How to enable Cloudformation Hook for AWS Config Proactive Compliance Check

Question

This article https://aws.amazon.com/blogs/aws/new-aws-config-rules-now-support-proactive-compliance/ casually mentions that:

"When deploying using AWS CloudFormation, I can set up a CloudFormation hook to proactively check my configuration before the actual deployment happens.".

However, after searching the documentation and blocks I have not been able to find a description of how this is done.

Let say that that I would like to have the AWS Managed Config rule "lambda-inside-vpc" run when creating a Cloudformation stack and I want the creation to fail if the lambda in the stack is not within a VPC. How to setup that Cloudformation Hook - that is what I'm asking.

I don't see the AWS Managed Config Rules listed under Cloudformation -> Registry.

Please note that I'm *not* asking for documentation on how to set up a Cloudformation Custom Hook using java or python (as this is easily googable). I'm asking how to setup a Cloudformation Hook to invoke a proactive AWS Config rule.

Answer

Hi, documentation to develop Cloudformation Hooks is here: https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/hooks-walkthrough-python.html

This is a complete example showing how to verify /validate EC2 instance types launched by CFN: https://github.com/aws-cloudformation/aws-cloudformation-samples/blob/main/hooks/java-hooks/ec2-instance-types/README.md

Hope it helps!
Didier

Answer

Hi Johan,
at this time there isn't an AWS or community published hook in the CloudFormation public registry to call AWS Config, so you would have to privately register the hook yourself.

If this is still something you're looking to do, a sample of a hook that calls Config for proactive evaluation can be found in the [community registry extensions GitHub repository](https://github.com/aws-cloudformation/community-registry-extensions/tree/main/hooks/Config_ProactiveEvaluation).

How to enable Cloudformation Hook for AWS Config Proactive Compliance Check

Relevant content