Skip to content

Commit d557c50

Browse files
author
awstools
committed
docs(client-config-service): Documentation improvements have been made to the EvaluationModel and DescribeConfigurationRecorders APIs.
1 parent eaee979 commit d557c50

13 files changed

+189
-83
lines changed

‎clients/client-config-service/src/commands/DeleteConfigRuleCommand.ts‎

Lines changed: 7 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -39,27 +39,15 @@ export interface DeleteConfigRuleCommandOutput extends __MetadataBearer {}
3939
* <code>DescribeConfigRules</code> request.</p>
4040
* <note>
4141
* <p>
42-
* <b>Recommendation: Stop recording resource compliance before deleting rules</b>
42+
* <b>Recommendation: Consider excluding the <code>AWS::Config::ResourceCompliance</code> resource type from recording before deleting rules</b>
4343
* </p>
44-
* <p>It is highly recommended that you stop recording for the <code>AWS::Config::ResourceCompliance</code> resource type before you delete rules in your account.
45-
* Deleting rules creates CIs for <code>AWS::Config::ResourceCompliance</code> and can affect your Config <a href="https://docs.aws.amazon.com/config/latest/developerguide/stop-start-recorder.html">configuration recorder</a> costs.
46-
*
47-
* If you are deleting rules which evaluate a large number of resource types,
44+
* <p>Deleting rules creates configuration items (CIs) for <code>AWS::Config::ResourceCompliance</code>
45+
* that can affect your costs for the configuration recorder. If you are deleting rules which evaluate a large number of resource types,
4846
* this can lead to a spike in the number of CIs recorded.</p>
49-
* <p>Best practice:</p>
50-
* <ol>
51-
* <li>
52-
* <p>Stop recording <code>AWS::Config::ResourceCompliance</code>
53-
* </p>
54-
* </li>
55-
* <li>
56-
* <p>Delete rule(s)</p>
57-
* </li>
58-
* <li>
59-
* <p>Turn on recording for <code>AWS::Config::ResourceCompliance</code>
60-
* </p>
61-
* </li>
62-
* </ol>
47+
* <p>To avoid the associated costs, you can opt to disable recording
48+
* for the <code>AWS::Config::ResourceCompliance</code> resource type before deleting rules, and re-enable recording after the rules have been deleted.</p>
49+
* <p>However, since deleting rules is an asynchronous process, it might take an hour or more to complete. During the time
50+
* when recording is disabled for <code>AWS::Config::ResourceCompliance</code>, rule evaluations will not be recorded in the associated resource’s history.</p>
6351
* </note>
6452
* @example
6553
* Use a bare-bones client and the command you need to make an API call.

‎clients/client-config-service/src/commands/DeleteConformancePackCommand.ts‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,18 @@ export interface DeleteConformancePackCommandOutput extends __MetadataBearer {}
3232
* conformance pack.</p>
3333
* <p>Config sets the conformance pack to <code>DELETE_IN_PROGRESS</code> until the deletion is complete.
3434
* You cannot update a conformance pack while it is in this state.</p>
35+
* <note>
36+
* <p>
37+
* <b>Recommendation: Consider excluding the <code>AWS::Config::ResourceCompliance</code> resource type from recording before deleting rules</b>
38+
* </p>
39+
* <p>Deleting rules creates configuration items (CIs) for <code>AWS::Config::ResourceCompliance</code>
40+
* that can affect your costs for the configuration recorder. If you are deleting rules which evaluate a large number of resource types,
41+
* this can lead to a spike in the number of CIs recorded.</p>
42+
* <p>To avoid the associated costs, you can opt to disable recording
43+
* for the <code>AWS::Config::ResourceCompliance</code> resource type before deleting rules, and re-enable recording after the rules have been deleted.</p>
44+
* <p>However, since deleting rules is an asynchronous process, it might take an hour or more to complete. During the time
45+
* when recording is disabled for <code>AWS::Config::ResourceCompliance</code>, rule evaluations will not be recorded in the associated resource’s history.</p>
46+
* </note>
3547
* @example
3648
* Use a bare-bones client and the command you need to make an API call.
3749
* ```javascript

‎clients/client-config-service/src/commands/DeleteOrganizationConfigRuleCommand.ts‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,18 @@ export interface DeleteOrganizationConfigRuleCommandOutput extends __MetadataBea
3737
* <code>ListDelegatedAdministrator</code> permissions are added.</p>
3838
* <p>Config sets the state of a rule to DELETE_IN_PROGRESS until the deletion is complete.
3939
* You cannot update a rule while it is in this state.</p>
40+
* <note>
41+
* <p>
42+
* <b>Recommendation: Consider excluding the <code>AWS::Config::ResourceCompliance</code> resource type from recording before deleting rules</b>
43+
* </p>
44+
* <p>Deleting rules creates configuration items (CIs) for <code>AWS::Config::ResourceCompliance</code>
45+
* that can affect your costs for the configuration recorder. If you are deleting rules which evaluate a large number of resource types,
46+
* this can lead to a spike in the number of CIs recorded.</p>
47+
* <p>To avoid the associated costs, you can opt to disable recording
48+
* for the <code>AWS::Config::ResourceCompliance</code> resource type before deleting rules, and re-enable recording after the rules have been deleted.</p>
49+
* <p>However, since deleting rules is an asynchronous process, it might take an hour or more to complete. During the time
50+
* when recording is disabled for <code>AWS::Config::ResourceCompliance</code>, rule evaluations will not be recorded in the associated resource’s history.</p>
51+
* </note>
4052
* @example
4153
* Use a bare-bones client and the command you need to make an API call.
4254
* ```javascript

