AWS Config

10 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

ConfigAggregationAuthorization # CLOUD CONTROL · AWS::Config::AggregationAuthorization

ConfigAggregationAuthorization manages AWS::Config::AggregationAuthorization through the AWS Cloud Control API.

kubectl get configaggregationauthorizations · example on GitHub

Example

# ConfigAggregationAuthorization — AWS Config
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/configservice.html#configaggregationauthorization
apiVersion: aws.konfig.io/v1alpha1
kind: ConfigAggregationAuthorization
metadata:
  name: example-configaggregationauthorization
  namespace: default
spec:
  authorizedAccountId: '123456789012'
  authorizedAwsRegion: example
  providerRef:
    name: example-configaggregationauthorization
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`authorizedAccountId`	string	yes	The 12-digit account ID of the account authorized to aggregate data.
`authorizedAwsRegion`	string	yes	The region authorized to collect aggregated data.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for the AggregationAuthorization.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`aggregationAuthorizationArn`	string	—	The ARN of the AggregationAuthorization.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

ConfigConfigurationAggregator # CLOUD CONTROL · AWS::Config::ConfigurationAggregator

ConfigConfigurationAggregator manages AWS::Config::ConfigurationAggregator through the AWS Cloud Control API.

kubectl get configconfigurationaggregators · example on GitHub

Example

# ConfigConfigurationAggregator — AWS Config
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/configservice.html#configconfigurationaggregator
apiVersion: aws.konfig.io/v1alpha1
kind: ConfigConfigurationAggregator
metadata:
  name: example-configconfigurationaggregator
  namespace: default
spec:
  accountAggregationSources:
  - accountIds:
    - example
    allAwsRegions: false
    awsRegions:
    - example
  configurationAggregatorName: example-configconfigurationaggregator
  organizationAggregationSource:
    allAwsRegions: false
    awsRegions:
    - example
    roleArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-configconfigurationaggregator
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`accountAggregationSources`	array<object>	—
`accountAggregationSources[].accountIds`	array<string>	yes
`accountAggregationSources[].allAwsRegions`	boolean	—
`accountAggregationSources[].awsRegions`	array<string>	—
`configurationAggregatorName`	string	—	The name of the aggregator.
`organizationAggregationSource`	object	—	ConfigConfigurationAggregatorOrganizationAggregationSource is a nested property type of AWS::Config::ConfigurationAggregator.
`organizationAggregationSource.allAwsRegions`	boolean	—
`organizationAggregationSource.awsRegions`	array<string>	—
`organizationAggregationSource.roleArn`	string	yes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for the configuration aggregator.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`configurationAggregatorArn`	string	—	The Amazon Resource Name (ARN) of the aggregator.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

ConfigConformancePack # CLOUD CONTROL · AWS::Config::ConformancePack

ConfigConformancePack manages AWS::Config::ConformancePack through the AWS Cloud Control API.

kubectl get configconformancepacks · example on GitHub

Example

# ConfigConformancePack — AWS Config
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/configservice.html#configconformancepack
apiVersion: aws.konfig.io/v1alpha1
kind: ConfigConformancePack
metadata:
  name: example-configconformancepack
  namespace: default
spec:
  conformancePackInputParameters:
  - parameterName: example-configconformancepack
    parameterValue: example
  conformancePackName: example-configconformancepack
  deliveryS3Bucket: example
  deliveryS3KeyPrefix: example
  providerRef:
    name: example-configconformancepack
    region: us-east-1
  tags:
  - key: example
    value: example
  templateBody: example
  templateS3Uri: example
  templateSSMDocumentDetails:
    documentName: example-configconformancepack
    documentVersion: '1.0'

