How can I use AWS Config to notify me when an AWS resource is non-compliant?

Short description

To match an AWS Config evaluation rule output as NON_COMPLIANT, first create an EventBridge rule with a custom event pattern and an input transformer. Then, route the response from EventBridge to an Amazon Simple Notification Service (Amazon SNS) topic.

Resolution

In the following example, EventBridge sends Amazon SNS notifications when the ec2-security-group-attached-to-eni managed rule reports AWS resources as NON_COMPLIANT. The non-compliant resource is an Amazon Elastic Compute Cloud (Amazon EC2) security group.

Note: You can replace the resourceType and configRuleName fields with the actual values from the Config rule that you use.

Complete the following steps:

1. Create an Amazon SNS topic. If you have an existing Amazon SNS topic, then continue to the next step. Important: The Amazon SNS topic must be in the same AWS Region as your AWS Config service.

2. Open the EventBridge console.

3. Select EventBridge Rule with event pattern, and then choose Create rule.

4. Select Visual rule builder opt in, and then enter the following information:For Name, enter a name for your rule.(Optional) For Description, enter a description of the rule. Then, choose Next.

5. For Event source, choose AWS events or EventBridge partner events.

6. Under Creation method, choose Custom pattern (JSON editor), and then enter the following example event pattern:

   { 
     "source": [ 
       "aws.config" 
     ], 
     "detail-type": [ 
       "Config Rules Compliance Change" 
     ], 
     "detail": { 
       "messageType": [ 
         "ComplianceChangeNotification" 
       ], 
       "configRuleName": [ 
         "ec2-security-group-attached-to-eni" 
       ], 
       "resourceType": [ 
         "AWS::EC2::SecurityGroup" 
       ], 
       "newEvaluationResult": { 
         "complianceType": [ 
           "NON_COMPLIANT" 
         ] 
       } 
     } 
   }  

7. Choose Next.

8. On the Select target(s) screen, enter the following information:
   For Target types, choose AWS service.
   For Select a target, choose SNS topic.
   For Topic, choose your SNS topic.
   Under Additional settings, for Configure target input, choose Input transformer. Choose Configure input transformer. Under Target input transformer, for the Input Path text box, enter the following example path:

   { 
     "awsRegion": "$.detail.awsRegion", 
     "resourceId": "$.detail.resourceId", 
     "awsAccountId": "$.detail.awsAccountId", 
     "compliance": "$.detail.newEvaluationResult.complianceType", 
     "rule": "$.detail.configRuleName", 
     "time": "$.detail.newEvaluationResult.resultRecordedTime", 
     "resourceType": "$.detail.resourceType" 
   }  

   For Template, enter the following example template:
   "On  AWS Config rule evaluated the with Id in the account in the as. For more details open the AWS Config console at https://console.aws.amazon.com/config/home?region=<awsRegion>#/timeline/<resourceType>/<resourceId>/configuration"

9. Choose Confirm.

10. Choose Next, and then choose Next.

11. Choose Create rule.

After your resources trigger an event type, you receive an SNS email notification with the custom fields populated.

Example:

"On ExampleTime AWS Config rule ExampleRuleName evaluated the ExampleResourceType with Id ExampleResource_ID in the account ExampleAccount_ID in the Region ExampleRegion as ExampleComplianceType. For more details open the AWS Config console at https://console.aws.amazon.com/config/home?region=ExampleRegion#/timeline/ExampleResourceType/ExampleResource_ID/configuration"

Related information

How do I get notifications when changes happen to my Route 53 hosted zone records?

How do I set up custom email notifications when AWS Config detects new resources?

How do I configure EventBridge rules for GuardDuty to send custom SNS notifications for specific service finding types?