Creates or updates a conformance pack. A conformance pack is a collection of Config rules that can be easily deployed in an account and a region and across an organization. For information on how many conformance packs you can have per account, see Service Limits in the Config Developer Guide.
When you use PutConformancePack to deploy conformance packs in your account, the operation can create Config rules and remediation actions without requiring config:PutConfigRule or config:PutRemediationConfigurations permissions in your account IAM policies.
This API uses the AWSServiceRoleForConfigConforms service-linked role in your account to create conformance pack resources. This service-linked role includes the permissions to create Config rules and remediation configurations, even if your account IAM policies explicitly deny these actions.
This API creates a service-linked role AWSServiceRoleForConfigConforms in your account. The service-linked role is created only when the role does not exist in your account.
You must specify only one of the follow parameters: TemplateS3Uri, TemplateBody or TemplateSSMDocumentDetails.
Tags are added at creation and cannot be updated with this operation
PutConformancePack is an idempotent API. Subsequent requests won't create a duplicate resource if one was already created. If a following request has different tags values, Config will ignore these differences and treat it as an idempotent request of the previous. In this case, tags will not be updated, even if they are different.
Use TagResource and UntagResource to update tags after creation.
Parameters:
-
conformance_pack_name
(ConformancePackName)
–
The unique name of the conformance pack you want to deploy.
-
template_s3_uri
(Optional[TemplateS3Uri], default:
None
)
–
The location of the file containing the template body (s3://bucketname/prefix). The uri must point to a conformance pack template (max size: 300 KB) that is located in an Amazon S3 bucket in the same Region as the conformance pack.
You must have access to read Amazon S3 bucket. In addition, in order to ensure a successful deployment, the template object must not be in an archived storage class if this parameter is passed.
-
template_body
(Optional[TemplateBody], default:
None
)
–
A string that contains the full conformance pack template body. The structure containing the template body has a minimum length of 1 byte and a maximum length of 51,200 bytes.
You can use a YAML template with two resource types: Config rule (AWS::Config::ConfigRule) and remediation action (AWS::Config::RemediationConfiguration).
-
delivery_s3_bucket
(Optional[DeliveryS3Bucket], default:
None
)
–
The name of the Amazon S3 bucket where Config stores conformance pack templates.
This field is optional.
-
delivery_s3_key_prefix
(Optional[DeliveryS3KeyPrefix], default:
None
)
–
The prefix for the Amazon S3 bucket.
This field is optional.
-
conformance_pack_input_parameters
(Optional[ConformancePackInputParameters], default:
None
)
–
A list of ConformancePackInputParameter objects.
-
template_ssm_document_details
(Optional[TemplateSSMDocumentDetails], default:
None
)
–
An object of type TemplateSSMDocumentDetails, which contains the name or the Amazon Resource Name (ARN) of the Amazon Web Services Systems Manager document (SSM document) and the version of the SSM document that is used to create a conformance pack.
-
tags
(Optional[TagsList], default:
None
)
–
The tags for the conformance pack. Each tag consists of a key and an optional value, both of which you define.
Raises:
-
ConformancePackTemplateValidationException
–
You have specified a template that is not valid or supported.
-
InsufficientPermissionsException
–
Indicates one of the following errors:
-
For PutConfigRule, the rule cannot be created because the IAM role assigned to Config lacks permissions to perform the config:Put* action.
-
For PutConfigRule, the Lambda function cannot be invoked. Check the function ARN, and check the function's permissions.
-
For PutOrganizationConfigRule, organization Config rule cannot be created because you do not have permissions to call IAM GetRole action or create a service-linked role.
-
For PutConformancePack and PutOrganizationConformancePack, a conformance pack cannot be created because you do not have the following permissions:
-
For PutServiceLinkedConfigurationRecorder, a service-linked configuration recorder cannot be created because you do not have the following permissions: IAM CreateServiceLinkedRole.
