steampipe plugin install awssteampipe plugin install aws

Table: aws_config_rule

An AWS Config rule represents an AWS Lambda function that you create for a custom rule or a predefined function for an AWS managed rule. The function evaluates configuration items to assess whether your AWS resources comply with your desired configurations. This function can run when AWS Config detects a configuration change to an AWS resource and at a periodic frequency that you choose (for example, every 24 hours).

Examples

Basic info

select
  name,
  rule_id,
  arn,
  rule_state,
  created_by,
  scope
from
  aws_config_rule;

List inactive rules

select
  name,
  rule_id,
  arn,
  rule_state
from
  aws_config_rule
where
  rule_state <> 'ACTIVE';

List active rules for S3 buckets

select
  name,
  rule_id,
  tags
from
  aws_config_rule
where
  name Like '%s3-bucket%';

List complaince details by config rule

select
  jsonb_pretty(compliance_by_config_rule) as compliance_info
from
  aws_config_rule
where
  name = 'approved-amis-by-id';

List complaince types by config rule

select
  name as config_rule_name,
  compliance_status -> 'Compliance' -> 'ComplianceType' as compliance_type
from
  aws_config_rule,
  jsonb_array_elements(compliance_by_config_rule) as compliance_status;

List config rules that run in proactive mode

select
  name as config_rule_name,
  c ->> 'Mode' as evaluation_mode
from
  aws_config_rule,
  jsonb_array_elements(evaluation_modes) as c
where
  c ->> 'Mode' = 'PROACTIVE';

Control examples

.inspect aws_config_rule

AWS Config Rule

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
arn	text	The Amazon Resource Name (ARN) of the AWS Config rule.
compliance_by_config_rule	jsonb	The compliance information of the config rule.
created_by	text	Service principal name of the service that created the rule.
description	text	The description that you provide for the AWS Config rule.
evaluation_modes	jsonb	The modes the Config rule can be evaluated in. The valid values are distinct objects. By default, the value is Detective evaluation mode only.
input_parameters	jsonb	A string, in JSON format, that is passed to the AWS Config rule Lambda function.
maximum_execution_frequency	text	The maximum frequency with which AWS Config runs evaluations for a rule.
name	text	The name that you assign to the AWS Config rule.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
region	text	The AWS Region in which the resource is located.
rule_id	text	The ID of the AWS Config rule.
rule_state	text	It indicate the evaluation status for the AWS Config rule.
scope	jsonb	Defines which resources can trigger an evaluation for the rule. The scope can include one or more resource types, a combination of one resource type and one resource ID, or a combination of a tag key and value. Specify a scope to constrain the resources that can trigger an evaluation for the rule. If you do not specify a scope, evaluations are triggered when any resource in the recording group changes.
source	jsonb	Provides the rule owner (AWS or customer), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.
tags	jsonb	A map of tags for the resource.
tags_src	jsonb	A list of tags assigned to the rule.
title	text	Title of the resource.

turbot/aws