{
  "typeName" : "AWS::Config::ConfigRule",
  "description" : "You must first create and start the CC configuration recorder in order to create CC managed rules with CFNlong. For more information, see [Managing the Configuration Recorder](https://docs.aws.amazon.com/config/latest/developerguide/stop-start-recorder.html).\n  Adds or updates an CC rule to evaluate if your AWS resources comply with your desired configurations. For information on how many CC rules you can have per account, see [Service Limits](https://docs.aws.amazon.com/config/latest/developerguide/configlimits.html) in the *Developer Guide*.\n There are two types of rules: *Managed Rules* and *Custom Rules*. You can use the ``ConfigRule`` resource to create both CC Managed Rules and CC Custom Rules.\n  CC Managed Rules are predefined, customizable rules created by CC. For a list of managed rules, see [List of Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html). If you are adding an CC managed rule, you must specify the rule's identifier for the ``SourceIdentifier`` key.\n  CC Custom Rules are rules that you create from scratch. There are two ways to create CC custom rules: with Lambda functions ([Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/gettingstarted-concepts.html#gettingstarted-concepts-function)) and with CFNGUARDshort ([Guard GitHub Repository](https://docs.aws.amazon.com/https://github.com/aws-cloudformation/cloudformation-guard)), a policy-as-code language. CC custom rules created with LAMlong are called *Custom Lambda Rules* and CC custom rules created with CFNGUARDshort are called *Custom Policy Rules*.\n If you are adding a new CC Custom LAM rule, you first need to create an LAMlong function that the rule invokes to evaluate your resources. When you use the ``ConfigRule`` resource to add a Custom LAM rule to CC, you must specify the Amazon Resource Name (ARN) that LAMlong assigns to the function. You specify the ARN in the ``SourceIdentifier`` key. This key is part of the ``Source`` object, which is part of the ``ConfigRule`` object. \n For any new CC rule that you add, specify the ``ConfigRuleName`` in the ``ConfigRule`` object. Do not specify the ``ConfigRuleArn`` or the ``ConfigRuleId``. These values are generated by CC for new rules.\n If you are updating a rule that you added previously, you can specify the rule by ``ConfigRuleName``, ``ConfigRuleId``, or ``ConfigRuleArn`` in the ``ConfigRule`` data type that you use in this request.\n For more information about developing and using CC rules, see [Evaluating Resources with Rules](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html) in the *Developer Guide*.",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-config.git",
  "definitions" : {
    "Scope" : {
      "type" : "object",
      "description" : "Defines which resources trigger an evaluation for an CC rule. The scope can include one or more resource types, a combination of a tag key and value, or a combination of one resource type and one resource ID. Specify a scope to constrain which resources trigger an evaluation for a rule. Otherwise, evaluations for the rule are triggered when any resource in your recording group changes in configuration.",
      "additionalProperties" : false,
      "properties" : {
        "TagKey" : {
          "type" : "string",
          "description" : "The tag key that is applied to only those AWS resources that you want to trigger an evaluation for the rule."
        },
        "ComplianceResourceTypes" : {
          "type" : "array",
          "description" : "The resource types of only those AWS resources that you want to trigger an evaluation for the rule. You can only specify one type if you also specify a resource ID for ``ComplianceResourceId``.",
          "uniqueItems" : true,
          "items" : {
            "type" : "string"
          }
        },
        "TagValue" : {
          "type" : "string",
          "description" : "The tag value applied to only those AWS resources that you want to trigger an evaluation for the rule. If you specify a value for ``TagValue``, you must also specify a value for ``TagKey``."
        },
        "ComplianceResourceId" : {
          "type" : "string",
          "description" : "The ID of the only AWS resource that you want to trigger an evaluation for the rule. If you specify a resource ID, you must specify one resource type for ``ComplianceResourceTypes``."
        }
      }
    },
    "CustomPolicyDetails" : {
      "type" : "object",
      "description" : "Provides the CustomPolicyDetails, the rule owner (```` for managed rules, ``CUSTOM_POLICY`` for Custom Policy rules, and ``CUSTOM_LAMBDA`` for Custom Lambda rules), the rule identifier, and the events that cause the evaluation of your AWS resources.",
      "additionalProperties" : false,
      "properties" : {
        "EnableDebugLogDelivery" : {
          "type" : "boolean",
          "description" : "The boolean expression for enabling debug logging for your CC Custom Policy rule. The default value is ``false``."
        },
        "PolicyText" : {
          "type" : "string",
          "description" : "The policy definition containing the logic for your CC Custom Policy rule."
        },
        "PolicyRuntime" : {
          "type" : "string",
          "description" : "The runtime system for your CC Custom Policy rule. Guard is a policy-as-code language that allows you to write policies that are enforced by CC Custom Policy rules. For more information about Guard, see the [Guard GitHub Repository](https://docs.aws.amazon.com/https://github.com/aws-cloudformation/cloudformation-guard)."