-
For PutConnector, a connector cannot be created because you do not have the following permissions: IAM CreateServiceLinkedRole.
-
InvalidParameterValueException
–
One or more of the specified parameters are not valid. Verify that your parameters are valid and try again.
-
MaxNumberOfConformancePacksExceededException
–
You have reached the limit of the number of conformance packs you can create in an account. For more information, see Service Limits in the Config Developer Guide.
-
ResourceInUseException
–
You see this exception in the following cases:
-
For DeleteConfigRule, Config is deleting this rule. Try your request again later.
-
For DeleteConfigRule, the rule is deleting your evaluation results. Try your request again later.
-
For DeleteConfigRule, a remediation action is associated with the rule and Config cannot delete this rule. Delete the remediation action associated with the rule before deleting the rule and try your request again later.
-
For PutConfigOrganizationRule, organization Config rule deletion is in progress. Try your request again later.
-
For DeleteOrganizationConfigRule, organization Config rule creation is in progress. Try your request again later.
-
For PutConformancePack and PutOrganizationConformancePack, a conformance pack creation, update, and deletion is in progress. Try your request again later.
-
For DeleteConformancePack, a conformance pack creation, update, and deletion is in progress. Try your request again later.
-
UnknownServiceError
–
The service returned an error code this client does not model.
Source code in docs_src/capo_config_service/_services/config_service.py
| def put_conformance_pack(
self,
conformance_pack_name: "capo_config_service.types.conformance_pack_name.ConformancePackName",
*,
config_overrides: Optional[ConfigServiceClientConfig] = None,
template_s3_uri: Optional[
"capo_config_service.types.template_s3_uri.TemplateS3Uri"
] = None,
template_body: Optional[
"capo_config_service.types.template_body.TemplateBody"
] = None,
delivery_s3_bucket: Optional[
"capo_config_service.types.delivery_s3_bucket.DeliveryS3Bucket"
] = None,
delivery_s3_key_prefix: Optional[
"capo_config_service.types.delivery_s3_key_prefix.DeliveryS3KeyPrefix"
] = None,
conformance_pack_input_parameters: Optional[
"capo_config_service.types.conformance_pack_input_parameters.ConformancePackInputParameters"
] = None,
template_ssm_document_details: Optional[
"capo_config_service.types.template_ssm_document_details.TemplateSSMDocumentDetails"
] = None,
tags: Optional["capo_config_service.types.tags_list.TagsList"] = None,
) -> "capo_config_service.types.put_conformance_pack_response.PutConformancePackResponse":
"""<p>Creates or updates a conformance pack. A conformance pack is a collection of Config rules that can be easily deployed in an account and a region and across an organization. For information on how many conformance packs you can have per account, see <a href="https://docs.aws.amazon.com/config/latest/developerguide/configlimits.html"> <b>Service Limits</b> </a> in the <i>Config Developer Guide</i>.</p> <important> <p>When you use <code>PutConformancePack</code> to deploy conformance packs in your account, the operation can create Config rules and remediation actions without requiring <code>config:PutConfigRule</code> or <code>config:PutRemediationConfigurations</code> permissions in your account IAM policies.</p> <p>This API uses the <code>AWSServiceRoleForConfigConforms</code> service-linked role in your account to create conformance pack resources. This service-linked role includes the permissions to create Config rules and remediation configurations, even if your account IAM policies explicitly deny these actions.</p> </important> <p>This API creates a service-linked role <code>AWSServiceRoleForConfigConforms</code> in your account. The service-linked role is created only when the role does not exist in your account. </p> <note> <p>You must specify only one of the follow parameters: <code>TemplateS3Uri</code>, <code>TemplateBody</code> or <code>TemplateSSMDocumentDetails</code>.