Execute managed AWS Config rule on demand via SDK

Question

Is it possible to run a managed AWS Config rule (for example https://docs.aws.amazon.com/config/latest/developerguide/root-account-mfa-enabled.html) on demand via the SDK?

Scenario: As a consultant I want to easily assess a customer's environment without spending time applying all the AWS Config rules to my customer's environment. Instead I want to use the SDK to quickly execute many rules and get the results back.

Is this possible?

Answer 1

Cloud Custodian

For adhoc execution you might be best served by evaluating Cloud Custodian instead. When I tried this out previously, I was pretty impressed with the immediate value I could get with minimal deployment.

The adhoc nature of your execution can benefit as you can run a report only action, or actually have it create lambda functions to remediate in certain cases if you need that.

The tool is cross platform, dockerized as well, and most of the configuration for rules is yaml based, supporting AWS Config, Security Hub, AWS SSM, and more.

If you look at the Run Your First Policy section in AWS you'll see it can be as simple as:

AWS_ACCESS_KEY_ID="foo" AWS_SECRET_ACCESS_KEY="bar" custodian run --output-dir=. custodian.yml

There is a pretty extensive list of example-policies which include items like

AWS Config Integration

• Can be deployed as config-rule for any resource type supported by config.
• Can use config as resource database instead of querying service describe apis. Custodian supports server side querying resources with Config’s SQL expression language.
• Can filter resources based on their compliance with one or more config rules.
• Can be deployed as a config-poll-rule against any resource type supported by cloudformation. source: AWS Config Integration

It supports custom config rules as well.

Note: I'm not involved in the project, just found it useful and promising for similar situations as you describe. Seems to reduce a lot of "DevOps plumbing" required to get value out of several AWS services with far less service specific knowledge and setup required.