fix(config): cannot scope a custom rule without configurationChanges on

[RomainMuller]

While CloudFormation allows to specify the scope for a custom ConfigRule
without necessarily specifying configurationChanges: true, this was
not allowed by the corresponding construct.

This removed the offending guard, and replaced the test that verified
the throwing behavior with a regression test that validates this
configuration is allowed.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[RomainMuller]

@jogold - you had introduced this guard... Let me know if you know of invalid situations that we should still guard against. I could not find anything by browsing the documentations for the Config service.

[jogold]

@jogold - you had introduced this guard... Let me know if you know of invalid situations that we should still guard against. I could not find anything by browsing the documentations for the Config service.

@RomainMuller the console experience doesn't allow to scope a rule to resources if configuration change is not checked. You first select the trigger type and then the scoping option appears:

This is also the case for the new console experience:

[RomainMuller]

@jogold interesting... I have heard from a customer who claims they can deploy via CloudFormation that setup you cannot make in the console. I'll write an integration test to confirm that then...

[RomainMuller]

Yeah I confirmed CloudFormation lets you do that. Interestingly, the scope is meaningless for custom rules on a periodic-only schedule, but customers have been found using the recorded scope as a configuration point for their periodic custom rules (which is creative, but sounds reasonable to me).

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 55ee19b
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).