Class: AWSCDK::CfnGuardHookProps

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
cfn_guard_hook_props.rb

Overview

Properties for defining a CfnGuardHook.

See Also:

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(_alias:, execution_role:, failure_mode:, hook_status:, rule_location:, target_operations:, log_bucket: nil, options: nil, stack_filters: nil, target_filters: nil) ⇒ CfnGuardHookProps

Returns a new instance of CfnGuardHookProps.

Parameters:

  • _alias (String) —

    The type name alias for the Hook. This alias must be unique per account and Region.

  • execution_role (String) —

    The IAM role that the Hook assumes to retrieve your Guard rules from S3 and optionally write a detailed Guard output report back.

  • failure_mode (String) —

    Specifies how the Hook responds when rules fail their evaluation.

  • hook_status (String) —

    Specifies if the Hook is ENABLED or DISABLED .

  • rule_location (AWSCDK::IResolvable, AWSCDK::CfnGuardHook::S3LocationProperty) —

    Specifies the S3 location of your Guard rules.

  • target_operations (Array<String>) —

    Specifies the list of operations the Hook is run against.

  • log_bucket (String, nil) (defaults to: nil) —

    Specifies the name of an S3 bucket to store the Guard output report.

  • options (AWSCDK::IResolvable, AWSCDK::CfnGuardHook::OptionsProperty, nil) (defaults to: nil) —

    Specifies the S3 location of your input parameters.

  • stack_filters (AWSCDK::IResolvable, AWSCDK::CfnGuardHook::StackFiltersProperty, nil) (defaults to: nil) —

    Specifies the stack level filters for the Hook.

  • target_filters (AWSCDK::IResolvable, AWSCDK::CfnGuardHook::TargetFiltersProperty, nil) (defaults to: nil) —

    Specifies the target filters for the Hook.



19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
 
# File 'cfn_guard_hook_props.rb', line 19

def initialize(_alias:, execution_role:, failure_mode:, hook_status:, rule_location:, target_operations:, log_bucket: nil, options: nil, stack_filters: nil, target_filters: nil)
  @_alias = _alias
  Jsii::Type.check_type(@_alias, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "alias")
  @execution_role = execution_role
  Jsii::Type.check_type(@execution_role, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "executionRole")
  @failure_mode = failure_mode
  Jsii::Type.check_type(@failure_mode, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "failureMode")
  @hook_status = hook_status
  Jsii::Type.check_type(@hook_status, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "hookStatus")
  @rule_location = rule_location.is_a?(Hash) ? ::AWSCDK::CfnGuardHook::S3LocationProperty.new(**rule_location.transform_keys(&:to_sym)) : rule_location
  Jsii::Type.check_type(@rule_location, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3siZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifSx7ImZxbiI6ImF3cy1jZGstbGliLkNmbkd1YXJkSG9vay5TM0xvY2F0aW9uUHJvcGVydHkifV19fQ==")), "ruleLocation")
  @target_operations = target_operations
  Jsii::Type.check_type(@target_operations, JSON.parse(Base64.strict_decode64("eyJjb2xsZWN0aW9uIjp7ImVsZW1lbnR0eXBlIjp7InByaW1pdGl2ZSI6InN0cmluZyJ9LCJraW5kIjoiYXJyYXkifX0=")), "targetOperations")
  @log_bucket = log_bucket
  Jsii::Type.check_type(@log_bucket, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "logBucket") unless @log_bucket.nil?
  @options = options.is_a?(Hash) ? ::AWSCDK::CfnGuardHook::OptionsProperty.new(**options.transform_keys(&:to_sym)) : options
  Jsii::Type.check_type(@options, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3siZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifSx7ImZxbiI6ImF3cy1jZGstbGliLkNmbkd1YXJkSG9vay5PcHRpb25zUHJvcGVydHkifV19fQ==")), "options") unless @options.nil?
  @stack_filters = stack_filters.is_a?(Hash) ? ::AWSCDK::CfnGuardHook::StackFiltersProperty.new(**stack_filters.transform_keys(&:to_sym)) : stack_filters
  Jsii::Type.check_type(@stack_filters, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3siZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifSx7ImZxbiI6ImF3cy1jZGstbGliLkNmbkd1YXJkSG9vay5TdGFja0ZpbHRlcnNQcm9wZXJ0eSJ9XX19")), "stackFilters") unless @stack_filters.nil?
  @target_filters = target_filters.is_a?(Hash) ? ::AWSCDK::CfnGuardHook::TargetFiltersProperty.new(**target_filters.transform_keys(&:to_sym)) : target_filters
  Jsii::Type.check_type(@target_filters, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3siZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifSx7ImZxbiI6ImF3cy1jZGstbGliLkNmbkd1YXJkSG9vay5UYXJnZXRGaWx0ZXJzUHJvcGVydHkifV19fQ==")), "targetFilters") unless @target_filters.nil?
end

Instance Attribute Details

#_alias ⇒ String (readonly)

The type name alias for the Hook. This alias must be unique per account and Region.

