AWS Config Rule

The AWS Config Rule check fetches AWS Config rule compliance and fails when matching rules are non-compliant. It skips INSUFFICIENT_DATA and NOT_APPLICABLE results.

aws-config-rule.yaml
apiVersion: canaries.flanksource.com/v1
kind: Canary
metadata:
  name: awsconfigrule-pass
spec:
  schedule: "@every 5m"
  awsConfigRule:
    - name: AWS Config Rule
      region: "eu-west-1"
      complianceTypes: [NON_COMPLIANT]
      transform:
        expr: |
          results.rules.map(i,
            i.resources.map(r,
             {
              'name': i.rule + "/" + r.type + "/" + r.id,
              'description': i.rule,
              'icon': 'aws-config-alarm',
              'duration': time.Since(timestamp(r.recorded)).getMilliseconds(),
              'labels': {'id': r.id, 'type': r.type},
              'message': i.description + i.annotation + r.annotation
            })
          ).flatten().toJSON()

Field	Description	Scheme
name*	Name of the check, must be unique within the canary	string
accessKey	Access Key ID	EnvVar
assumeRole	Role ARN to assume	string
complianceTypes	Filters the results by compliance. The allowed values are INSUFFICIENT_DATA, NON_COMPLIANT, NOT_APPLICABLE, COMPLIANT	[]string
connection	The connection url to use, mutually exclusive with accessKey and secretKey	Connection
endpoint	Custom AWS Endpoint to use	string
ignoreRules	List of rules which would be omitted from the fetch result	[]string
region	The AWS region	string
rules	Specify one or more Config rule names to filter the results by rule	[]string
secretKey	Secret Access Key	EnvVar
sessionToken	Session token	EnvVar
skipTLSVerify	Skip TLS verify when connecting to AWS	boolean
dependsOn	Checks that must complete before this check runs	[]string
description	Description for the check	string
display	Expression to change the formatting of the display	Expression
icon	Icon for overwriting default icon on the dashboard	Icon
labels	Labels for check	[map[string]string]
markFailOnEmpty	If a transformation or datasource returns empty results, the check should fail	boolean
metrics	Metrics to export from	[]Metrics
namespace	Namespace to insert the check result into when it differs from the canary namespace	string
relationships	Relationships that link check results to components or configs	Relationship
test	Evaluate whether a check is healthy	Expression
transform	Transform data from a check into multiple individual checks	Expression
transformDeleteStrategy	Status to apply to transformed checks when the source check no longer returns them	string