        }
      }
    },
    "SourceDetail" : {
      "type" : "object",
      "description" : "Provides the source and the message types that trigger CC to evaluate your AWS resources against a rule. It also provides the frequency with which you want CC to run evaluations for the rule if the trigger type is periodic. You can specify the parameter values for ``SourceDetail`` only for custom rules.",
      "additionalProperties" : false,
      "properties" : {
        "EventSource" : {
          "type" : "string",
          "description" : "The source of the event, such as an AWS service, that triggers CC to evaluate your AWS resources."
        },
        "MaximumExecutionFrequency" : {
          "type" : "string",
          "description" : "The frequency at which you want CC to run evaluations for a custom rule with a periodic trigger. If you specify a value for ``MaximumExecutionFrequency``, then ``MessageType`` must use the ``ScheduledNotification`` value.\n  By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the ``MaximumExecutionFrequency`` parameter.\n Based on the valid value you choose, CC runs evaluations once for each valid value. For example, if you choose ``Three_Hours``, CC runs evaluations once every three hours. In this case, ``Three_Hours`` is the frequency of this rule."
        },
        "MessageType" : {
          "type" : "string",
          "description" : "The type of notification that triggers CC to run an evaluation for a rule. You can specify the following notification types:\n  +   ``ConfigurationItemChangeNotification`` - Triggers an evaluation when CC delivers a configuration item as a result of a resource change.\n  +   ``OversizedConfigurationItemChangeNotification`` - Triggers an evaluation when CC delivers an oversized configuration item. CC may generate this notification type when a resource changes and the notification exceeds the maximum size allowed by Amazon SNS.\n  +   ``ScheduledNotification`` - Triggers a periodic evaluation at the frequency specified for ``MaximumExecutionFrequency``.\n  +   ``ConfigurationSnapshotDeliveryCompleted`` - Triggers a periodic evaluation when CC delivers a configuration snapshot.\n  \n If you want your custom rule to be triggered by configuration changes, specify two SourceDetail objects, one for ``ConfigurationItemChangeNotification`` and one for ``OversizedConfigurationItemChangeNotification``."
        }
      },
      "required" : [ "EventSource", "MessageType" ]
    },
    "Source" : {
      "type" : "object",
      "description" : "Provides the CustomPolicyDetails, the rule owner (```` for managed rules, ``CUSTOM_POLICY`` for Custom Policy rules, and ``CUSTOM_LAMBDA`` for Custom Lambda rules), the rule identifier, and the events that cause the evaluation of your AWS resources.",
      "additionalProperties" : false,
      "properties" : {
        "CustomPolicyDetails" : {
          "description" : "Provides the runtime system, policy definition, and whether debug logging is enabled. Required when owner is set to ``CUSTOM_POLICY``.",
          "$ref" : "#/definitions/CustomPolicyDetails"
        },
        "SourceIdentifier" : {
          "type" : "string",
          "description" : "For CC Managed rules, a predefined identifier from a list. For example, ``IAM_PASSWORD_POLICY`` is a managed rule. To reference a managed rule, see [List of Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html).\n For CC Custom Lambda rules, the identifier is the Amazon Resource Name (ARN) of the rule's LAMlong function, such as ``arn:aws:lambda:us-east-2:123456789012:function:custom_rule_name``.\n For CC Custom Policy rules, this field will be ignored."
        },
        "Owner" : {
          "type" : "string",
          "description" : "Indicates whether AWS or the customer owns and manages the CC rule.\n  CC Managed Rules are predefined rules owned by AWS. For more information, see [Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html) in the *developer guide*.\n  CC Custom Rules are rules that you can develop either with Guard (``CUSTOM_POLICY``) or LAMlong (``CUSTOM_LAMBDA``). For more information, see [Custom Rules](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules.html) in the *developer guide*."
        },
        "SourceDetails" : {
          "type" : "array",
          "description" : "Provides the source and the message types that cause CC to evaluate your AWS resources against a rule. It also provides the frequency with which you want CC to run evaluations for the rule if the trigger type is periodic.\n If the owner is set to ``CUSTOM_POLICY``, the only acceptable values for the CC rule trigger message type are ``ConfigurationItemChangeNotification`` and ``OversizedConfigurationItemChangeNotification``.",
          "uniqueItems" : true,
          "items" : {
            "description" : "Source and message type that can trigger the rule",
            "$ref" : "#/definitions/SourceDetail"
          }
        }
      },
      "required" : [ "Owner" ]
    },
    "EvaluationModeConfiguration" : {
      "type" : "object",
      "description" : "The configuration object for CC rule evaluation mode. The supported valid values are Detective or Proactive.",
      "additionalProperties" : false,
      "properties" : {
        "Mode" : {
          "type" : "string",
          "description" : "The mode of an evaluation. The valid values are Detective or Proactive."
