Encapsulates AWS Config functions.
| 19 | |
| 20 | # snippet-start:[python.example_code.config-service.ConfigWrapper] |
| 21 | class ConfigWrapper: |
| 22 | """ |
| 23 | Encapsulates AWS Config functions. |
| 24 | """ |
| 25 | |
| 26 | def __init__(self, config_client): |
| 27 | """ |
| 28 | :param config_client: A Boto3 AWS Config client. |
| 29 | """ |
| 30 | self.config_client = config_client |
| 31 | |
| 32 | # snippet-end:[python.example_code.config-service.ConfigWrapper] |
| 33 | |
| 34 | # snippet-start:[python.example_code.config-service.PutConfigRule] |
| 35 | def put_config_rule(self, rule_name): |
| 36 | """ |
| 37 | Sets a configuration rule that prohibits making Amazon S3 buckets publicly |
| 38 | readable. |
| 39 | |
| 40 | :param rule_name: The name to give the rule. |
| 41 | """ |
| 42 | try: |
| 43 | self.config_client.put_config_rule( |
| 44 | ConfigRule={ |
| 45 | "ConfigRuleName": rule_name, |
| 46 | "Description": "S3 Public Read Prohibited Bucket Rule", |
| 47 | "Scope": { |
| 48 | "ComplianceResourceTypes": [ |
| 49 | "AWS::S3::Bucket", |
| 50 | ], |
| 51 | }, |
| 52 | "Source": { |
| 53 | "Owner": "AWS", |
| 54 | "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED", |
| 55 | }, |
| 56 | "InputParameters": "{}", |
| 57 | "ConfigRuleState": "ACTIVE", |
| 58 | } |
| 59 | ) |
| 60 | logger.info("Created configuration rule %s.", rule_name) |
| 61 | except ClientError: |
| 62 | logger.exception("Couldn't create configuration rule %s.", rule_name) |
| 63 | raise |
| 64 | |
| 65 | # snippet-end:[python.example_code.config-service.PutConfigRule] |
| 66 | |
| 67 | # snippet-start:[python.example_code.config-service.DescribeConfigRules] |
| 68 | def describe_config_rule(self, rule_name): |
| 69 | """ |
| 70 | Gets data for the specified rule. |
| 71 | |
| 72 | :param rule_name: The name of the rule to retrieve. |
| 73 | :return: The rule data. |
| 74 | """ |
| 75 | try: |
| 76 | response = self.config_client.describe_config_rules( |
| 77 | ConfigRuleNames=[rule_name] |
| 78 | ) |
no outgoing calls