Spec

Field	Type	Required	Description
`conformancePackInputParameters`	array<object>	—	A list of ConformancePackInputParameter objects.
`conformancePackInputParameters[].parameterName`	string	yes
`conformancePackInputParameters[].parameterValue`	string	yes
`conformancePackName`	string	yes	Name of the conformance pack which will be assigned as the unique identifier.
`deliveryS3Bucket`	string	—	AWS Config stores intermediate files while processing conformance pack template.
`deliveryS3KeyPrefix`	string	—	The prefix for delivery S3 bucket.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for the conformance pack.
`tags[].key`	string	yes
`tags[].value`	string	yes
`templateBody`	string	—	A string containing full conformance pack template body.
`templateS3Uri`	string	—	Location of file containing the template body which points to the conformance pack template that is located in an Amazon S3 bucket.
`templateSSMDocumentDetails`	object	—	The TemplateSSMDocumentDetails object contains the name of the SSM document and the version of the SSM document.
`templateSSMDocumentDetails.documentName`	string	—
`templateSSMDocumentDetails.documentVersion`	string	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`conformancePackArn`	string	—	Amazon Resource Name (ARN) of the conformance pack.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

ConfigConnector # CLOUD CONTROL · AWS::Config::Connector

ConfigConnector manages AWS::Config::Connector through the AWS Cloud Control API.

kubectl get configconnectors · example on GitHub

Example

# ConfigConnector — AWS Config
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/configservice.html#configconnector
apiVersion: aws.konfig.io/v1alpha1
kind: ConfigConnector
metadata:
  name: example-configconnector
  namespace: default
spec:
  connectorConfiguration:
    azure:
      clientIdentifier: example
      tenantIdentifier: example
  providerRef:
    name: example-configconnector
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`connectorConfiguration`	object	yes	The configuration for the connector that specifies the third-party cloud provider connection details.
`connectorConfiguration.azure`	object	—	The configuration for connecting to Microsoft Azure.
`connectorConfiguration.azure.clientIdentifier`	string	yes	The Azure client (application) identifier.
`connectorConfiguration.azure.tenantIdentifier`	string	yes	The Azure tenant identifier.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for the connector.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the connector.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdTime`	string	—	The time at which the connector was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`name`	string	—	The name of the connector.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

ConfigDeliveryChannel # GA

ConfigDeliveryChannel is the Schema for managing AWS Config delivery channels.

kubectl get configdeliverychannels · example on GitHub

Example

# ConfigDeliveryChannel — AWS Config
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/configservice.html#configdeliverychannel
apiVersion: aws.konfig.io/v1alpha1
kind: ConfigDeliveryChannel
metadata:
  name: example-configdeliverychannel
  namespace: default
spec:
  channelName: example-configdeliverychannel
  deliveryFrequency: One_Hour
  providerRef:
    name: example-configdeliverychannel
    region: us-east-1
  s3BucketName: example-configdeliverychannel
  s3KeyPrefix: example
  snsTopicARN: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`channelName`	string	yes	ChannelName is the name of the delivery channel.
`deliveryFrequency`	enum	—	DeliveryFrequency is how often Config delivers configuration snapshots. Allowed: `One_Hour, Three_Hours, Six_Hours, Twelve_Hours, TwentyFour_Hours`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`s3BucketName`	string	yes	S3BucketName is the S3 bucket to which Config delivers configuration snapshots and history files.
`s3KeyPrefix`	string	—	S3KeyPrefix is the prefix for the S3 bucket.
`snsTopicARN`	string	—	SNSTopicARN is the SNS topic to which Config sends notifications.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`channelName`	string	—	ChannelName is the name of the delivery channel in AWS.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

ConfigOrganizationConformancePack # CLOUD CONTROL · AWS::Config::OrganizationConformancePack ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: organization-wide conformance pack deployed to all accounts. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. ConfigOrganizationConformancePack manages AWS::Config::OrganizationConformancePack through the AWS Cloud Control API.