‎clients/client-config-service/src/commands/DeleteOrganizationConformancePackCommand.ts‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,18 @@ export interface DeleteOrganizationConformancePackCommandOutput extends __Metada
3838
* <code>ListDelegatedAdministrator</code> permissions are added.</p>
3939
* <p>Config sets the state of a conformance pack to DELETE_IN_PROGRESS until the deletion is complete.
4040
* You cannot update a conformance pack while it is in this state. </p>
41+
* <note>
42+
* <p>
43+
* <b>Recommendation: Consider excluding the <code>AWS::Config::ResourceCompliance</code> resource type from recording before deleting rules</b>
44+
* </p>
45+
* <p>Deleting rules creates configuration items (CIs) for <code>AWS::Config::ResourceCompliance</code>
46+
* that can affect your costs for the configuration recorder. If you are deleting rules which evaluate a large number of resource types,
47+
* this can lead to a spike in the number of CIs recorded.</p>
48+
* <p>To avoid the associated costs, you can opt to disable recording
49+
* for the <code>AWS::Config::ResourceCompliance</code> resource type before deleting rules, and re-enable recording after the rules have been deleted.</p>
50+
* <p>However, since deleting rules is an asynchronous process, it might take an hour or more to complete. During the time
51+
* when recording is disabled for <code>AWS::Config::ResourceCompliance</code>, rule evaluations will not be recorded in the associated resource’s history.</p>
52+
* </note>
4153
* @example
4254
* Use a bare-bones client and the command you need to make an API call.
4355
* ```javascript

‎clients/client-config-service/src/commands/GetResourceConfigHistoryCommand.ts‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -29,16 +29,22 @@ export interface GetResourceConfigHistoryCommandOutput extends GetResourceConfig
2929

3030
/**
3131
* <important>
32-
* <p>For accurate reporting on the compliance status, you must record the <code>AWS::Config::ResourceCompliance</code> resource type.
33-
* For more information, see <a href="https://docs.aws.amazon.com/config/latest/developerguide/select-resources.html">Selecting Which Resources Config Records</a>.</p>
32+
* <p>For accurate reporting on the compliance status, you must record the <code>AWS::Config::ResourceCompliance</code> resource type.</p>
33+
* <p>For more information, see <a href="https://docs.aws.amazon.com/config/latest/developerguide/select-resources.html">Recording Amazon Web Services Resources</a> in the <i>Config Resources Developer Guide</i>.</p>
3434
* </important>
35-
* <p>Returns a list of <code>ConfigurationItems</code> for the specified resource.
36-
* The list contains details about each state of the resource
35+
* <p>Returns a list of configurations items (CIs) for the specified resource.</p>
36+
* <p>
37+
* <b>Contents</b>
38+
* </p>
39+
* <p>The list contains details about each state of the resource
3740
* during the specified time interval. If you specified a retention
38-
* period to retain your <code>ConfigurationItems</code> between a
41+
* period to retain your CIs between a
3942
* minimum of 30 days and a maximum of 7 years (2557 days), Config
40-
* returns the <code>ConfigurationItems</code> for the specified
43+
* returns the CIs for the specified
4144
* retention period. </p>
45+
* <p>
46+
* <b>Pagination</b>
47+
* </p>
4248
* <p>The response is paginated. By default, Config returns a
4349
* limit of 10 configuration items per page. You can customize this
4450
* number with the <code>limit</code> parameter. The response includes

‎clients/client-config-service/src/commands/ListDiscoveredResourcesCommand.ts‎

Lines changed: 48 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -28,23 +28,61 @@ export interface ListDiscoveredResourcesCommandInput extends ListDiscoveredResou
2828
export interface ListDiscoveredResourcesCommandOutput extends ListDiscoveredResourcesResponse, __MetadataBearer {}
2929

3030
/**
31-
* <p>Accepts a resource type and returns a list of resource
32-
* identifiers for the resources of that type. A resource identifier
31+
* <p>Returns a list of resource
32+
* resource identifiers for the specified resource types for the resources of that type. A <i>resource identifier</i>
3333
* includes the resource type, ID, and (if available) the custom
34-
* resource name. The results consist of resources that Config has
35-
* discovered, including those that Config is not currently
34+
* resource name.</p>
35+
* <p>The results consist of resources that Config has
36+
* <i>discovered</i>, including those that Config is not currently
3637
* recording. You can narrow the results to include only resources that
3738
* have specific resource IDs or a resource name.</p>
3839
* <note>
3940
* <p>You can specify either resource IDs or a resource name, but
4041
* not both, in the same request.</p>
4142
* </note>
42-
* <p>The response is paginated. By default, Config lists 100
43-
* resource identifiers on each page. You can customize this number
44-
* with the <code>limit</code> parameter. The response includes a
45-
* <code>nextToken</code> string. To get the next page of results,
46-
* run the request again and specify the string for the
47-
* <code>nextToken</code> parameter.</p>
43+
* <important>
44+
* <p>
45+
* <i>CloudFormation stack recording behavior in Config</i>
46+
* </p>
47+
* <p>When a CloudFormation stack fails to create (for example, it enters the <code>ROLLBACK_FAILED</code> state),
48+
* Config does not record a configuration item (CI) for that stack. Configuration items are only recorded for stacks that reach
49+
* the following states:</p>
50+
* <ul>
51+
* <li>
52+
* <p>
53+
* <code>CREATE_COMPLETE</code>
54+
* </p>
55+
* </li>
56+
* <li>
57+
* <p>
58+
* <code>UPDATE_COMPLETE</code>
59+
* </p>
60+
* </li>
61+
* <li>
62+
* <p>
63+
* <code>UPDATE_ROLLBACK_COMPLETE</code>
64+
* </p>
65+
* </li>
66+
* <li>
67+
* <p>
68+
* <code>UPDATE_ROLLBACK_FAILED</code>
69+
* </p>
70+
* </li>
71+
* <li>
72+
* <p>
73+
* <code>DELETE_FAILED</code>
74+
* </p>
75+
* </li>
76+
* <li>
77+
* <p>
78+
* <code>DELETE_COMPLETE</code>
79+
* </p>
80+
* </li>
81+
* </ul>
82+
* <p>Because no CI is created for a failed stack creation, you won't see configuration history
83+
* for that stack in Config, even after the stack is deleted. This helps make sure that Config only
84+
* tracks resources that were successfully provisioned.</p>
85+
* </important>
4886
* @example
4987
* Use a bare-bones client and the command you need to make an API call.
5088
* ```javascript

