Add partial support for Proactive rules

integration/config-opscenter-integration-example/s3EncryptedConfigRule.yaml

@@ -36,7 +36,7 @@ Resources:
            - 'Config Rules Compliance Change'
          detail:
            configRuleName:
-             - !Ref S3BucketServerSideEncryptionEnabled
+             - Ref: S3BucketServerSideEncryptionEnabled
            newEvaluationResult:
              complianceType:
                - NON_COMPLIANT

pyproject.toml

@@ -7,7 +7,7 @@
 #    or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
 [tool.poetry]
 name = "rdk"
-version = "0.17.11"
+version = "0.17.12"
 description = "Rule Development Kit CLI for AWS Config"
 authors = [
     "AWS RDK Maintainers <rdk-maintainers@amazon.com>",
@@ -123,6 +123,7 @@ isort = {extras = ["toml"], version = "^5.11.4"}
 mypy = "^1.3.0"
 debugpy = "^1.6.7"
 ruff = "^0.0.269"
+checkov = "^3.2.0"
 
 [tool.poetry.group.security.dependencies]
 bandit = "^1.7.7"

rdk/__init__.py

@@ -6,4 +6,4 @@
 #
 #    or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
 
-MY_VERSION = "0.17.11"
+MY_VERSION = "2"

rdk/template/configManagedRule.yaml

@@ -0,0 +1,102 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Description: AWS CloudFormation template to create Managed AWS Config rules. You
+  will be billed for the AWS resources used if you create a stack from this
+  template.
+Parameters:
+  RuleName:
+    Description: Name of the Rule
+    Type: String
+    MinLength: "1"
+    MaxLength: "128"
+  Description:
+    Description: Description of the Rule
+    Type: String
+    MinLength: "1"
+    MaxLength: "255"
+  SourceEvents:
+    Description: Event Type
+    Type: CommaDelimitedList
+    Default: NONE
+  SourcePeriodic:
+    Description: Execution Frequency
+    Type: String
+    MinLength: "1"
+    MaxLength: "255"
+    Default: NONE
+  SourceIdentifier:
+    Description: Source Identifier of Managed Rule
+    Type: String
+    MinLength: "1"
+    MaxLength: "255"
+  SourceInputParameters:
+    Description: Input Parameters
+    Type: String
+    Default: "{}"
+  EvaluationMode:
+    Description: The evaluation mode to use, either DETECTIVE, PROACTIVE, or BOTH.
+    Type: String
+    Default: DETECTIVE
+    AllowedValues:
+      - DETECTIVE
+      - PROACTIVE
+      - BOTH
+Conditions:
+  RemoveEventScope:
+    Fn::Or:
+      - Fn::Not:
+          - Condition: EventTriggered
+      - Fn::Equals:
+          - Fn::Join:
+              - ","
+              - Ref: SourceEvents
+          - ALL
+  EventTriggered:
+    Fn::Not:
+      - Fn::Equals:
+          - Fn::Join:
+              - ","
+              - Ref: SourceEvents
+          - NONE
+  PeriodicTriggered:
+    Fn::Not:
+      - Fn::Equals:
+          - Ref: SourcePeriodic
+          - NONE
+  UseBothEvaluationModes:
+    Fn::Equals:
+      - Ref: EvaluationMode
+      - "BOTH"
+Resources:
+  rdkConfigRule:
+    Type: AWS::Config::ConfigRule
+    Properties:
+      ConfigRuleName:
+        Ref: RuleName
+      Description:
+        Ref: Description
+      Scope:
+        Fn::If:
+          - RemoveEventScope
+          - Ref: AWS::NoValue
+          - ComplianceResourceTypes:
+              Ref: SourceEvents
+      MaximumExecutionFrequency:
+        Fn::If:
+          - PeriodicTriggered
+          - Ref: SourcePeriodic
+          - Ref: AWS::NoValue
+      Source:
+        Owner: AWS
+        SourceIdentifier:
+          Ref: SourceIdentifier
+      InputParameters:
+        Ref: SourceInputParameters
+      EvaluationModes:
+        Fn::If:
+          - UseBothEvaluationModes
+          - 
+            - Mode: DETECTIVE
+            - Mode: PROACTIVE
+          - 
+            - Mode:
+                Ref: EvaluationMode