Class ConfigurationRecorder
- All Implemented Interfaces:
Serializable
,SdkPojo
,ToCopyableBuilder<ConfigurationRecorder.Builder,
ConfigurationRecorder>
Records configuration changes to the resource types in scope.
For more information about the configuration recorder, see Working with the Configuration Recorder in the Config Developer Guide.
- See Also:
-
Nested Class Summary
Nested Classes -
Method Summary
Modifier and TypeMethodDescriptionfinal String
arn()
The Amazon Resource Name (ARN) of the specified configuration recorder.builder()
final boolean
final boolean
equalsBySdkFields
(Object obj) Indicates whether some other object is "equal to" this one by SDK fields.final <T> Optional
<T> getValueForField
(String fieldName, Class<T> clazz) final int
hashCode()
final String
name()
The name of the configuration recorder.final RecordingGroup
Specifies which resource types are in scope for the configuration recorder to record.final RecordingMode
Specifies the default recording frequency for the configuration recorder.final RecordingScope
Specifies whether the ConfigurationItems in scope for the specified configuration recorder are recorded for free (INTERNAL
) or if it impacts the costs to your bill (PAID
).final String
Specifies whether the ConfigurationItems in scope for the specified configuration recorder are recorded for free (INTERNAL
) or if it impacts the costs to your bill (PAID
).final String
roleARN()
The Amazon Resource Name (ARN) of the IAM role assumed by Config and used by the specified configuration recorder.static Class
<? extends ConfigurationRecorder.Builder> final String
For service-linked configuration recorders, specifies the linked Amazon Web Services service for the configuration recorder.Take this object and create a builder that contains all of the current property values of this object.final String
toString()
Returns a string representation of this object.Methods inherited from interface software.amazon.awssdk.utils.builder.ToCopyableBuilder
copy
-
Method Details
-
arn
The Amazon Resource Name (ARN) of the specified configuration recorder.
- Returns:
- The Amazon Resource Name (ARN) of the specified configuration recorder.
-
name
The name of the configuration recorder.
For customer managed configuration recorders, Config automatically assigns the name of "default" when creating a configuration recorder if you do not specify a name at creation time.
For service-linked configuration recorders, Config automatically assigns a name that has the prefix "
AWSConfigurationRecorderFor
" to a new service-linked configuration recorder.Changing the name of a configuration recorder
To change the name of the customer managed configuration recorder, you must delete it and create a new customer managed configuration recorder with a new name.
You cannot change the name of a service-linked configuration recorder.
- Returns:
- The name of the configuration recorder.
For customer managed configuration recorders, Config automatically assigns the name of "default" when creating a configuration recorder if you do not specify a name at creation time.
For service-linked configuration recorders, Config automatically assigns a name that has the prefix "
AWSConfigurationRecorderFor
" to a new service-linked configuration recorder.Changing the name of a configuration recorder
To change the name of the customer managed configuration recorder, you must delete it and create a new customer managed configuration recorder with a new name.
You cannot change the name of a service-linked configuration recorder.
-
roleARN
The Amazon Resource Name (ARN) of the IAM role assumed by Config and used by the specified configuration recorder.
The server will reject a request without a defined
roleARN
for the configuration recorderWhile the API model does not require this field, the server will reject a request without a defined
roleARN
for the configuration recorder.Policies and compliance results
IAM policies and other policies managed in Organizations can impact whether Config has permissions to record configuration changes for your resources. Additionally, rules directly evaluate the configuration of a resource and rules don't take into account these policies when running evaluations. Make sure that the policies in effect align with how you intend to use Config.
Keep Minimum Permisions When Reusing an IAM role
If you use an Amazon Web Services service that uses Config, such as Security Hub or Control Tower, and an IAM role has already been created, make sure that the IAM role that you use when setting up Config keeps the same minimum permissions as the pre-existing IAM role. You must do this to ensure that the other Amazon Web Services service continues to run as expected.
For example, if Control Tower has an IAM role that allows Config to read S3 objects, make sure that the same permissions are granted to the IAM role you use when setting up Config. Otherwise, it may interfere with how Control Tower operates.
The service-linked IAM role for Config must be used for service-linked configuration recorders
For service-linked configuration recorders, you must use the service-linked IAM role for Config: AWSServiceRoleForConfig.
- Returns:
- The Amazon Resource Name (ARN) of the IAM role assumed by Config and used by the specified configuration
recorder.
The server will reject a request without a defined
roleARN
for the configuration recorderWhile the API model does not require this field, the server will reject a request without a defined
roleARN
for the configuration recorder.Policies and compliance results
IAM policies and other policies managed in Organizations can impact whether Config has permissions to record configuration changes for your resources. Additionally, rules directly evaluate the configuration of a resource and rules don't take into account these policies when running evaluations. Make sure that the policies in effect align with how you intend to use Config.
Keep Minimum Permisions When Reusing an IAM role
If you use an Amazon Web Services service that uses Config, such as Security Hub or Control Tower, and an IAM role has already been created, make sure that the IAM role that you use when setting up Config keeps the same minimum permissions as the pre-existing IAM role. You must do this to ensure that the other Amazon Web Services service continues to run as expected.
For example, if Control Tower has an IAM role that allows Config to read S3 objects, make sure that the same permissions are granted to the IAM role you use when setting up Config. Otherwise, it may interfere with how Control Tower operates.
The service-linked IAM role for Config must be used for service-linked configuration recorders
For service-linked configuration recorders, you must use the service-linked IAM role for Config: AWSServiceRoleForConfig.
-
recordingGroup
Specifies which resource types are in scope for the configuration recorder to record.
High Number of Config Evaluations
You might notice increased activity in your account during your initial month recording with Config when compared to subsequent months. During the initial bootstrapping process, Config runs evaluations on all the resources in your account that you have selected for Config to record.
If you are running ephemeral workloads, you may see increased activity from Config as it records configuration changes associated with creating and deleting these temporary resources. An ephemeral workload is a temporary use of computing resources that are loaded and run when needed. Examples include Amazon Elastic Compute Cloud (Amazon EC2) Spot Instances, Amazon EMR jobs, and Auto Scaling.
If you want to avoid the increased activity from running ephemeral workloads, you can set up the configuration recorder to exclude these resource types from being recorded, or run these types of workloads in a separate account with Config turned off to avoid increased configuration recording and rule evaluations.
- Returns:
- Specifies which resource types are in scope for the configuration recorder to record.
High Number of Config Evaluations
You might notice increased activity in your account during your initial month recording with Config when compared to subsequent months. During the initial bootstrapping process, Config runs evaluations on all the resources in your account that you have selected for Config to record.
If you are running ephemeral workloads, you may see increased activity from Config as it records configuration changes associated with creating and deleting these temporary resources. An ephemeral workload is a temporary use of computing resources that are loaded and run when needed. Examples include Amazon Elastic Compute Cloud (Amazon EC2) Spot Instances, Amazon EMR jobs, and Auto Scaling.
If you want to avoid the increased activity from running ephemeral workloads, you can set up the configuration recorder to exclude these resource types from being recorded, or run these types of workloads in a separate account with Config turned off to avoid increased configuration recording and rule evaluations.
-
recordingMode
Specifies the default recording frequency for the configuration recorder. Config supports Continuous recording and Daily recording.
-
Continuous recording allows you to record configuration changes continuously whenever a change occurs.
-
Daily recording allows you to receive a configuration item (CI) representing the most recent state of your resources over the last 24-hour period, only if it’s different from the previous CI recorded.
Some resource types require continuous recording
Firewall Manager depends on continuous recording to monitor your resources. If you are using Firewall Manager, it is recommended that you set the recording frequency to Continuous.
You can also override the recording frequency for specific resource types.
- Returns:
- Specifies the default recording frequency for the configuration recorder. Config supports Continuous
recording and Daily recording.
-
Continuous recording allows you to record configuration changes continuously whenever a change occurs.
-
Daily recording allows you to receive a configuration item (CI) representing the most recent state of your resources over the last 24-hour period, only if it’s different from the previous CI recorded.
Some resource types require continuous recording
Firewall Manager depends on continuous recording to monitor your resources. If you are using Firewall Manager, it is recommended that you set the recording frequency to Continuous.
You can also override the recording frequency for specific resource types.
-
-
-
recordingScope
Specifies whether the ConfigurationItems in scope for the specified configuration recorder are recorded for free (
INTERNAL
) or if it impacts the costs to your bill (PAID
).If the service returns an enum value that is not available in the current SDK version,
recordingScope
will returnRecordingScope.UNKNOWN_TO_SDK_VERSION
. The raw value returned by the service is available fromrecordingScopeAsString()
.- Returns:
- Specifies whether the ConfigurationItems in scope for the specified configuration recorder are recorded for free (
INTERNAL
) or if it impacts the costs to your bill (PAID
). - See Also:
-
recordingScopeAsString
Specifies whether the ConfigurationItems in scope for the specified configuration recorder are recorded for free (
INTERNAL
) or if it impacts the costs to your bill (PAID
).If the service returns an enum value that is not available in the current SDK version,
recordingScope
will returnRecordingScope.UNKNOWN_TO_SDK_VERSION
. The raw value returned by the service is available fromrecordingScopeAsString()
.- Returns:
- Specifies whether the ConfigurationItems in scope for the specified configuration recorder are recorded for free (
INTERNAL
) or if it impacts the costs to your bill (PAID
). - See Also:
-
servicePrincipal
For service-linked configuration recorders, specifies the linked Amazon Web Services service for the configuration recorder.
- Returns:
- For service-linked configuration recorders, specifies the linked Amazon Web Services service for the configuration recorder.
-
toBuilder
Description copied from interface:ToCopyableBuilder
Take this object and create a builder that contains all of the current property values of this object.- Specified by:
toBuilder
in interfaceToCopyableBuilder<ConfigurationRecorder.Builder,
ConfigurationRecorder> - Returns:
- a builder for type T
-
builder
-
serializableBuilderClass
-
hashCode
-
equals
-
equalsBySdkFields
Description copied from interface:SdkPojo
Indicates whether some other object is "equal to" this one by SDK fields. An SDK field is a modeled, non-inherited field in anSdkPojo
class, and is generated based on a service model.If an
SdkPojo
class does not have any inherited fields,equalsBySdkFields
andequals
are essentially the same.- Specified by:
equalsBySdkFields
in interfaceSdkPojo
- Parameters:
obj
- the object to be compared with- Returns:
- true if the other object equals to this object by sdk fields, false otherwise.
-
toString
-
getValueForField
-
sdkFields
-
sdkFieldNameToField
- Specified by:
sdkFieldNameToField
in interfaceSdkPojo
- Returns:
- The mapping between the field name and its corresponding field.
-