2021-06-30 17:31:37 -07:00
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0
2021-07-30 16:48:43 -07:00
"""
Purpose
Shows how to use the AWS SDK for Python (Boto3) with AWS Config to create and
manage configuration rules.
"""
import logging
2021-06-30 17:31:37 -07:00
from pprint import pprint
2021-07-30 16:48:43 -07:00
2021-06-30 17:31:37 -07:00
import boto3
from botocore . exceptions import ClientError
2021-07-30 16:48:43 -07:00
logger = logging . getLogger ( __name__ )
2021-09-10 15:16:12 -07:00
# snippet-start:[python.example_code.config-service.ConfigWrapper]
2021-07-30 16:48:43 -07:00
class ConfigWrapper :
"""
Encapsulates AWS Config functions.
"""
2023-10-18 10:35:05 -07:00
2021-07-30 16:48:43 -07:00
def __init__ ( self , config_client ) :
"""
:param config_client: A Boto3 AWS Config client.
"""
self . config_client = config_client
2023-10-18 10:35:05 -07:00
# snippet-end:[python.example_code.config-service.ConfigWrapper]
# snippet-start:[python.example_code.config-service.PutConfigRule]
2021-07-30 16:48:43 -07:00
def put_config_rule ( self , rule_name ) :
"""
Sets a configuration rule that prohibits making Amazon S3 buckets publicly
readable.
:param rule_name: The name to give the rule.
"""
try :
self . config_client . put_config_rule (
ConfigRule = {
2023-10-18 10:35:05 -07:00
" ConfigRuleName " : rule_name ,
" Description " : " S3 Public Read Prohibited Bucket Rule " ,
" Scope " : {
" ComplianceResourceTypes " : [
" AWS::S3::Bucket " ,
2021-07-30 16:48:43 -07:00
] ,
} ,
2023-10-18 10:35:05 -07:00
" Source " : {
" Owner " : " AWS " ,
" SourceIdentifier " : " S3_BUCKET_PUBLIC_READ_PROHIBITED " ,
2021-07-30 16:48:43 -07:00
} ,
2023-10-18 10:35:05 -07:00
" InputParameters " : " {} " ,
" ConfigRuleState " : " ACTIVE " ,
2021-07-30 16:48:43 -07:00
}
)
logger . info ( " Created configuration rule %s . " , rule_name )
except ClientError :
logger . exception ( " Couldn ' t create configuration rule %s . " , rule_name )
raise
2023-10-18 10:35:05 -07:00
# snippet-end:[python.example_code.config-service.PutConfigRule]
# snippet-start:[python.example_code.config-service.DescribeConfigRules]
2021-07-30 16:48:43 -07:00
def describe_config_rule ( self , rule_name ) :
"""
Gets data for the specified rule.
:param rule_name: The name of the rule to retrieve.
:return: The rule data.
"""
try :
response = self . config_client . describe_config_rules (
2023-10-18 10:35:05 -07:00
ConfigRuleNames = [ rule_name ]
)
rule = response [ " ConfigRules " ]
2021-07-30 16:48:43 -07:00
logger . info ( " Got data for rule %s . " , rule_name )
except ClientError :
logger . exception ( " Couldn ' t get data for rule %s . " , rule_name )
raise
else :
return rule
2023-10-18 10:35:05 -07:00
# snippet-end:[python.example_code.config-service.DescribeConfigRules]
# snippet-start:[python.example_code.config-service.DeleteConfigRule]
2021-07-30 16:48:43 -07:00
def delete_config_rule ( self , rule_name ) :
"""
Delete the specified rule.
:param rule_name: The name of the rule to delete.
"""
try :
self . config_client . delete_config_rule ( ConfigRuleName = rule_name )
logger . info ( " Deleted rule %s . " , rule_name )
except ClientError :
logger . exception ( " Couldn ' t delete rule %s . " , rule_name )
raise
2023-10-18 10:35:05 -07:00
2021-09-10 15:16:12 -07:00
# snippet-end:[python.example_code.config-service.DeleteConfigRule]
2021-06-30 17:31:37 -07:00
def usage_demo ( ) :
2023-10-18 10:35:05 -07:00
print ( " - " * 88 )
2021-07-30 16:48:43 -07:00
print ( " Welcome to the AWS Config demo! " )
2023-10-18 10:35:05 -07:00
print ( " - " * 88 )
2021-07-30 16:48:43 -07:00
2023-10-18 10:35:05 -07:00
logging . basicConfig ( level = logging . INFO , format = " %(levelname)s : %(message)s " )
2021-07-30 16:48:43 -07:00
2023-10-18 10:35:05 -07:00
config = ConfigWrapper ( boto3 . client ( " config " ) )
rule_name = " DemoS3BucketRule "
2021-07-30 16:48:43 -07:00
print ( f " Creating AWS Config rule ' { rule_name } ' ... " )
config . put_config_rule ( rule_name )
2021-06-30 17:31:37 -07:00
print ( f " Describing AWS Config rule ' { rule_name } ' ... " )
2021-07-30 16:48:43 -07:00
rule = config . describe_config_rule ( rule_name )
pprint ( rule )
2021-06-30 17:31:37 -07:00
print ( f " Deleting AWS Config rule ' { rule_name } ' ... " )
2021-07-30 16:48:43 -07:00
config . delete_config_rule ( rule_name )
2021-06-30 17:31:37 -07:00
print ( " Thanks for watching! " )
2023-10-18 10:35:05 -07:00
print ( " - " * 88 )
2021-06-30 17:31:37 -07:00
2023-10-18 10:35:05 -07:00
if __name__ == " __main__ " :
2021-06-30 17:31:37 -07:00
usage_demo ( )