The alias must be in the form Name1::Name2::Name3 and must not begin with AWS . For example, Private::Guard::MyTestHook .

Returns:

  • (String)

See Also:



48
49
50
 
# File 'cfn_guard_hook_props.rb', line 48

def _alias
  @_alias
end

#execution_role ⇒ String (readonly)

The IAM role that the Hook assumes to retrieve your Guard rules from S3 and optionally write a detailed Guard output report back.

Returns:

  • (String)

See Also:



53
54
55
 
# File 'cfn_guard_hook_props.rb', line 53

def execution_role
  @execution_role
end

#failure_mode ⇒ String (readonly)

Note:

Default: - "WARN"

Specifies how the Hook responds when rules fail their evaluation.

  • FAIL : Prevents the action from proceeding. This is helpful for enforcing strict compliance or security policies.
  • WARN : Issues warnings to users but allows actions to continue. This is useful for non-critical validations or informational checks.

Returns:

  • (String)

See Also:



62
63
64
 
# File 'cfn_guard_hook_props.rb', line 62

def failure_mode
  @failure_mode
end

#hook_status ⇒ String (readonly)

Note:

Default: - "DISABLED"

Specifies if the Hook is ENABLED or DISABLED .

Returns:

  • (String)

See Also:



68
69
70
 
# File 'cfn_guard_hook_props.rb', line 68

def hook_status
  @hook_status
end

#log_bucket ⇒ String? (readonly)

Specifies the name of an S3 bucket to store the Guard output report.

This report contains the results of your Guard rule validations.

Returns:

  • (String, nil)

See Also:



89
90
91
 
# File 'cfn_guard_hook_props.rb', line 89

def log_bucket
  @log_bucket
end

#options ⇒ AWSCDK::IResolvable, ... (readonly)

Specifies the S3 location of your input parameters.

Returns:

See Also:



94
95
96
 
# File 'cfn_guard_hook_props.rb', line 94

def options
  @options
end

#rule_location ⇒ AWSCDK::IResolvable, AWSCDK::CfnGuardHook::S3LocationProperty (readonly)

Specifies the S3 location of your Guard rules.

Returns:

See Also:



73
74
75
 
# File 'cfn_guard_hook_props.rb', line 73

def rule_location
  @rule_location
end

#stack_filters ⇒ AWSCDK::IResolvable, ... (readonly)

Specifies the stack level filters for the Hook.

Example stack level filter in JSON:

"StackFilters": {"FilteringCriteria": "ALL", "StackNames": {"Exclude": [ "stack-1", "stack-2"]}}

Example stack level filter in YAML:

StackFilters: FilteringCriteria: ALL StackNames: Exclude: - stack-1 - stack-2

Returns:

See Also:



107
108
109
 
# File 'cfn_guard_hook_props.rb', line 107

def stack_filters
  @stack_filters
end

#target_filters ⇒ AWSCDK::IResolvable, ... (readonly)

Specifies the target filters for the Hook.

Example target filter in JSON:

"TargetFilters": {"Actions": [ "CREATE", "UPDATE", "DELETE" ]}

Example target filter in YAML:

TargetFilters: Actions: - CREATE - UPDATE - DELETE

Returns:

See Also:



120
121
122
 
# File 'cfn_guard_hook_props.rb', line 120

def target_filters
  @target_filters
end

#target_operations ⇒ Array<String> (readonly)

Specifies the list of operations the Hook is run against.

For more information, see Hook targets in the CloudFormation Hooks User Guide .

Valid values: STACK | RESOURCE | CHANGE_SET | CLOUD_CONTROL

Returns:

  • (Array<String>)

See Also:



82
83
84
 
# File 'cfn_guard_hook_props.rb', line 82

def target_operations
  @target_operations
end

Class Method Details

.jsii_properties ⇒ Object 



122
123
124
125
126
127
128
129
130
131
132
133
134
135
 
# File 'cfn_guard_hook_props.rb', line 122

def self.jsii_properties
  {
    :_alias => "alias",
    :execution_role => "executionRole",
    :failure_mode => "failureMode",
    :hook_status => "hookStatus",
    :rule_location => "ruleLocation",
    :target_operations => "targetOperations",
    :log_bucket => "logBucket",
    :options => "options",
    :stack_filters => "stackFilters",
    :target_filters => "targetFilters",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
 
# File 'cfn_guard_hook_props.rb', line 137

def to_jsii
  result = {}
  result.merge!({
    "alias" => @_alias,
    "executionRole" => @execution_role,
    "failureMode" => @failure_mode,
    "hookStatus" => @hook_status,
    "ruleLocation" => @rule_location,
    "targetOperations" => @target_operations,
    "logBucket" => @log_bucket,
    "options" => @options,
    "stackFilters" => @stack_filters,
    "targetFilters" => @target_filters,
  })
  result.compact
end