kubectl get configorganizationconformancepacks · example on GitHub

Example

# ConfigOrganizationConformancePack — AWS Config
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/configservice.html#configorganizationconformancepack
apiVersion: aws.konfig.io/v1alpha1
kind: ConfigOrganizationConformancePack
metadata:
  name: example-configorganizationconformancepack
  namespace: default
spec:
  conformancePackInputParameters:
  - parameterName: example-configorganizationconformancepack
    parameterValue: example
  deliveryS3Bucket: example
  deliveryS3KeyPrefix: example
  excludedAccounts:
  - example
  organizationConformancePackName: example-configorganizationconformancepack
  providerRef:
    name: example-configorganizationconformancepack
    region: us-east-1
  tags:
  - key: example
    value: example
  templateBody: example
  templateS3Uri: example

Spec

Field	Type	Required	Description
`conformancePackInputParameters`	array<object>	—	A list of ConformancePackInputParameter objects.
`conformancePackInputParameters[].parameterName`	string	yes
`conformancePackInputParameters[].parameterValue`	string	yes
`deliveryS3Bucket`	string	—	AWS Config stores intermediate files while processing conformance pack template.
`deliveryS3KeyPrefix`	string	—	The prefix for the delivery S3 bucket.
`excludedAccounts`	array<string>	—	A list of AWS accounts to be excluded from an organization conformance pack while deploying a conformance pack.
`organizationConformancePackName`	string	yes	The name of the organization conformance pack.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for the organization conformance pack.
`tags[].key`	string	yes
`tags[].value`	string	yes
`templateBody`	string	—	A string containing full conformance pack template body.
`templateS3Uri`	string	—	Location of file containing the template body.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`organizationConformancePackArn`	string	—	Amazon Resource Name (ARN) of the organization conformance pack.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

ConfigRecorder # GA

ConfigRecorder is the Schema for managing AWS Config configuration recorders.

kubectl get configrecorders · example on GitHub

Example

# ConfigRecorder — AWS Config
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/configservice.html#configrecorder
apiVersion: aws.konfig.io/v1alpha1
kind: ConfigRecorder
metadata:
  name: example-configrecorder
  namespace: default
spec:
  enabled: true
  providerRef:
    name: example-configrecorder
    region: us-east-1
  recorderName: example-configrecorder
  recordingGroup:
    allSupported: false
    includeGlobalResourceTypes: false
    resourceTypes:
    - example
  roleARN: arn:aws:iam::123456789012:role/example-role
  roleRef:
    name: example-role

Spec

Field	Type	Required	Description
`enabled`	boolean	—	Enabled starts (true) or stops (false) the configuration recorder.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`recorderName`	string	yes	RecorderName is the name of the configuration recorder.
`recordingGroup`	object	—	RecordingGroup selects which resource types are recorded.
`recordingGroup.allSupported`	boolean	—	AllSupported records configuration changes for all supported regional resource types.
`recordingGroup.includeGlobalResourceTypes`	boolean	—	IncludeGlobalResourceTypes also records global resource types (IAM).
`recordingGroup.resourceTypes`	array<string>	—	ResourceTypes lists specific resource types to record (e.g.
`roleARN`	string	—	RoleARN is the IAM role ARN assumed by AWS Config.
`roleRef`	object	—	RoleRef references an IAMRole CR whose ARN to use.
`roleRef.arn`	string	—	ARN is a direct AWS IAM role ARN.
`roleRef.name`	string	—	Name of an IAMRole CR in the same namespace.
`roleRef.namespace`	string	—	Namespace of the IAMRole CR.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`recorderName`	string	—	RecorderName is the name of the recorder in AWS.
`recording`	boolean	—	Recording reports whether the recorder is currently recording.

ConfigRemediationConfiguration # CLOUD CONTROL · AWS::Config::RemediationConfiguration

ConfigRemediationConfiguration manages AWS::Config::RemediationConfiguration through the AWS Cloud Control API.

kubectl get configremediationconfigurations · example on GitHub

Example

# ConfigRemediationConfiguration — AWS Config
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/configservice.html#configremediationconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: ConfigRemediationConfiguration
metadata:
  name: example-configremediationconfiguration
  namespace: default
spec:
  automatic: false
  configRuleName: example-configremediationconfiguration
  executionControls:
    ssmControls:
      concurrentExecutionRatePercentage: 1
      errorPercentage: 1
  maximumAutomaticAttempts: 1
  providerRef:
    name: example-configremediationconfiguration
    region: us-east-1
  resourceType: example
  retryAttemptSeconds: 300
  targetId: example-id
  targetType: example
  targetVersion: '1.0'

