aws-config-rules.py

#!/usr/bin/env python

"""
Download a list of resource compliance rules
Usage: ./aws-config-rules.py \
    --profile profile-name \
    --region {us-east-1}\
    --output output-dir
"""

from argparse import ArgumentDefaultsHelpFormatter, ArgumentParser
from datetime import date
from itertools import count
from json import loads
from os import path
from pathlib import Path

import boto3

TODAY = date.today().strftime("%Y%m%d")

parser = ArgumentParser(
    description="List Config rules across all accounts and regions.",
    formatter_class=ArgumentDefaultsHelpFormatter,
)
parser.add_argument(
    "--profile",
    "-p",
    required=True,
    help="AWS profile name. "
    "Parsed from ~/.aws/config (SSO) or credentials (API key). "
    "Corresponds to the account where Config is deployed.",
)
parser.add_argument(
    "--region", "-r", default="us-east-1", help="AWS Region of Config Aggregator."
)
parser.add_argument("--output", "-o", default="", help="Output directory of CSV.")
args = parser.parse_args()
profile = args.profile
region = args.region
dir_path = args.output
Path(dir_path).mkdir(parents=True, exist_ok=True)

session = boto3.session.Session(profile_name=profile, region_name=region)
client = session.client("config")


def select_aggregate_resource_config(expression):
    """Run Config (SQL) query specified by "expression" argument"""
    results = []
    response = {}
    for i in count():
        params = {
            "Expression": expression,
            "ConfigurationAggregatorName": "OrganizationConfigAggregator",
        }
        if i == 0 or "NextToken" in response:
            if "NextToken" in response:
                params["NextToken"] = response["NextToken"]
            response = client.select_aggregate_resource_config(**params)
            results.extend(response["Results"])
        else:
            break

    return results


# List all rules
rule_list = select_aggregate_resource_config(
    "SELECT configuration.configRuleList.configRuleName "
    "WHERE resourceType = 'AWS::Config::ResourceCompliance'"
)

all_rules = set()
for result in rule_list:
    for rule in loads(result)["configuration"]["configRuleList"]:
        all_rules.add(rule["configRuleName"])

with open(path.join(dir_path, f"aws-config-rules-{TODAY}.txt", "w")) as f:
    for rule in all_rules:
        f.write(rule + "\n")