Terraform-provider-aws: aws_config_config_rule input_parameters for AWS Managed Config Rules

[hashibot]

_This issue was originally opened by @eric-nord as hashicorp/terraform#14518. It was migrated here as part of the provider split. The original body of the issue is below._

---

Terraform Version

0.9.5

Affected Resource(s)

• aws_config_config_rule

Terraform Configuration Files

It is noted that input_parameter is only valid if source.owner is CUSTOM_LAMBDA.
As several AWS Managed Config Rules need params to function, it would be nice to be abled to add input_parameters to AWS MANAGED Config Rules like this:

module "common_port_restriction_audit" { name ="common-port-restriction-enabled" source ="./aws-managed-config-rules" owner = "AWS" source_identifier ="RESTRICTED_INCOMING_TRAFFIC" input_parameters = <<EOF { "smtp": 23 } EOF

Expected Behavior

add input_parameters for AWS Managed Config Rules. For instance
http://docs.aws.amazon.com/config/latest/developerguide/required-tags.html

Actual Behavior

input_parameters is only valid if source.owner is CUSTOM_LAMBDA.

[ghost]

Utilizing the input_parameters property for config rule 'Properties' works for AWS Managed rules as long as the json is 'string' based.

Example:

resource "aws_config_config_rule" "managed-rule-01" {
  name = "REQUIRED_TAGS"

  input_parameters = "{\"tag1Key\": \"Name\",\"tag2Key\": \"Description\",\"tag3Key\": \"BudgetCode\",\"tag4Key\": \"Owner\"}"

  source {
    owner             = "AWS"
    source_identifier = "REQUIRED_TAGS"
  }
}

[jbscare]

Yeah, if the error you get is something like "AWSConfig rule: InvalidParameterValueException: Blank spaces are not acceptable for input parameter", that should go away if you make sure your parameter values are strings (I had some that were integers and some that were booleans, quoting them fixed the problem).

[erikpaasonen]

So to clarify this issue, this works but is a bit ugly:

resource "aws_config_config_rule" "managed-rule-01" {
  name = "REQUIRED_TAGS"

  input_parameters = "{\"tag1Key\": \"Name\",\"tag2Key\": \"Description\",\"tag3Key\": \"BudgetCode\",\"tag4Key\": \"Owner\"}"

  source {
    owner             = "AWS"
    source_identifier = "REQUIRED_TAGS"
  }
}

The "here-string" equivalent also works and is arguably more readable and maintainable:

resource "aws_config_config_rule" "managed-rule-01" {
  name = "REQUIRED_TAGS"

  input_parameters =<<EOF
{
  "tag1Key": "Name",
  "tag2Key": "Description",
  "tag3Key": "BudgetCode",
  "tag4Key": "Owner"
}
EOF

  source {
    owner             = "AWS"
    source_identifier = "REQUIRED_TAGS"
  }
}

The example from the original poster doesn't work because the value 23 does not have quotes around it:

    name ="common-port-restriction-enabled"
    source ="./aws-managed-config-rules"
    owner = "AWS"
    source_identifier ="RESTRICTED_INCOMING_TRAFFIC"
    input_parameters = <<EOF
{
    "smtp": 23
}
EOF

Which implies that this WOULD work:

    name ="common-port-restriction-enabled"
    source ="./aws-managed-config-rules"
    owner = "AWS"
    source_identifier ="RESTRICTED_INCOMING_TRAFFIC"
    input_parameters = <<EOF
{
    "smtp": "23"
}
EOF

[ydnitin]

https://github.com/terraform-providers/terraform-provider-aws/issues/773#issuecomment-327896447 only works for tagXkeys.

How does one create tag values?

resource "aws_config_config_rule" "billing-costcode" {
  name = "TF_billing-costcode"

  input_parameters = "{\"tag1Key\": \"CostCode\",\"tag1value\": \"XXXX\"}"

  source {
    owner             = "AWS"
    source_identifier = "REQUIRED_TAGS"
  }

  scope {
    tag_key = "CostCode"
  }
}

TF craps out this if I use "tag1value".

Error: Error applying plan:

1 error(s) occurred:

* aws_config_config_rule.billing-costcode: 1 error(s) occurred:

* aws_config_config_rule.billing-costcode: Failed to create AWSConfig rule: InvalidParameterValueException: Unknown parameters provided in the inputParameters: {"tag1Key": "CostCode","tag1value": "XXXX"}.
    status code: 400, request id: 1442c62b-bafe-11e8-b785-ed95c875d706

Terraform does not automatically rollback in the face of errors.
Instead, your Terraform state file has been partially updated with
any resources that successfully completed. Please address the error
above and apply again to incrementally change your infrastructure.

[Hmerac]

@ydnitin Did you manage to find any solution for this? I'm also struggling with the format...

I'm going to try "tag1Value" instead of "tag1value" which you've written. Will inform if works.

---

I just tried "tag1Value" and it works. Here is an example snippet:

 input_parameters = <<EOF
{
  "tag1Key": "Key1",
  "tag1Value": "Value1",
  "tag2Key": "Key2",
  "tag2Value": "Value2"
}
EOF

[tyrken]

Just pointing out we have the same problem with aws_config_organization_managed_rule but the all-values-as-strings fix I found here works. You can also use jsonencode to make your code a little cleaner, e.g. I use:

locals {
  # Values MUST be strings, even if numeric
  parameterised_config_rules = {
    ACCESS_KEYS_ROTATED = {
      maxAccessKeyAge = "30"
    }
    # other rules...
  }

resource "aws_config_organization_managed_rule" "parameterised" {
  for_each         = local.parameterised_config_rules
  name             = each.key
  input_parameters = jsonencode(each.value)
  rule_identifier  = each.key
}

[ksanjay7]

This worked for me too...

Is there a way to have regex for tag1Value ? I would like config rule to be valid if there are any matches to regex starting with abc and string size 3... Like I would like rule to be compliant if I have values abc123 or abc456 or abc789
input_parameters = < {
"tag1Key": "Key1",
"tag1Value": "Value1",
"tag2Key": "Key2",
"tag2Value": "Value2"
}
EOF

[EvanGertis]

I am trying to resolve this issue, as well. I am trying to create and aws_config_config_rule like so

resource aws_config_config_rule ensure-log-alarm-exists-for-cloudtrail {
  name = "ensure-log-alarm-exists-for-cloudtrail"
  description = "Checks whether we have a cloudwatch alarm on for cloudtrail configuration changes"

  source {
    owner = "AWS"
    source_identifier = "CLOUDWATCH_ALARM_SETTINGS_CHECK"
  }

  input_parameters = "{\"metricName\":\"CloudTrailConfigChanges\",\"threshold\":1,\"evaluationPeriod\":\"1\",\"period\":\"300\",\"comparisonOperator\":\"GreaterThanOrEqualToThreshold\",\"statistic\":\"Sum\"}"
}

I've been able to get the apply to work by just specifying input_parameters like so:

input_parameters = "{\"metricName\":\"CloudTrailConfigChanges\"}"

````
There is something wrong with the way that I am passing `threshold` which is a type int. I read what @jbscare wrote about using quotes, but when I do that  I get `Unknown parameters provided in the inputParameters:`. I think this is because the int is parsed as a string. I even tried 

input_parameters = jsonencode({"metricName":"CloudTrailConfigChanges","threshold"=1})

and

input_parameters =< {
"metricName":"CloudTrailConfigChanges",
"threshold":1
}
EOF
```
both of these failed. Any help with this would be greatly appreciated.