Spec

Field	Type	Required	Description
`automatic`	boolean	—
`configRuleName`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`executionControls`	object	—	ConfigRemediationConfigurationExecutionControls is a nested property type of AWS::Config::RemediationConfiguration.
`executionControls.ssmControls`	object	—	ConfigRemediationConfigurationSsmControls is a nested property type of AWS::Config::RemediationConfiguration.
`executionControls.ssmControls.concurrentExecutionRatePercentage`	integer	—
`executionControls.ssmControls.errorPercentage`	integer	—
`maximumAutomaticAttempts`	integer	—
`parameters`	object	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceType`	string	—
`retryAttemptSeconds`	integer	—
`targetId`	string	yes
`targetType`	string	yes
`targetVersion`	string	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

ConfigRule # GA

ConfigRule is the Schema for managing AWS Config rules.

kubectl get configrules · example on GitHub

Example

# ConfigRule — AWS Config
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/configservice.html#configrule
apiVersion: aws.konfig.io/v1alpha1
kind: ConfigRule
metadata:
  name: example-configrule
  namespace: default
spec:
  description: Managed by konfig-konector
  inputParameters: example
  maximumExecutionFrequency: One_Hour
  providerRef:
    name: example-configrule
    region: us-east-1
  ruleName: example-configrule
  scope:
    complianceResourceTypes:
    - example
    tagKey: example
    tagValue: example
  sourceIdentifier: example
  sourceOwner: AWS

Spec

Field	Type	Required	Description
`description`	string	—	Description of the rule.
`inputParameters`	string	—	InputParameters is a JSON string passed to the rule.
`maximumExecutionFrequency`	enum	—	MaximumExecutionFrequency is the maximum frequency of evaluations for periodic rules. Allowed: `One_Hour, Three_Hours, Six_Hours, Twelve_Hours, TwentyFour_Hours`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`ruleName`	string	yes	RuleName is the name of the Config rule.
`scope`	object	—	Scope constrains which resources trigger an evaluation.
`scope.complianceResourceTypes`	array<string>	—	ComplianceResourceTypes are the resource types that trigger evaluation (e.g.
`scope.tagKey`	string	—	TagKey triggers evaluation for resources with this tag key.
`scope.tagValue`	string	—	TagValue triggers evaluation for resources with this tag value.
`sourceIdentifier`	string	yes	SourceIdentifier is the managed rule identifier (e.g.
`sourceOwner`	enum	yes	SourceOwner indicates who owns the rule: AWS for managed rules, CUSTOM_LAMBDA for custom Lambda rules. Allowed: `AWS, CUSTOM_LAMBDA`

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`ruleArn`	string	—	RuleARN is the ARN of the Config rule.
`ruleId`	string	—	RuleID is the ID of the Config rule.

ConfigStoredQuery # CLOUD CONTROL · AWS::Config::StoredQuery

ConfigStoredQuery manages AWS::Config::StoredQuery through the AWS Cloud Control API.

kubectl get configstoredqueries · example on GitHub

Example

# ConfigStoredQuery — AWS Config
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/configservice.html#configstoredquery
apiVersion: aws.konfig.io/v1alpha1
kind: ConfigStoredQuery
metadata:
  name: example-configstoredquery
  namespace: default
spec:
  providerRef:
    name: example-configstoredquery
    region: us-east-1
  queryDescription: Managed by konfig-konector
  queryExpression: example
  queryName: example-configstoredquery
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`queryDescription`	string	—
`queryExpression`	string	yes
`queryName`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`tags`	array<object>	—	The tags for the stored query.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`queryArn`	string	—	Read-only: reported by AWS after creation.
`queryId`	string	—	Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.