aws_config_config_rule input_parameters for AWS Managed Config Rules

[hashibot]

This issue was originally opened by @eric-nord as hashicorp/terraform#14518. It was migrated here as part of the provider split. The original body of the issue is below.

---

Terraform Version

0.9.5

Affected Resource(s)

• aws_config_config_rule

Terraform Configuration Files

It is noted that input_parameter is only valid if source.owner is CUSTOM_LAMBDA.
As several AWS Managed Config Rules need params to function, it would be nice to be abled to add input_parameters to AWS MANAGED Config Rules like this:

	name ="common-port-restriction-enabled"
	source ="./aws-managed-config-rules"
	owner = "AWS"
	source_identifier ="RESTRICTED_INCOMING_TRAFFIC"
	input_parameters = <<EOF
{
	"smtp": 23
}
EOF

Expected Behavior

add input_parameters for AWS Managed Config Rules. For instance
http://docs.aws.amazon.com/config/latest/developerguide/required-tags.html

Actual Behavior

input_parameters is only valid if source.owner is CUSTOM_LAMBDA.

[ghost]

Utilizing the input_parameters property for config rule 'Properties' works for AWS Managed rules as long as the json is 'string' based.

Example:

resource "aws_config_config_rule" "managed-rule-01" {
  name = "REQUIRED_TAGS"

  input_parameters = "{\"tag1Key\": \"Name\",\"tag2Key\": \"Description\",\"tag3Key\": \"BudgetCode\",\"tag4Key\": \"Owner\"}"

  source {
    owner             = "AWS"
    source_identifier = "REQUIRED_TAGS"
  }
}

[jbscare]

Yeah, if the error you get is something like "AWSConfig rule: InvalidParameterValueException: Blank spaces are not acceptable for input parameter", that should go away if you make sure your parameter values are strings (I had some that were integers and some that were booleans, quoting them fixed the problem).

[erikpaasonen]

So to clarify this issue, this works but is a bit ugly:

resource "aws_config_config_rule" "managed-rule-01" {
  name = "REQUIRED_TAGS"

  input_parameters = "{\"tag1Key\": \"Name\",\"tag2Key\": \"Description\",\"tag3Key\": \"BudgetCode\",\"tag4Key\": \"Owner\"}"

  source {
    owner             = "AWS"
    source_identifier = "REQUIRED_TAGS"
  }
}

The "here-string" equivalent also works and is arguably more readable and maintainable:

resource "aws_config_config_rule" "managed-rule-01" {
  name = "REQUIRED_TAGS"

  input_parameters =<<EOF
{
  "tag1Key": "Name",
  "tag2Key": "Description",
  "tag3Key": "BudgetCode",
  "tag4Key": "Owner"
}
EOF

  source {
    owner             = "AWS"
    source_identifier = "REQUIRED_TAGS"
  }
}

The example from the original poster doesn't work because the value 23 does not have quotes around it:

	name ="common-port-restriction-enabled"
	source ="./aws-managed-config-rules"
	owner = "AWS"
	source_identifier ="RESTRICTED_INCOMING_TRAFFIC"
	input_parameters = <<EOF
{
	"smtp": 23
}
EOF

Which implies that this WOULD work:

	name ="common-port-restriction-enabled"
	source ="./aws-managed-config-rules"
	owner = "AWS"
	source_identifier ="RESTRICTED_INCOMING_TRAFFIC"
	input_parameters = <<EOF
{
	"smtp": "23"
}
EOF

[ydnitin]

#773 (comment) only works for tagXkeys.

How does one create tag values?

resource "aws_config_config_rule" "billing-costcode" {
  name = "TF_billing-costcode"

  input_parameters = "{\"tag1Key\": \"CostCode\",\"tag1value\": \"XXXX\"}"

  source {
    owner             = "AWS"
    source_identifier = "REQUIRED_TAGS"
  }

  scope {
    tag_key = "CostCode"
  }
}

TF craps out this if I use "tag1value".

Error: Error applying plan:

1 error(s) occurred:

* aws_config_config_rule.billing-costcode: 1 error(s) occurred:

* aws_config_config_rule.billing-costcode: Failed to create AWSConfig rule: InvalidParameterValueException: Unknown parameters provided in the inputParameters: {"tag1Key": "CostCode","tag1value": "XXXX"}.
	status code: 400, request id: 1442c62b-bafe-11e8-b785-ed95c875d706

Terraform does not automatically rollback in the face of errors.
Instead, your Terraform state file has been partially updated with
any resources that successfully completed. Please address the error
above and apply again to incrementally change your infrastructure.

[Hmerac]

@ydnitin Did you manage to find any solution for this? I'm also struggling with the format...

I'm going to try "tag1Value" instead of "tag1value" which you've written. Will inform if works.