‎clients/client-config-service/src/commands/PutConfigurationRecorderCommand.ts‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,8 +114,7 @@ export interface PutConfigurationRecorderCommandOutput extends __MetadataBearer
114114
* @see {@link ConfigServiceClientResolvedConfig | config} for ConfigServiceClient's `config` shape.
115115
*
116116
* @throws {@link InvalidConfigurationRecorderNameException} (client fault)
117-
* <p>You have provided a name for the customer managed configuration recorder that is not
118-
* valid.</p>
117+
* <p>The configuration recorder name is not valid. The prefix "<code>AWSConfigurationRecorderFor</code>" is reserved for service-linked configuration recorders.</p>
119118
*
120119
* @throws {@link InvalidRecordingGroupException} (client fault)
121120
* <p>One of the following errors:</p>

‎clients/client-config-service/src/commands/PutConformancePackCommand.ts‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,17 @@ export interface PutConformancePackCommandOutput extends PutConformancePackRespo
3333
* see <a href="https://docs.aws.amazon.com/config/latest/developerguide/configlimits.html">
3434
* <b>Service Limits</b>
3535
* </a> in the <i>Config Developer Guide</i>.</p>
36+
* <important>
37+
* <p>When you use <code>PutConformancePack</code> to deploy conformance packs in your account,
38+
* the operation can create Config rules and remediation actions without
39+
* requiring <code>config:PutConfigRule</code> or
40+
* <code>config:PutRemediationConfigurations</code> permissions in your account IAM
41+
* policies.</p>
42+
* <p>This API uses the <code>AWSServiceRoleForConfigConforms</code> service-linked role in your
43+
* account to create conformance pack resources. This service-linked role includes the
44+
* permissions to create Config rules and remediation configurations, even
45+
* if your account IAM policies explicitly deny these actions.</p>
46+
* </important>
3647
* <p>This API creates a service-linked role <code>AWSServiceRoleForConfigConforms</code> in your account.
3748
* The service-linked role is created only when the role does not exist in your account. </p>
3849
* <note>

‎clients/client-config-service/src/commands/PutOrganizationConformancePackCommand.ts‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,18 @@ export interface PutOrganizationConformancePackCommandOutput
4040
* <p>Only a management account and a delegated administrator can call this API.
4141
* When calling this API with a delegated administrator, you must ensure Organizations
4242
* <code>ListDelegatedAdministrator</code> permissions are added. An organization can have up to 3 delegated administrators.</p>
43+
* <important>
44+
* <p>When you use <code>PutOrganizationConformancePack</code> to deploy conformance packs across
45+
* member accounts, the operation can create Config rules and remediation
46+
* actions without requiring <code>config:PutConfigRule</code> or
47+
* <code>config:PutRemediationConfigurations</code> permissions in member account
48+
* IAM policies.</p>
49+
* <p>This API uses the <code>AWSServiceRoleForConfigConforms</code> service-linked role in each
50+
* member account to create conformance pack resources. This service-linked role
51+
* includes the permissions to create Config rules and remediation
52+
* configurations, even if member account IAM policies explicitly deny these
53+
* actions.</p>
54+
* </important>
4355
* <p>This API enables organization service access for <code>config-multiaccountsetup.amazonaws.com</code>
4456
* through the <code>EnableAWSServiceAccess</code> action and creates a
4557
* service-linked role <code>AWSServiceRoleForConfigMultiAccountSetup</code> in the management or delegated administrator account of your organization.

‎clients/client-config-service/src/commands/PutServiceLinkedConfigurationRecorderCommand.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ export interface PutServiceLinkedConfigurationRecorderCommandOutput
3939
/**
4040
* <p>Creates a service-linked configuration recorder that is linked to a specific Amazon Web Services service based on the <code>ServicePrincipal</code> you specify.</p>
4141
* <p>The configuration recorder's <code>name</code>, <code>recordingGroup</code>, <code>recordingMode</code>, and <code>recordingScope</code> is set by the service that is linked to the configuration recorder.</p>
42-
* <p>For more information, see <a href="https://docs.aws.amazon.com/config/latest/developerguide/stop-start-recorder.html">
42+
* <p>For more information and a list of supported services/service principals, see <a href="https://docs.aws.amazon.com/config/latest/developerguide/stop-start-recorder.html">
4343
* <b>Working with the Configuration Recorder</b>
4444
* </a> in the <i>Config Developer Guide</i>.</p>
4545
* <p>This API creates a service-linked role <code>AWSServiceRoleForConfig</code> in your account. The service-linked role is created only when the role does not exist in your account.</p>

0 commit comments

Comments
 (0)