AWS Config Rules - Certain rules don't allow you to use Scope
Hello, I'm trying to use AWS Config rules to only track resources with specific tags.
From what I understand, I should be able to use the 'Scope' attribute for each rule.
I've found that certain rules don't let you use the 'Scope' attribute, so I am automatically tracking every resource for those rules. See screenshots below.
Is this intended or is there any fix for this?
Thank you
Doesn't allow scope -
Allows scope -
- 新しい順
- 投票が多い順
- コメントが多い順
Hello, it does not necessarily depend on the rule per se, it depends on the Trigger type of the rule, where in the 2nd case it gets triggered when there is a configuration change (therefore you have options to choose which resources/scope) whereas in the 1st case its triggered periodically, which does not depend on the resources. And of course some rules are triggered one way or the other depending on the nature.
Hope this helps. Thanks!
Hello, thank you for the response!
Just to clarify - so in the case of the vpc-flow-logs-enabled rule, there is no way to filter the scope since the trigger type is periodic?
Correct. Some rules are triggered based on the scope, some periodic, and there is also hybrid. For hybrid rules both configuration change and periodic triggers. For these rules, AWS Config evaluates your resources when it detects a configuration change and also at the frequency that you specify. You can learn more about Trigger types here. https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config-rules.html
If there are any further questions feel free to ask. If this answer is satisfactory to you please mark it as accepted. Thanks!
And specifically for vpc-flow-logs-enabled rule Trigger type is Periodic, as documented here. https://docs.aws.amazon.com/config/latest/developerguide/vpc-flow-logs-enabled.html
関連するコンテンツ
AWS公式更新しました 10ヶ月前- AWS公式更新しました 3年前
If there are any further questions feel free to ask. If the answer below is satisfactory to you please mark it as accepted. Thanks!