gezza-b

            "Resource": "arn:aws:s3:::awsconfigconforms-yourname/*",
            "Condition": {
                "StringEquals": {
                    "aws:PrincipalOrgID": "youraccount"
                },
                "ArnLike": {
                    "aws:PrincipalArn": "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms"
                }

gezza-b

      Path: /
      Description: Role for the AWS Config Recorder
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/service-role/AWSConfigRoleForOrganizations
      RoleName: OrgRecorderRole

gezza-b

    Type: AWS::IAM::Role
    Properties: 
      AssumeRolePolicyDocument: 
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
              - config.amazonaws.com
            Action:

gezza-b

Resources:
  ConfigAggregator:
    Type: AWS::Config::ConfigurationAggregator
    Properties: 
      ConfigurationAggregatorName: !Ref AggregatorName
      OrganizationAggregationSource: 
        AllAwsRegions: true
        RoleArn: !GetAtt OrgRecorderRole.Arn

gezza-b

        InstanceId:
          StaticValue:
            Values:
              - instanceId
      MaximumAutomaticAttempts: 2   
      ResourceType: "AWS::EC2::Instance"
      RetryAttemptSeconds: 60
      TargetId: "AWS-StopEC2Instance"
      TargetType: "SSM_DOCUMENT"

gezza-b

  Ec2ApprovedAmiRemediation:  
    Type: AWS::Config::RemediationConfiguration
    Properties: 
      Automatic: true
      ConfigRuleName: !Ref Ec2ApprovedAmiRule
      Parameters:
        AutomationAssumeRole:
          StaticValue:
            Values:
              - !Sub 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig'

gezza-b

Parameters:
  AllowedAmi:
    Description: Environment type
    Type: String
    Default: "ami-06fcc1f0bc2c8943f"

gezza-b

  Ec2ApprovedAmiRule:
    Type: AWS::Config::ConfigRule
    Properties: 
      ConfigRuleName: Ec2ApprovedAmiRule
      InputParameters: !Sub '{ "amiIds" : "${AllowedAmi}" }'
      Scope:
        ComplianceResourceTypes:
          - "AWS::EC2::Instance"
      Source: 
        Owner: AWS

gezza-b

  ConfigDeliveryChannel:
    Type: AWS::Config::DeliveryChannel
    Properties: 
      ConfigSnapshotDeliveryProperties: 
        DeliveryFrequency: 'One_Hour'
      Name: !Ref ConfigDeliveryChannel
      S3BucketName: !Ref ConfigBucketName

gezza-b

Resources:
  ConfigRecorder:
    Type: AWS::Config::ConfigurationRecorder
    Properties: 
      Name: !Ref RecorderName
      RecordingGroup: 
        AllSupported: true
        IncludeGlobalResourceTypes: true
      RoleARN: !Sub 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig'