在 aws config 模板的云形成中将补救操作作为参数传递答案

【问题标题】：Passing remediation actions as parameter in cloud formation for aws config template在 aws config 模板的云形成中将补救操作作为参数传递
【发布时间】：2019-10-20 11:56:01
【问题描述】：

我目前正在使用 cloudformation 模板自动创建 aws config 规则。我需要在脚本中添加修复操作以自动化不兼容的资源。我不知道将补救操作添加为云形成模板的参数。有人可以帮我解决这个问题吗？下面是我的代码。但我无法创建堆栈

{
"Resources": {
"AWSConfigRule": {
  "Type": "AWS::Config::ConfigRule",
  "Properties": {
    "ConfigRuleName": {
      "Ref": "ConfigRuleName"
    },
    "Description": "Checks whether Amazon Virtual Private Cloud flow logs 
are found and enabled for Amazon VPC.",
    "InputParameters": {
      "trafficType": {
        "Fn::If": [
          "trafficType",
          {
            "Ref": "trafficType"
          },
          {
            "Ref": "AWS::NoValue"
          }
        ]
      }
    },
    "Scope": {},
    "Source": {
      "Owner": "AWS",
      "SourceIdentifier": "VPC_FLOW_LOGS_ENABLED"
    },
    "MaximumExecutionFrequency": {
      "Ref": "MaximumExecutionFrequency"
    },
    "RemediationConfigurations": {
        "Ref": "RemediationConfigurations"
    },        
  }
}
  },
 "Parameters": {
"ConfigRuleName": {
  "Type": "String",
  "Default": "vpc-flow-logs-enabled",
  "Description": "The name that you assign to the AWS Config rule.",
  "MinLength": "1",
  "ConstraintDescription": "This parameter is required."
},
"MaximumExecutionFrequency": {
  "Type": "String",
  "Default": "TwentyFour_Hours",
  "Description": "The frequency that you want AWS Config to run evaluations for the rule.",
  "MinLength": "1",
  "ConstraintDescription": "This parameter is required.",
  "AllowedValues": [
    "One_Hour",
    "Three_Hours",
    "Six_Hours",
    "Twelve_Hours",
    "TwentyFour_Hours"
  ]
},
"trafficType": {
  "Type": "String",
  "Default": "",
  "Description": "TrafficType of flow logs"
},
"RemediationConfigurations": [ 
  { 
     "TargetId": "AWS-PublishSNSNotification",
     "TargetType": "SSM_DOCUMENT"
  }
]
},

【问题讨论】：

标签： amazon-cloudformation amazon-systems-manager

【解决方案1】：

对于配置规则，没有像“RemediationConfigurations”这样的可用属性，您可以直接在云端使用它。所以你最好调用 lambda 函数并使用函数 putremediationconfigurations 通过脚本传递它。

【讨论】：