second first commit

2026-09-22 08:57:00 -04:00
parent e88d7e2ff3
commit 0aef7fb2d8
4766 changed files with 1236986 additions and 0 deletions
@@ -0,0 +1,196 @@
+# AWS Config
+
+**Protocol:** JSON 1.1 (`X-Amz-Target: StarlingDoveService.*`)
+**Endpoint:** `POST http://localhost:4566/`
+
+## Supported Actions
+
+### Config Rules
+
+| Action | Description |
+|---|---|
+| `PutConfigRule` | Create or update a config rule (full rule shape round-trips: description, scope, source details, input parameters, execution frequency, evaluation modes) |
+| `DeleteConfigRule` | Delete a config rule and its evaluation results |
+| `DescribeConfigRules` | List config rules, optionally filtered by name, paginated via `NextToken` |
+| `DescribeConfigRuleEvaluationStatus` | Get evaluation status for config rules |
+| `StartConfigRulesEvaluation` | Trigger evaluation for config rules |
+
+### Compliance & Evaluations
+
+| Action | Description |
+|---|---|
+| `PutEvaluations` | Report evaluation results for a config rule (supports `TestMode`) |
+| `PutExternalEvaluation` | Report a single external evaluation for a config rule |
+| `DeleteEvaluationResults` | Delete all evaluation results for a config rule |
+| `DescribeComplianceByConfigRule` | Get rule-level compliance aggregated from reported evaluations |
+| `DescribeComplianceByResource` | Get resource-level compliance aggregated across rules |
+| `GetComplianceDetailsByConfigRule` | List the evaluation results recorded for a rule |
+| `GetComplianceDetailsByResource` | List the evaluation results recorded for a resource |
+| `GetComplianceSummaryByConfigRule` | Count compliant and non-compliant rules |
+| `GetComplianceSummaryByResourceType` | Count compliant and non-compliant resources, grouped by type |
+
+### Configuration Recorder
+
+| Action | Description |
+|---|---|
+| `PutConfigurationRecorder` | Create or update a configuration recorder |
+| `DescribeConfigurationRecorders` | List configuration recorders |
+| `DeleteConfigurationRecorder` | Delete a configuration recorder |
+| `StartConfigurationRecorder` | Start recording configuration changes |
+| `StopConfigurationRecorder` | Stop recording configuration changes |
+| `DescribeConfigurationRecorderStatus` | Get the status of configuration recorders |
+
+### Delivery Channel
+
+| Action | Description |
+|---|---|
+| `PutDeliveryChannel` | Create or update a delivery channel |
+| `DescribeDeliveryChannels` | List delivery channels |
+| `DeleteDeliveryChannel` | Delete a delivery channel (fails while the recorder is running) |
+
+### Retention Configuration
+
+| Action | Description |
+|---|---|
+| `PutRetentionConfiguration` | Set the retention period (30-2557 days) |
+| `DescribeRetentionConfigurations` | List retention configurations |
+| `DeleteRetentionConfiguration` | Delete the retention configuration |
+
+### Conformance Packs
+
+| Action | Description |
+|---|---|
+| `PutConformancePack` | Create or update a conformance pack |
+| `DeleteConformancePack` | Delete a conformance pack |
+| `DescribeConformancePacks` | List conformance packs, paginated via `Limit`/`NextToken` |
+| `DescribeConformancePackStatus` | Get the deployment status of conformance packs |
+
+### Aggregation Authorizations
+
+| Action | Description |
+|---|---|
+| `PutAggregationAuthorization` | Authorize an account and region to aggregate this account's Config data |
+| `DescribeAggregationAuthorizations` | List aggregation authorizations, paginated via `Limit`/`NextToken` |
+| `DeleteAggregationAuthorization` | Revoke an aggregation authorization |
+
+### Tagging
+
+| Action | Description |
+|---|---|
+| `TagResource` | Add tags to a Config resource |
+| `UntagResource` | Remove tags from a Config resource |
+| `ListTagsForResource` | List tags on a Config resource |
+
+## Configuration
+
+| Variable | Default | Description |
+|---|---|---|
+| `FLOCI_SERVICES_CONFIGSERVICE_ENABLED` | `true` | Enable or disable the service |
+
+## Examples
+
+```bash
