FlociClone/docs/services/config.md

AWS Config

Protocol: JSON 1.1 (X-Amz-Target: StarlingDoveService.*) Endpoint: POST http://localhost:4566/

Supported Actions

Config Rules

Action	Description
PutConfigRule	Create or update a config rule (full rule shape round-trips: description, scope, source details, input parameters, execution frequency, evaluation modes)
DeleteConfigRule	Delete a config rule and its evaluation results
DescribeConfigRules	List config rules, optionally filtered by name, paginated via NextToken
DescribeConfigRuleEvaluationStatus	Get evaluation status for config rules
StartConfigRulesEvaluation	Trigger evaluation for config rules

Compliance & Evaluations

Action	Description
PutEvaluations	Report evaluation results for a config rule (supports TestMode)
PutExternalEvaluation	Report a single external evaluation for a config rule
DeleteEvaluationResults	Delete all evaluation results for a config rule
DescribeComplianceByConfigRule	Get rule-level compliance aggregated from reported evaluations
DescribeComplianceByResource	Get resource-level compliance aggregated across rules
GetComplianceDetailsByConfigRule	List the evaluation results recorded for a rule
GetComplianceDetailsByResource	List the evaluation results recorded for a resource
GetComplianceSummaryByConfigRule	Count compliant and non-compliant rules
GetComplianceSummaryByResourceType	Count compliant and non-compliant resources, grouped by type

Configuration Recorder

Action	Description
PutConfigurationRecorder	Create or update a configuration recorder
DescribeConfigurationRecorders	List configuration recorders
DeleteConfigurationRecorder	Delete a configuration recorder
StartConfigurationRecorder	Start recording configuration changes
StopConfigurationRecorder	Stop recording configuration changes
DescribeConfigurationRecorderStatus	Get the status of configuration recorders

Delivery Channel

Action	Description
PutDeliveryChannel	Create or update a delivery channel
DescribeDeliveryChannels	List delivery channels
DeleteDeliveryChannel	Delete a delivery channel (fails while the recorder is running)

Retention Configuration

Action	Description
PutRetentionConfiguration	Set the retention period (30-2557 days)
DescribeRetentionConfigurations	List retention configurations
DeleteRetentionConfiguration	Delete the retention configuration

Conformance Packs

Action	Description
PutConformancePack	Create or update a conformance pack
DeleteConformancePack	Delete a conformance pack
DescribeConformancePacks	List conformance packs, paginated via Limit/NextToken
DescribeConformancePackStatus	Get the deployment status of conformance packs

Aggregation Authorizations

Action	Description
PutAggregationAuthorization	Authorize an account and region to aggregate this account's Config data
DescribeAggregationAuthorizations	List aggregation authorizations, paginated via Limit/NextToken
DeleteAggregationAuthorization	Revoke an aggregation authorization

Tagging

Action	Description
TagResource	Add tags to a Config resource
UntagResource	Remove tags from a Config resource
ListTagsForResource	List tags on a Config resource

Configuration

Variable	Default	Description
FLOCI_SERVICES_CONFIGSERVICE_ENABLED	true	Enable or disable the service

Examples

export AWS_ENDPOINT_URL=http://localhost:4566

# Create a config rule
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "s3-bucket-versioning",
  "Description": "Checks that versioning is enabled",
  "Scope": {"ComplianceResourceTypes": ["AWS::S3::Bucket"]},
  "Source": {
    "Owner": "AWS",
    "SourceIdentifier": "S3_BUCKET_VERSIONING_ENABLED"
  }
}'

# List config rules
aws configservice describe-config-rules

# Report evaluation results (the ResultToken is the rule name, see Deviations)
aws configservice put-evaluations \
  --result-token s3-bucket-versioning \
  --evaluations '[{
    "ComplianceResourceType": "AWS::S3::Bucket",
    "ComplianceResourceId": "my-bucket",
    "ComplianceType": "NON_COMPLIANT",
    "Annotation": "Versioning is suspended",
    "OrderingTimestamp": 1700000000.0
  }]'

# Rule compliance now reflects the reported evaluations
aws configservice describe-compliance-by-config-rule \
  --config-rule-names s3-bucket-versioning

# Inspect per-resource evaluation results
aws configservice get-compliance-details-by-config-rule \
  --config-rule-name s3-bucket-versioning

# Set the retention period
aws configservice put-retention-configuration --retention-period-in-days 365

# Create a configuration recorder
aws configservice put-configuration-recorder --configuration-recorder '{
  "name": "default",
  "roleARN": "arn:aws:iam::012345678901:role/config-role",
  "recordingGroup": {
    "allSupported": true,
    "includeGlobalResourceTypes": true
  }
}'

# Start recording
aws configservice start-configuration-recorder --configuration-recorder-name default

# Check recorder status
aws configservice describe-configuration-recorder-status

# Create a conformance pack
aws configservice put-conformance-pack \
  --conformance-pack-name my-pack \
  --template-body "Resources: {}"

# List conformance packs
aws configservice describe-conformance-packs

# Authorize another account to aggregate this account's data
aws configservice put-aggregation-authorization \
  --authorized-account-id 111122223333 \
  --authorized-aws-region eu-west-1

# List aggregation authorizations
aws configservice describe-aggregation-authorizations

# Tag a resource
aws configservice tag-resource \
  --resource-arn arn:aws:config:us-east-1:000000000000:config-rule/config-rule-abc123 \
  --tags Key=env,Value=dev

# Delete a config rule
aws configservice delete-config-rule --config-rule-name s3-bucket-versioning

Deviations

!!! note Compliance is driven entirely by evaluations reported through PutEvaluations and PutExternalEvaluation — Floci does not record resource configurations or run rule evaluations itself. Until an evaluation is reported, compliance returns INSUFFICIENT_DATA.

- **ResultToken**: real AWS hands custom rules an opaque token inside the evaluation
  event. Floci has no evaluation event, so `PutEvaluations` expects the config rule
  name as the token (a `<rule-name>:<suffix>` form is also accepted).
- `StartConfigRulesEvaluation` marks the rule as invoked but does not call the rule's
  Lambda function.
- `FirstActivatedTime` and invocation timestamps are runtime state and are not
  persisted across restarts.
- `DescribeConfigRules` and `DescribeComplianceByConfigRule` use a fixed page size
  of 25.
- Configuration recorders and delivery channels are stored and validated, but no
  configuration items or snapshots are produced.
- Conformance pack status is always `CREATE_SUCCESSFUL`; pack templates are stored,
  not evaluated.
- `PutAggregationAuthorization` records the authorization and returns its ARN, but no
  data is aggregated: configuration aggregators are not emulated.
  `DeleteAggregationAuthorization` on an authorization that does not exist succeeds,
  because the Config API models no "not found" error for that operation.