</p> </note> <note> <p> <b>Tags are added at creation and cannot be updated with this operation</b> </p> <p> <code>PutConformancePack</code> is an idempotent API. Subsequent requests won't create a duplicate resource if one was already created. If a following request has different <code>tags</code> values, Config will ignore these differences and treat it as an idempotent request of the previous. In this case, <code>tags</code> will not be updated, even if they are different.</p> <p>Use <a href="https://docs.aws.amazon.com/config/latest/APIReference/API_TagResource.html">TagResource</a> and <a href="https://docs.aws.amazon.com/config/latest/APIReference/API_UntagResource.html">UntagResource</a> to update tags after creation.</p> </note>
Args:
conformance_pack_name: <p>The unique name of the conformance pack you want to deploy.</p>
template_s3_uri: <p>The location of the file containing the template body (<code>s3://bucketname/prefix</code>). The uri must point to a conformance pack template (max size: 300 KB) that is located in an Amazon S3 bucket in the same Region as the conformance pack. </p> <note> <p>You must have access to read Amazon S3 bucket. In addition, in order to ensure a successful deployment, the template object must not be in an <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html">archived storage class</a> if this parameter is passed.</p> </note>
template_body: <p>A string that contains the full conformance pack template body. The structure containing the template body has a minimum length of 1 byte and a maximum length of 51,200 bytes.</p> <note> <p>You can use a YAML template with two resource types: Config rule (<code>AWS::Config::ConfigRule</code>) and remediation action (<code>AWS::Config::RemediationConfiguration</code>).</p> </note>
delivery_s3_bucket: <p>The name of the Amazon S3 bucket where Config stores conformance pack templates.</p> <note> <p>This field is optional.</p> </note>
delivery_s3_key_prefix: <p>The prefix for the Amazon S3 bucket. </p> <note> <p>This field is optional.</p> </note>
conformance_pack_input_parameters: <p>A list of <code>ConformancePackInputParameter</code> objects.</p>
template_ssm_document_details: <p>An object of type <code>TemplateSSMDocumentDetails</code>, which contains the name or the Amazon Resource Name (ARN) of the Amazon Web Services Systems Manager document (SSM document) and the version of the SSM document that is used to create a conformance pack.</p>
tags: <p>The tags for the conformance pack. Each tag consists of a key and an optional value, both of which you define.</p>
Raises:
capo_config_service.errors.conformance_pack_template_validation_exception.ConformancePackTemplateValidationException: <p>You have specified a template that is not valid or supported.</p>
capo_config_service.errors.insufficient_permissions_exception.InsufficientPermissionsException: <p>Indicates one of the following errors:</p> <ul> <li> <p>For <a href="https://docs.aws.amazon.com/config/latest/APIReference/API_PutConfigRule.html">PutConfigRule</a>, the rule cannot be created because the IAM role assigned to Config lacks permissions to perform the config:Put* action.</p> </li> <li> <p>For <a href="https://docs.aws.amazon.com/config/latest/APIReference/API_PutConfigRule.html">PutConfigRule</a>, the Lambda function cannot be invoked. Check the function ARN, and check the function's permissions.</p> </li> <li> <p>For <a href="https://docs.aws.amazon.com/config/latest/APIReference/API_PutOrganizationConfigRule.html">PutOrganizationConfigRule</a>, organization Config rule cannot be created because you do not have permissions to call IAM <code>GetRole</code> action or create a service-linked role.</p> </li> <li> <p>For <a href="https://docs.aws.amazon.com/config/latest/APIReference/API_PutConformancePack.html">PutConformancePack</a> and <a href="https://docs.aws.amazon.com/config/latest/APIReference/API_PutOrganizationConformancePack.html">PutOrganizationConformancePack</a>, a conformance pack cannot be created because you do not have the following permissions: </p> <ul> <li> <p>You do not have permission to call IAM <code>GetRole</code> action or create a service-linked role.