+export AWS_ENDPOINT_URL=http://localhost:4566
+
+# Create a config rule
+aws configservice put-config-rule --config-rule '{
+  "ConfigRuleName": "s3-bucket-versioning",
+  "Description": "Checks that versioning is enabled",
+  "Scope": {"ComplianceResourceTypes": ["AWS::S3::Bucket"]},
+  "Source": {
+    "Owner": "AWS",
+    "SourceIdentifier": "S3_BUCKET_VERSIONING_ENABLED"
+  }
+}'
+
+# List config rules
+aws configservice describe-config-rules
+
+# Report evaluation results (the ResultToken is the rule name, see Deviations)
+aws configservice put-evaluations \
+  --result-token s3-bucket-versioning \
+  --evaluations '[{
+    "ComplianceResourceType": "AWS::S3::Bucket",
+    "ComplianceResourceId": "my-bucket",
+    "ComplianceType": "NON_COMPLIANT",
+    "Annotation": "Versioning is suspended",
+    "OrderingTimestamp": 1700000000.0
+  }]'
+
+# Rule compliance now reflects the reported evaluations
+aws configservice describe-compliance-by-config-rule \
+  --config-rule-names s3-bucket-versioning
+
+# Inspect per-resource evaluation results
+aws configservice get-compliance-details-by-config-rule \
+  --config-rule-name s3-bucket-versioning
+
+# Set the retention period
+aws configservice put-retention-configuration --retention-period-in-days 365
+
+# Create a configuration recorder
+aws configservice put-configuration-recorder --configuration-recorder '{
+  "name": "default",
+  "roleARN": "arn:aws:iam::012345678901:role/config-role",
+  "recordingGroup": {
+    "allSupported": true,
+    "includeGlobalResourceTypes": true
+  }
+}'
+
+# Start recording
+aws configservice start-configuration-recorder --configuration-recorder-name default
+
+# Check recorder status
+aws configservice describe-configuration-recorder-status
+
+# Create a conformance pack
+aws configservice put-conformance-pack \
+  --conformance-pack-name my-pack \
+  --template-body "Resources: {}"
+
+# List conformance packs
+aws configservice describe-conformance-packs
+
+# Authorize another account to aggregate this account's data
+aws configservice put-aggregation-authorization \
+  --authorized-account-id 111122223333 \
+  --authorized-aws-region eu-west-1
+
+# List aggregation authorizations
+aws configservice describe-aggregation-authorizations
+
+# Tag a resource
+aws configservice tag-resource \
+  --resource-arn arn:aws:config:us-east-1:000000000000:config-rule/config-rule-abc123 \
+  --tags Key=env,Value=dev
+
+# Delete a config rule
+aws configservice delete-config-rule --config-rule-name s3-bucket-versioning
+```
+
+## Deviations
+
+!!! note
+    Compliance is driven entirely by evaluations reported through `PutEvaluations` and
+    `PutExternalEvaluation` — Floci does not record resource configurations or run rule
+    evaluations itself. Until an evaluation is reported, compliance returns
+    `INSUFFICIENT_DATA`.
+
+    - **ResultToken**: real AWS hands custom rules an opaque token inside the evaluation
+      event. Floci has no evaluation event, so `PutEvaluations` expects the config rule
+      name as the token (a `<rule-name>:<suffix>` form is also accepted).
+    - `StartConfigRulesEvaluation` marks the rule as invoked but does not call the rule's
+      Lambda function.
+    - `FirstActivatedTime` and invocation timestamps are runtime state and are not
+      persisted across restarts.
+    - `DescribeConfigRules` and `DescribeComplianceByConfigRule` use a fixed page size
+      of 25.
+    - Configuration recorders and delivery channels are stored and validated, but no
+      configuration items or snapshots are produced.
+    - Conformance pack status is always `CREATE_SUCCESSFUL`; pack templates are stored,
+      not evaluated.
+    - `PutAggregationAuthorization` records the authorization and returns its ARN, but no
+      data is aggregated: configuration aggregators are not emulated.
+      `DeleteAggregationAuthorization` on an authorization that does not exist succeeds,
+      because the Config API models no "not found" error for that operation.