingGroup {
    allSupported?: pulumi.Input<boolean>;
    includeGlobalResourceTypes?: pulumi.Input<boolean>;
    resourceTypes?: pulumi.Input<pulumi.Input<string>[]>;
}

const configRole = new aws.iam.Role("config-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Principal: {
                Service: "config.amazonaws.com",
            },
            Effect: "Allow",
        }],
    }),
});

new aws.iam.RolePolicyAttachment("config-policy", {
    role: configRole.name,
    policyArn: "arn:aws:iam::aws:policy/service-role/ConfigRole",
});

const recorder = new cfg.Recorder("main", {
    roleArn: configRole.arn,
    recordingGroup: {
        allSupported: true,
        includeGlobalResourceTypes: true,
    },
});

new cfg.RecorderStatus("main", {
    isEnabled: true,
    name: recorder.name,
});

class DeliveryChannel extends pulumi.CustomResource {
    constructor(name: string, args: DeliveryChannelArgs, opts?: pulumi.CustomResourceOptions);
}

interface DeliveryChannelArgs {
    s3BucketName: pulumi.Input<string>;
    name?: pulumi.Input<string>;
    s3KeyPrefix?: pulumi.Input<string>;
    snsTopicArn?: pulumi.Input<string>;
    snapshotDeliveryProperties?: pulumi.Input<SnapshotDeliveryProperties>;
}

class Rule extends pulumi.CustomResource {
    constructor(name: string, args: RuleArgs, opts?: pulumi.CustomResourceOptions);

    readonly arn: pulumi.Output<string>;
}

interface RuleArgs {
    source: pulumi.Input<RuleSource>;
    name?: pulumi.Input<string>;
    description?: pulumi.Input<string>;
    inputParameters?: pulumi.Input<string>;
    maximumExecutionFrequency?: pulumi.Input<string>;
    scope?: pulumi.Input<RuleScope>;
}

// Managed rule from AWS
const encryptionRule = new cfg.Rule("require-encryption", {
    description: "Ensure S3 buckets have encryption enabled",
    source: {
        owner: "AWS",
        sourceIdentifier: "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED",
    },
});

// Custom Lambda-based rule
const customRule = new cfg.Rule("custom-tagging", {
    description: "Ensure resources have required tags",
    source: {
        owner: "CUSTOM_LAMBDA",
        sourceIdentifier: customRuleLambda.arn,
        sourceDetails: [{
            eventSource: "aws.config",
            messageType: "ConfigurationItemChangeNotification",
        }],
    },
    scope: {
        complianceResourceTypes: ["AWS::EC2::Instance", "AWS::S3::Bucket"],
    },
});

new aws.lambda.Permission("config-invoke", {
    action: "lambda:InvokeFunction",
    function: customRuleLambda.name,
    principal: "config.amazonaws.com",
});

class ConformancePack extends pulumi.CustomResource {
    constructor(name: string, args: ConformancePackArgs, opts?: pulumi.CustomResourceOptions);

    readonly arn: pulumi.Output<string>;
}

interface ConformancePackArgs {
    name: pulumi.Input<string>;
    templateBody?: pulumi.Input<string>;
    templateS3Uri?: pulumi.Input<string>;
    deliveryS3Bucket?: pulumi.Input<string>;
    inputParameters?: pulumi.Input<pulumi.Input<ConformancePackInputParameter>[]>;
}