r/aws_config_config_rule: add evaluation_mode

.changelog/34033.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_config_config_rule: Add `evaluation_mode` attribute
+```

internal/service/configservice/config_rule.go

@@ -40,15 +40,6 @@ func ResourceConfigRule() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringLenBetween(0, 128),
-			},
-			"rule_id": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 			"arn": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -58,6 +49,26 @@ func ResourceConfigRule() *schema.Resource {
 				Optional:     true,
 				ValidateFunc: validation.StringLenBetween(0, 256),
 			},
+			"evaluation_mode": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"mode": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Computed:     true,
+							ValidateFunc: validation.StringInSlice(configservice.EvaluationMode_Values(), false),
+						},
+					},
+				},
+			},
+			"name": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validation.StringLenBetween(0, 128),
+			},
 			"input_parameters": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -68,6 +79,10 @@ func ResourceConfigRule() *schema.Resource {
 				Optional:     true,
 				ValidateFunc: validation.StringInSlice(configservice.MaximumExecutionFrequency_Values(), false),
 			},
+			"rule_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"scope": {
 				Type:     schema.TypeList,
 				MaxItems: 1,
@@ -206,9 +221,15 @@ func resourceRulePutConfig(ctx context.Context, d *schema.ResourceData, meta int
 	if v, ok := d.GetOk("description"); ok {
 		ruleInput.Description = aws.String(v.(string))
 	}
+
+	if v, ok := d.Get("evaluation_mode").(*schema.Set); ok && v.Len() > 0 {
+		ruleInput.EvaluationModes = expandRulesEvaluationModes(v.List())
+	}
+
 	if v, ok := d.GetOk("input_parameters"); ok {
 		ruleInput.InputParameters = aws.String(v.(string))
 	}
+
 	if v, ok := d.GetOk("maximum_execution_frequency"); ok {
 		ruleInput.MaximumExecutionFrequency = aws.String(v.(string))
 	}
@@ -266,6 +287,8 @@ func resourceConfigRuleRead(ctx context.Context, d *schema.ResourceData, meta in
 	d.Set("input_parameters", rule.InputParameters)
 	d.Set("maximum_execution_frequency", rule.MaximumExecutionFrequency)
 
+	d.Set("evaluation_mode", flattenRuleEvaluationMode(rule.EvaluationModes))
+
 	if rule.Scope != nil {
 		d.Set("scope", flattenRuleScope(rule.Scope))
 	}

internal/service/configservice/config_rule_test.go

@@ -40,6 +40,65 @@ func testAccConfigRule_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "source.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "source.0.owner", "AWS"),
 					resource.TestCheckResourceAttr(resourceName, "source.0.source_identifier", "S3_BUCKET_VERSIONING_ENABLED"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "evaluation_mode.*", map[string]string{
+						"mode": "DETECTIVE",
+					}),
+				),
+			},
+		},
+	})
+}
+
+func testAccConfigRule_evaluationMode(t *testing.T) {
+	ctx := acctest.Context(t)
+	var cr configservice.ConfigRule
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_config_config_rule.test"
+
+	evaluationMode1 := `
+  evaluation_mode {
+    mode = "DETECTIVE"
+  }
+`
+
+	evaluationMode2 := `
+  evaluation_mode {
+    mode = "DETECTIVE"
+  }
+
+  evaluation_mode {
+    mode = "PROACTIVE"
+  }
+`
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, configservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConfigRuleDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConfigRuleConfig_evaluationMode(rName, evaluationMode1),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfigRuleExists(ctx, resourceName, &cr),
+					testAccCheckConfigRuleName(resourceName, rName, &cr),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "evaluation_mode.*", map[string]string{
+						"mode": "DETECTIVE",
+					}),
+				),
+			},
+			{
+				Config: testAccConfigRuleConfig_evaluationMode(rName, evaluationMode2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfigRuleExists(ctx, resourceName, &cr),
+					testAccCheckConfigRuleName(resourceName, rName, &cr),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "evaluation_mode.*", map[string]string{
+						"mode": "DETECTIVE",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "evaluation_mode.*", map[string]string{
+						"mode": "PROACTIVE",
+					}),
 				),
 			},
 		},
@@ -710,3 +769,20 @@ resource "aws_config_config_rule" "test" {
 }
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
+
+func testAccConfigRuleConfig_evaluationMode(rName, evaluationMode string) string {
+	return testAccConfigRuleConfig_base(rName) + fmt.Sprintf(`
+resource "aws_config_config_rule" "test" {
+  name = %[1]q
+
+  source {
+    owner             = "AWS"
+    source_identifier = "EIP_ATTACHED"
+  }
+
+%[2]s
+
+  depends_on = [aws_config_configuration_recorder.test]
+}
+`, rName, evaluationMode)
+}