---

I just tried "tag1Value" and it works. Here is an example snippet:

 input_parameters = <<EOF
{
  "tag1Key": "Key1",
  "tag1Value": "Value1",
  "tag2Key": "Key2",
  "tag2Value": "Value2"
}
EOF

[tyrken]

Just pointing out we have the same problem with aws_config_organization_managed_rule but the all-values-as-strings fix I found here works. You can also use jsonencode to make your code a little cleaner, e.g. I use:

locals {
  # Values MUST be strings, even if numeric
  parameterised_config_rules = {
    ACCESS_KEYS_ROTATED = {
      maxAccessKeyAge = "30"
    }
    # other rules...
  }

resource "aws_config_organization_managed_rule" "parameterised" {
  for_each         = local.parameterised_config_rules
  name             = each.key
  input_parameters = jsonencode(each.value)
  rule_identifier  = each.key
}

[ksanjay7]

This worked for me too...

Is there a way to have regex for tag1Value ? I would like config rule to be valid if there are any matches to regex starting with abc and string size 3... Like I would like rule to be compliant if I have values abc123 or abc456 or abc789
input_parameters = <<EOF
{
"tag1Key": "Key1",
"tag1Value": "Value1",
"tag2Key": "Key2",
"tag2Value": "Value2"
}
EOF

[EvanGertis]

I am trying to resolve this issue, as well. I am trying to create and aws_config_config_rule like so

resource aws_config_config_rule ensure-log-alarm-exists-for-cloudtrail {
  name = "ensure-log-alarm-exists-for-cloudtrail"
  description = "Checks whether we have a cloudwatch alarm on for cloudtrail configuration changes"

  source {
    owner = "AWS"
    source_identifier = "CLOUDWATCH_ALARM_SETTINGS_CHECK"
  }
  
  input_parameters = "{\"metricName\":\"CloudTrailConfigChanges\",\"threshold\":1,\"evaluationPeriod\":\"1\",\"period\":\"300\",\"comparisonOperator\":\"GreaterThanOrEqualToThreshold\",\"statistic\":\"Sum\"}"
}

I've been able to get the apply to work by just specifying input_parameters like so:

input_parameters = "{\"metricName\":\"CloudTrailConfigChanges\"}"

There is something wrong with the way that I am passing threshold which is a type int. I read what @jbscare wrote about using quotes, but when I do that I get Unknown parameters provided in the inputParameters:. I think this is because the int is parsed as a string. I even tried

input_parameters = jsonencode({"metricName":"CloudTrailConfigChanges","threshold"=1})

and

  input_parameters =<<EOF
{
  "metricName":"CloudTrailConfigChanges",
  "threshold":1
}
EOF

both of these failed. Any help with this would be greatly appreciated.

[lagrianitis]

I am trying to resolve this issue, as well. I am trying to create and aws_config_config_rule like so

resource aws_config_config_rule ensure-log-alarm-exists-for-cloudtrail {
  name = "ensure-log-alarm-exists-for-cloudtrail"
  description = "Checks whether we have a cloudwatch alarm on for cloudtrail configuration changes"

  source {
    owner = "AWS"
    source_identifier = "CLOUDWATCH_ALARM_SETTINGS_CHECK"
  }
  
  input_parameters = "{\"metricName\":\"CloudTrailConfigChanges\",\"threshold\":1,\"evaluationPeriod\":\"1\",\"period\":\"300\",\"comparisonOperator\":\"GreaterThanOrEqualToThreshold\",\"statistic\":\"Sum\"}"
}

I've been able to get the apply to work by just specifying input_parameters like so:

input_parameters = "{\"metricName\":\"CloudTrailConfigChanges\"}"

There is something wrong with the way that I am passing threshold which is a type int. I read what @jbscare wrote about using quotes, but when I do that I get Unknown parameters provided in the inputParameters:. I think this is because the int is parsed as a string. I even tried

input_parameters = jsonencode({"metricName":"CloudTrailConfigChanges","threshold"=1})

and

  input_parameters =<<EOF
{
  "metricName":"CloudTrailConfigChanges",
  "threshold":1
}
EOF

both of these failed. Any help with this would be greatly appreciated.

In both cases you need to quote the number 1 and pass it as a string:

 input_parameters = jsonencode(
  {
    metricName = "CloudTrailConfigChanges"
    threshold = "1"
  }
)

[nathan-mikkelsen]

Pertaining to input_parameters, how does one omit the value as it is optional through the AWS Config GUI.
input_parameters =<<EOF { "tag1Key": "name", "tag1Value": "" } EOF

When submitting this, ERROR occurs.
Error: Error creating AWSConfig rule: Failed to create AWSConfig rule: InvalidParameterValueException: Blank spaces are not acceptable for input parameter: tag1Value.

[mandeepgoyat]

I am also getting the same above error while submitting resourceTags(optional parameter) for managed config rule.

[grrapport]

I am also getting the same above error while submitting resourceTags(optional parameter) for managed config rule.

I've tried almost every conceivable way of formatting this, and I can't get it to work either.

Edit:

Fixed by using the following instead
scope { compliance_resource_types = ["AWS::S3::Bucket", "AWS::RDS::DBCluster", "AWS::Redshift::Cluster"] }