Creating a Custom Organization Rule

Scenario

You can create custom organization rules to supplement predefined ones.

To create custom rules, you need to use Use of FunctionGraph functions. Each rule is associated with a Function Graph function. Config reports events to the function. The function collects rule parameters and resource attributes from the events; evaluates whether your resources comply with the rule; and return evaluation results using Open APIs of Config. The function is invoked either in response to configuration changes or periodically. When adding a custom organization rule, you need to share the associated FunctionGraph functions with your organization members through RAM.

This section describes how to create a custom organization rule by following steps:

1. Creating a function using FunctionGraph
2. Sharing a FunctionGraph Function
3. Creating a Custom Organization Rule
4. Triggering a Rule

Constraints and Limitations

• You can add up to 500 rules in an account.
• The resource recorder must be enabled for adding, modifying, and triggering organization rules. If the resource recorder is disabled, you can only view and delete organization rules.
• The Organization Rules tab is inaccessible for an account that is not associated any organizations.
• To deploy an organization rule to a member, the member account must be in the normal state, and the resource recorder must be enabled for the member.

NOTICE:

To evaluate resources with rules, you need to enable the resource recorder. Resource evaluation is subject to the following rules:

• If the resource recorder is disabled, no resources will be available for evaluation. You can still view historical evaluation results.
• If the resource recorder is enabled and a monitoring scope is configured, only resources within the monitoring scope can be evaluated.

For details about how to enable and configure the resource recorder, see Configuring the Resource Recorder.

Creating a function using FunctionGraph

1. Log in to the FunctionGraph console. In the navigation pane on the left, choose Functions > Function List.
2. In the upper right corner, click Create Function.
3. Set Function Type to Event Function and configure the required IAM agency. The agency grants the function required permissions, including rms:policyStates:update.
4. Click Create Function and then on the Code tab, configure the code.
5. Click Deploy.

   For details about example code, see Example Functions (Python).

6. Click Configurations, modify Execution Timeout (s) and Memory (MB) in the Basic Settings area as required. Configure Concurrency.
7. Click Save.

   For details, see Creating an Event Function.

Sharing a FunctionGraph Function

1. Log in to the Config console as an organization administrator or an agency administrator of Config.
2. Click in the upper left corner and choose Management & Governance > Resource Access Manager. The Resource Access Manager page is displayed.
3. Choose Shared by Me > Resource Shares.
4. In the upper right corder, click Create Resource Share. In the Basic Information area, configure basic information. In the Resources to Share area, select functiongraph:function, and then select a function that is displayed. Click Next: Associate Permissions.
   Figure 1 Specifying Resources to Share
   

5. Click default FunctionGraph function statement and click Next: Specify Principals.
   Figure 2 Associate Permissions
   

6. On the Grant Access to Principals page, specify principals and click Next: Confirm in the lower right corner.
   • If you select Allow sharing only within your organization for Principals allowed access, you can only grant access to members in your organization.
   • If you select Organization for Principal Type and then select Root, all members in your organization can access the function.
   NOTE:

   If you haven't enabled resource sharing with organizations, you cannot set Principal Type to Organization. To learn about how to enable resource sharing with organizations, see Enabling Sharing with Organizations.

   Figure 3 Specifying principals
   

7. Review and confirm the configuration details of your resource share and select I have read and agree to Privacy Statement on the Confirm page. Then, click Submit in the lower right corner.

Creating a Custom Organization Rule

1. Log in to the management console.
2. Click in the upper left corner. Under Management & Governance, click Config.
3. In the navigation pane on the left, choose Resource Compliance.
4. Select the Organization Rules tab and click Add Rule.
5. Set Policy Type to Custom policy, and configure other parameters, and click Next.
   Figure 4 Basic Configurations
   

   Table 1 Basic parameters

   Parameter	Description
   Policy Type	Select Custom policy. You can create custom policies to supplement built-in policies.
   Rule Name	The name of a rule. A rule name must be unique. A rule name can contain only digits, letters, underscores (_), and hyphens (-).
   Description	The description of a rule. There are no restrictions on the rule description.
   FunctionGraph Function	The URN of a function. For details about how to create a FunctionGraph function, see Creating a function using FunctionGraph.

6. On the displayed Configure Rule Parameters page, configure required parameters and click Next.
   Figure 5 Configure Rule Parameters
   

   Table 2 Rule parameters

   Parameter	Description
   Trigger Type	The condition under which a rule will be triggered. Trigger types are as follows: Configuration change: A rule is triggered when there is a change in resource configurations. Periodic execution: A rule is triggered at a specific frequency.
   Filter Type	The type of resources to be evaluated. Filter types are as follows: Specific resources: Resources of a specific type. All resources: All resources from your account. This parameter is mandatory only when Trigger Type is set to Configuration change.
   Resource Scope	If you set Filter Type to Specific resources, you need to specify a resource scope. Service: The service that the resource belongs to. Resource type: The resource type Region: The region where the resource resides. This parameter is mandatory only when Trigger Type is set to Configuration change.
   Filter Scope	After you enable Filter Scope, you can filter resources by resource ID or tag. You can specify a specific resource for compliance evaluation. This parameter is mandatory only when Trigger Type is set to Configuration change.
   Execute Every	How often a rule will be triggered. This parameter is mandatory only when Trigger Type is set to Periodic execution.
   Rule Parameter	You can set up to 10 rule parameters for a custom rule.
   Destination	Where the organization rule will be deployed Organization: A conformance package will be deployed to all members in a specified organization. Current Account: A conformance package will be deployed to the current account. When creating an organization rule, select Organization.
   Excluded Account	IDs of member accounts to which organization rules will not be deployed. This parameter is only required when Destination is set to Organization.

7. Confirm rule information and click Submit.

Triggering a Rule

For details about how a member can trigger an organization rule, see Triggering a Rule.