internal/service/configservice/configservice_test.go

@@ -13,11 +13,12 @@ func TestAccConfigService_serial(t *testing.T) {
 	t.Parallel()
 
 	testCases := map[string]map[string]func(t *testing.T){
-		"Config": {
+		"ConfigRule": {
 			"basic":            testAccConfigRule_basic,
 			"ownerAws":         testAccConfigRule_ownerAws,
 			"customlambda":     testAccConfigRule_customlambda,
 			"customPolicy":     testAccConfigRule_ownerPolicy,
+			"evaluationMode":   testAccConfigRule_evaluationMode,
 			"scopeTagKey":      testAccConfigRule_Scope_TagKey,
 			"scopeTagKeyEmpty": testAccConfigRule_Scope_TagKey_Empty,
 			"scopeTagValue":    testAccConfigRule_Scope_TagValue,

internal/service/configservice/flex.go

@@ -100,6 +100,29 @@ func expandRecordingGroupRecordingStrategy(configured []interface{}) *configserv
 	return &recordingStrategy
 }
 
+func expandRulesEvaluationModes(in []interface{}) []*configservice.EvaluationModeConfiguration {
+	if len(in) == 0 {
+		return nil
+	}
+
+	var out []*configservice.EvaluationModeConfiguration
+	for _, val := range in {
+		m, ok := val.(map[string]interface{})
+		if !ok {
+			continue
+		}
+
+		e := &configservice.EvaluationModeConfiguration{}
+		if v, ok := m["mode"].(string); ok && v != "" {
+			e.Mode = aws.String(v)
+		}
+
+		out = append(out, e)
+	}
+
+	return out
+}
+
 func expandRuleScope(l []interface{}) *configservice.Scope {
 	if len(l) == 0 || l[0] == nil {
 		return nil
@@ -249,6 +272,23 @@ func flattenExclusionByResourceTypes(exclusionByResourceTypes *configservice.Exc
 	return []interface{}{m}
 }
 
+func flattenRuleEvaluationMode(in []*configservice.EvaluationModeConfiguration) []interface{} {
+	if len(in) == 0 {
+		return nil
+	}
+
+	var out []interface{}
+	for _, v := range in {
+		m := map[string]interface{}{
+			"mode": aws.StringValue(v.Mode),
+		}
+
+		out = append(out, m)
+	}
+
+	return out
+}
+
 func flattenRecordingGroupRecordingStrategy(recordingStrategy *configservice.RecordingStrategy) []interface{} {
 	if recordingStrategy == nil {
 		return nil

website/docs/r/config_config_rule.html.markdown

@@ -141,12 +141,17 @@ This resource supports the following arguments:
 
 * `name` - (Required) The name of the rule
 * `description` - (Optional) Description of the rule
+* `evaluation_mode` - (Optional) The modes the Config rule can be evaluated in. See [Evaluation Mode](#evaluation-mode) for more details.
 * `input_parameters` - (Optional) A string in JSON format that is passed to the AWS Config rule Lambda function.
 * `maximum_execution_frequency` - (Optional) The maximum frequency with which AWS Config runs evaluations for a rule.
 * `scope` - (Optional) Scope defines which resources can trigger an evaluation for the rule. See [Source](#source) Below.
 * `source` - (Required) Source specifies the rule owner, the rule identifier, and the notifications that cause the function to evaluate your AWS resources. See [Scope](#scope) Below.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
+### Evaluation Mode
+
+* `mode` - (Optional) The mode of an evaluation.
+
 ### Scope
 
 Defines which resources can trigger an evaluation for the rule.