</p> </li> <li> <p>You do not have permission to read Amazon S3 bucket or call SSM:GetDocument.</p> </li> </ul> </li> <li> <p>For <a href="https://docs.aws.amazon.com/config/latest/APIReference/API_PutServiceLinkedConfigurationRecorder.html">PutServiceLinkedConfigurationRecorder</a>, a service-linked configuration recorder cannot be created because you do not have the following permissions: IAM <code>CreateServiceLinkedRole</code>.</p> </li> <li> <p>For <a href="https://docs.aws.amazon.com/config/latest/APIReference/API_PutConnector.html">PutConnector</a>, a connector cannot be created because you do not have the following permissions: IAM <code>CreateServiceLinkedRole</code>.</p> </li> </ul>
capo_config_service.errors.invalid_parameter_value_exception.InvalidParameterValueException: <p>One or more of the specified parameters are not valid. Verify that your parameters are valid and try again.</p>
capo_config_service.errors.max_number_of_conformance_packs_exceeded_exception.MaxNumberOfConformancePacksExceededException: <p>You have reached the limit of the number of conformance packs you can create in an account. For more information, see <a href="https://docs.aws.amazon.com/config/latest/developerguide/configlimits.html"> <b>Service Limits</b> </a> in the <i>Config Developer Guide</i>.</p>
capo_config_service.errors.resource_in_use_exception.ResourceInUseException: <p>You see this exception in the following cases: </p> <ul> <li> <p>For DeleteConfigRule, Config is deleting this rule. Try your request again later.</p> </li> <li> <p>For DeleteConfigRule, the rule is deleting your evaluation results. Try your request again later.</p> </li> <li> <p>For DeleteConfigRule, a remediation action is associated with the rule and Config cannot delete this rule. Delete the remediation action associated with the rule before deleting the rule and try your request again later.</p> </li> <li> <p>For PutConfigOrganizationRule, organization Config rule deletion is in progress. Try your request again later.</p> </li> <li> <p>For DeleteOrganizationConfigRule, organization Config rule creation is in progress. Try your request again later.</p> </li> <li> <p>For PutConformancePack and PutOrganizationConformancePack, a conformance pack creation, update, and deletion is in progress. Try your request again later.</p> </li> <li> <p>For DeleteConformancePack, a conformance pack creation, update, and deletion is in progress. Try your request again later.</p> </li> </ul>
capo_config_service.errors.UnknownServiceError: The service returned an error code this client does not model.
"""
def _handler(
req: "OperationRequest[capo_config_service.types.put_conformance_pack_request.PutConformancePackRequest]",
) -> OperationResponse[
"capo_config_service.types.put_conformance_pack_response.PutConformancePackResponse"
]:
import capo_config_service._operations.starling_dove_service.put_conformance_pack
output, http_response = (
capo_config_service._operations.starling_dove_service.put_conformance_pack.put_conformance_pack(
req.options, req.input
)
)
return OperationResponse(output=output, response=http_response)
interceptors_, options_ = self.operation_options(
config_overrides, OperationLogging("PutConformancePack")
)
input_: capo_config_service.types.put_conformance_pack_request.PutConformancePackRequest = {
"conformance_pack_name": conformance_pack_name
}
if template_s3_uri is not None:
input_["template_s3_uri"] = template_s3_uri
if template_body is not None:
input_["template_body"] = template_body
if delivery_s3_bucket is not None:
input_["delivery_s3_bucket"] = delivery_s3_bucket
if delivery_s3_key_prefix is not None:
input_["delivery_s3_key_prefix"] = delivery_s3_key_prefix
if conformance_pack_input_parameters is not None:
input_["conformance_pack_input_parameters"] = (
conformance_pack_input_parameters
)
if template_ssm_document_details is not None:
input_["template_ssm_document_details"] = template_ssm_document_details
if tags is not None:
input_["tags"] = tags
response = execute_pipeline(
OperationRequest(input=input_, options=options_),
handler=_handler,
interceptors=list(interceptors_),
)
response.response.close()
return response.output
|