Adding a Predefined Organization Rule

Principles

If you are an organization administrator or a delegated administrator of Config, you can add organization rules and deploy the rules to member accounts that are in the normal state in your organization.

A deployed organization rule will be displayed in the rule list of each member in the organization. An organization rule can only be modified or deleted with the account that was used to create it. Members can only trigger an organization rule and view evaluation results.

You can use a built-in policy or a custom policy to create an organization rule. This section describes how to create an organization rule based on a built-in policy.

Constraints and Limitations

• You can add up to 500 rules in an account.
• The resource recorder must be enabled for adding, modifying, and triggering organization rules. If the resource recorder is disabled, you can only view and delete organization rules.
• The Organization Rules tab is inaccessible for an account that is not associated any organizations.
• To deploy an organization rule to a member, the member account must be in the normal state, and the resource recorder must be enabled for the member.

Only resources captured by the resource recorder are eligible for compliance rule evaluation. To ensure consistent and accurate evaluation results, maintain the resource recorder in an enabled state. The following scenarios describe the impact of recorder status on compliance:

• Recorder disabled: Compliance rules cannot evaluate resource data while the recorder is inactive. However, previously generated evaluation results remain available.
• Partial scope: If the monitoring scope is restricted to a subset of resources, compliance rules will only evaluate the selected resources.

For details about how to enable and configure the resource recorder, see Configuring the Resource Recorder.

Procedure

1. Log in to the Config console as an organization administrator or the delegated administrator of Config.
2. In the navigation pane on the left, choose Resource Conformance.
3. Select the Organization Rules tab and click Add Rule. Complete the basic configurations and click Next.
   Figure 1 Basic configuration
   

   Table 1 Parameters of the basic configuration

   Parameter	Description
   Policy Type	Select Built-in policy. Built-in policies are provided by Config. You can select a built-in policy to quickly add a rule. You can also search for a built-in policy by policy name or tag. For more information about built-in policies, see Built-In Policies.
   Rule Name	By default, the predefined policy name is reused as the rule name. A rule name must be unique. A rule name can contain only digits, letters, underscores (_), and hyphens (-).
   Description	By default, the rule description is the same as the description of the predefined policy. You can also customize the rule description. There are no restrictions on the rule description.

4. On the displayed Configure Rule Parameters page, configure required parameters and click Next.
   Figure 2 Rule parameters
   

   Table 2 Rule parameter description

   Parameter	Description
   Trigger Type	Specifies the conditions under which rules are triggered. Trigger types are as follows: Configuration change: allows Config to trigger an evaluation for the rule upon resource configuration changes. Periodic execution: triggers an evaluation for the rule at a specific frequency.
   Filter Type	Specifies the resource scope. Filter types are as follows: Specific resources: resources of a specific type All resources: all resources of your account This parameter is mandatory only when Trigger Type is set to Configuration change.
   Resource Scope	If you set Filter Type to Specific resources, you need to specify a resource scope. Service: the service to which the resource belongs Resource type: the resource type Region: the region where the resource is deployed This parameter is mandatory only when Trigger Type is set to Configuration change.
   (Optional) Filter Scope	Resources you want to filter for. This option allows you to filter for resources by ID or tag. This parameter is mandatory only when Trigger Type is set to Configuration change.
   Execute Every	How often a rule is triggered. This parameter is mandatory only when Trigger Type is set to Periodic execution.
   Rule Parameter	Parameters of a built-in policy. For example, if you select the required-tag-check policy, you need to specify a tag, so that resources that do not have the tag will be determined as non-compliant. Not all built-in policies require Configure Rule Parameters. For example, the rule, volumes-encrypted-check, does not require Configure Rule Parameters.
   Destination	Where the organization rule will be deployed. Organization indicates that a policy will be deployed to all member accounts in a specified organization. Current Account indicates that a policy will be deployed to the current account. When creating an organization rule, select Organization.
   Excluded Account	Member accounts to which organization rules will not be deployed. This parameter is only required when Destination is set to Organization.

5. Confirm rule information and click Submit.
   Figure 3 Confirming a rule
   
   

   After you add a rule, the first evaluation is automatically triggered immediately.

Verification

1. Go back to the Resource Conformance page. The new organization rule is displayed in the list in the Organization Rules tab.

   

2. Click the name of the organization rule. On the rule details page, if the policy type is Built-in policy, the organization rule was successfully added.

   

Triggering a Rule Evaluation

For details about how a member can trigger an organization rule, see Triggering Rules.

Helpful Links

• Why Is the Organization Rules Tab Not Displayed on the Console?
• Why Can't I Modify the Trigger Type of a Built-in Organization Rule?