        }
      }
    }
  },
  "properties" : {
    "ConfigRuleId" : {
      "type" : "string",
      "description" : ""
    },
    "Description" : {
      "type" : "string",
      "description" : "The description that you provide for the CC rule."
    },
    "Scope" : {
      "description" : "Defines which resources can trigger an evaluation for the rule. The scope can include one or more resource types, a combination of one resource type and one resource ID, or a combination of a tag key and value. Specify a scope to constrain the resources that can trigger an evaluation for the rule. If you do not specify a scope, evaluations are triggered when any resource in the recording group changes.\n  The scope can be empty.",
      "$ref" : "#/definitions/Scope"
    },
    "ConfigRuleName" : {
      "type" : "string",
      "description" : "A name for the CC rule. If you don't specify a name, CFN generates a unique physical ID and uses that ID for the rule name. For more information, see [Name Type](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-name.html)."
    },
    "Arn" : {
      "type" : "string",
      "description" : ""
    },
    "Compliance" : {
      "type" : "object",
      "description" : "Indicates whether an AWS resource or CC rule is compliant and provides the number of contributors that affect the compliance.",
      "additionalProperties" : false,
      "properties" : {
        "Type" : {
          "type" : "string",
          "description" : "Compliance type determined by the Config rule"
        }
      }
    },
    "MaximumExecutionFrequency" : {
      "type" : "string",
      "description" : "The maximum frequency with which CC runs evaluations for a rule. You can specify a value for ``MaximumExecutionFrequency`` when:\n  +  You are using an AWS managed rule that is triggered at a periodic frequency.\n  +  Your custom rule is triggered when CC delivers the configuration snapshot. For more information, see [ConfigSnapshotDeliveryProperties](https://docs.aws.amazon.com/config/latest/APIReference/API_ConfigSnapshotDeliveryProperties.html).\n  \n  By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the ``MaximumExecutionFrequency`` parameter."
    },
    "Source" : {
      "description" : "Provides the rule owner (```` for managed rules, ``CUSTOM_POLICY`` for Custom Policy rules, and ``CUSTOM_LAMBDA`` for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.",
      "$ref" : "#/definitions/Source"
    },
    "InputParameters" : {
      "type" : [ "string", "object" ],
      "description" : "A string, in JSON format, that is passed to the CC rule Lambda function."
    },
    "EvaluationModes" : {
      "type" : "array",
      "description" : "The modes the CC rule can be evaluated in. The valid values are distinct objects. By default, the value is Detective evaluation mode only.",
      "uniqueItems" : false,
      "items" : {
        "description" : "Mode of evaluation of AWS Config rule",
        "$ref" : "#/definitions/EvaluationModeConfiguration"
      }
    }
  },
  "propertyTransform" : {
    "/properties/Source" : "Source.Owner=\"CUSTOM_LAMBDA\" ? ($count(Source.SourceDetails[MessageType=\"ConfigurationItemChangeNotification\"]) > 0 and $count(Source.SourceDetails[MessageType=\"OversizedConfigurationItemChangeNotification\"]) = 0) ? $ ~> | $.Source | {\"SourceDetails\" : [SourceDetails, {\"EventSource\": \"aws.config\", \"MessageType\": \"OversizedConfigurationItemChangeNotification\"}]} | : ($count(Source.SourceDetails[MessageType=\"ConfigurationItemChangeNotification\"]) = 0 and $count(Source.SourceDetails[MessageType=\"OversizedConfigurationItemChangeNotification\"]) > 0) ? $ ~> | $.Source | {\"SourceDetails\" : [SourceDetails, {\"EventSource\": \"aws.config\", \"MessageType\": \"ConfigurationItemChangeNotification\" }]} | : $ : $"
  },
  "tagging" : {
    "taggable" : false
  },
  "additionalProperties" : false,
  "required" : [ "Source" ],
  "createOnlyProperties" : [ "/properties/ConfigRuleName" ],
  "primaryIdentifier" : [ "/properties/ConfigRuleName" ],
  "readOnlyProperties" : [ "/properties/ConfigRuleId", "/properties/Compliance/Type", "/properties/Arn" ],
  "writeOnlyProperties" : [ "/properties/Source/CustomPolicyDetails/PolicyText" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "config:PutConfigRule", "config:DescribeConfigRules" ]
    },
    "read" : {
      "permissions" : [ "config:DescribeConfigRules", "config:DescribeComplianceByConfigRule" ]
    },
    "delete" : {
      "permissions" : [ "config:DeleteConfigRule", "config:DescribeConfigRules" ]
    },
    "list" : {
      "permissions" : [ "config:DescribeConfigRules" ]
    },
    "update" : {
      "permissions" : [ "config:PutConfigRule", "config:DescribeConfigRules" ]
    }
  }
}