How to enable Cloudformation Hook for AWS Config Proactive Compliance Check

Question

This article https://aws.amazon.com/blogs/aws/new-aws-config-rules-now-support-proactive-compliance/ casually mentions that:

"When deploying using AWS CloudFormation, I can set up a CloudFormation hook to proactively check my configuration before the actual deployment happens.".

However, after searching the documentation and blocks I have not been able to find a description of how this is done.

Let say that that I would like to have the AWS Managed Config rule "lambda-inside-vpc" run when creating a Cloudformation stack and I want the creation to fail if the lambda in the stack is not within a VPC. How to setup that Cloudformation Hook - that is what I'm asking.

I don't see the AWS Managed Config Rules listed under Cloudformation -> Registry.

Please note that I'm *not* asking for documentation on how to set up a Cloudformation Custom Hook using java or python (as this is easily googable). I'm asking how to setup a Cloudformation Hook to invoke a proactive AWS Config rule.

Heverin, Stephen · Answer

We had a [Twitch AWS OnAir show](https://www.twitch.tv/videos/2355987066) this past Friday which dove into CloudFormation hooks, including a re:Post segment where we covered a number of re:Post user questions on this topic. Starting at 34:45. We provided more guidance on this answer, specifically that you can leverage Lambda hook to call an AWS Config proactive control. Another option would be to leverage CloudFormation Guard controls We have a [repository](https://github.com/aws-cloudformation/aws-guard-rules-registry/tree/main) of already build controls that you can leverage to apply checks there. This would be seperate from the AWS Config rule you may have in place, but can provide an easier path then deploying a lambda to call the AWS Config rule.

Trevor Schiavone · Answer

Hi Johan,
at this time there isn't an AWS or community published hook in the CloudFormation public registry to call AWS Config, so you would have to privately register the hook yourself.

If this is still something you're looking to do, a sample of a hook that calls Config for proactive evaluation can be found in the [community registry extensions GitHub repository](https://github.com/aws-cloudformation/community-registry-extensions/tree/main/hooks/Config_ProactiveEvaluation).

Didier Durand · Answer

Hi, documentation to develop Cloudformation Hooks is here: https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/hooks-walkthrough-python.html

This is a complete example showing how to verify /validate EC2 instance types launched by CFN: https://github.com/aws-cloudformation/aws-cloudformation-samples/blob/main/hooks/java-hooks/ec2-instance-types/README.md

Hope it helps!
Didier

How to enable Cloudformation Hook for AWS Config Proactive Compliance Check

Add your answer

Relevant content