How do I add remediation actions for AWS Config organizational rules?

Short description

To add remediation actions to AWS Config organizational rules, create an Amazon EventBridge rule with a custom event pattern, Then, use Automation, a capability of AWS Systems Manager, as the target. Apply this solution in each AWS account where you want remediation actions. To perform the remediation action across all member accounts in an organization, use AWS CloudFormation StackSets to deploy EventBridge and Automation.

Resolution

In the following example procedure, the AWS-TerminateEC2Instance runbook runs on noncompliant AWS::EC2::Instance resources that the organizational rule identifies. The runbook terminates the Amazon Elastic Compute Cloud (Amazon EC2) instance when the runbook detects noncompliance.

Note: Make sure that you have Amazon EC2 permissions to run the Automation runbook.

Complete the following steps:

1. Confirm that you have a Systems Manager Automation role trust policy similar to the following:

   {  "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Service": [
             "ssm.amazonaws.com"
           ]
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }

2. Open the EventBridge console.

3. In the navigation pane, choose Rules, and then choose Create rule.

4. In Name and description, enter a name and description for the rule.

5. In Define pattern, choose Event pattern.

6. In Event matching pattern, choose Custom pattern.

7. In Event pattern, enter the following example event pattern:

   {  "source": [    "aws.config"
     ],
     "detail-type": [
       "Config Rules Compliance Change"
     ],
     "detail": {
       "messageType": [
         "ComplianceChangeNotification"
       ],
       "configRuleName": [
         {
           "prefix": "OrgConfigRule-TestRuleExample-"
         }
       ],
       "resourceType": [
         "AWS::EC2::Instance"
       ],
       "newEvaluationResult": {
         "complianceType": [
           "NON_COMPLIANT"
         ]
       }
     }
   }

   Note: Replace TestRuleExample with the target organizational rule name in your account. In the event pattern, replace AWS::EC2::Instance with the resource type for your AWS service and organizational rule name.

8. Choose Save.

9. For Target, choose SSM Automation.

10. For Document, choose AWS-TerminateEC2Instance.

11. Expand Configure document version, and then choose Latest.

12. Expand Configure automation parameter(s), and then choose Input transformer.

13. For Input Path, enter the following JSON:

    {"instanceid":"$.detail.resourceId"}

14. For the Instance ID text box, enter the following JSON:

    {"InstanceId":[instanceid],"AutomationAssumeRole":["arn:aws:iam::123456789012:role/SSMRoleExample"]}

    Note: Replace the example Amazon Resource Name (ARN) with your Systems Manager role's ARN.

15. Choose either Create a new role or Use existing role.

16. Choose Create.
    Note: Confirm that the EventBridge rule status is Enabled.

For more information about the AWS Config organizational rule status and to get a list of AWS Config rules, see describe-organization-config-rule-statuses and describe-organization-config-rules.

Related information

How do I set up custom email notifications when AWS Config detects new resources?

Use AWS Config rules to automatically remediate noncompliant resources

Tutorial: Use input transformers to transform events in EventBridge