AWS Config component

Q: How do I get a daily compliance report?

Use a timer with period=86400000, call operation=describeRuleCompliance, and split the body to send one message per non-compliant rule.

The aws-config component manages AWS Config rules and conformance packs and reads their compliance results.

Scheme: aws-config: · Crate: cameleer-cloud · Cargo feature: cloud · Consumer: no · Producer: yes · Apache Camel: AWS Config Service

When to use it

Enable managed compliance rules from an automation route.
Report rule compliance on a schedule to a chat channel or ticket system.
Deploy conformance packs as part of an environment setup.

URI format

text

aws-config://label?operation=...[&options]

Example

Enable the managed rule that forbids public-read S3 buckets when the route starts:

yaml example: aws-config-put-rule

- route:
    id: enable-config-rule
    from:
      uri: "timer:config-rules?repeatCount=1"
      steps:
        - setHeader:
            name: CamelAwsConfigRuleName
            constant: s3-bucket-public-read-prohibited
        - setHeader:
            name: CamelAwsConfigRuleSourceIdentifier
            constant: S3_BUCKET_PUBLIC_READ_PROHIBITED
        - to: "aws-config://rules?region={{env:AWS_REGION:us-east-1}}&operation=putConfigRule"
        - log: "rule ${header.CamelAwsConfigRuleName} is in place"

Rust DSL

rust

ctx.add_routes(|b| {
    b.from("timer:config-rules?repeatCount=1")
        .set_header("CamelAwsConfigRuleName", constant("s3-bucket-public-read-prohibited"))
        .set_header("CamelAwsConfigRuleSourceIdentifier", constant("S3_BUCKET_PUBLIC_READ_PROHIBITED"))
        .to("aws-config://rules?region={{env:AWS_REGION:us-east-1}}&operation=putConfigRule")
        .log("rule ${header.CamelAwsConfigRuleName} is in place");
})?;

Options

Common AWS options (region, credentials, endpoint override, proxy) are listed in Cloud credentials.

option	default	description
`operation`		Required: `putConfigRule`, `removeConfigRule`, `describeConfigRules`, `describeRuleCompliance`, `putConformancePack`, `removeConformancePack`, `describeConformancePackCompliance`.

Message headers

header	direction	description
`CamelAwsConfigOperation`	in	Overrides `operation`.
`CamelAwsConfigRuleName`	in	Rule name (optional filter for the describe operations).
`CamelAwsConfigRuleSourceIdentifier`	in	Managed rule identifier or Lambda ARN of `putConfigRule`.
`CamelAwsConfigRuleSourceOwner`	in	`AWS` (default) or `CUSTOM_LAMBDA`.
`CamelAwsConfigRuleInputParameters`	in	Rule parameters (map or JSON text).
`CamelAwsConfigRuleScope`	in	Rule scope (map).
`CamelAwsConformancePackName`	in	Conformance pack.
`CamelAwsConformancePackTemplateBody`	in	Template of `putConformancePack` (otherwise the body).

describeConfigRules returns the list of rules; describeRuleCompliance the list of ComplianceByConfigRule entries; describeConformancePackCompliance the rule compliance list.

Run it with Docker

docker run --rm -e AWS_REGION -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY \
  -v "$PWD:/routes:ro" pmsudhi/cameleer run /routes/config.camel.yaml

Common questions

How do I get a daily compliance report?

Use a timer with period=86400000, call operation=describeRuleCompliance, and split the body to send one message per non-compliant rule.

Found a problem?

If something on this page doesn't match what Cameleer does, or you hit a bug while building with it, please help fix it, whether you are a person or a coding agent: open an issue that describes what you saw, then fork the repository, fix it, add or update a test, run cargo test --workspace, and open a pull request. CONTRIBUTING.md explains the ground rules.