Skip to content
AWS for Query.Farm

aws.config.describe_organization_config_rules

Example SQL Queries

SELECT * FROM
aws.config.describe_organization_config_rules;

Description

Returns a list of organization Config rules.

When you specify the limit and the next token, you receive a paginated response.

Limit and next token are not applicable if you specify organization Config rule names. It is only applicable, when you request all the organization Config rules.

For accounts within an organization

If you deploy an organizational rule or conformance pack in an organization administrator account, and then establish a delegated administrator and deploy an organizational rule or conformance pack in the delegated administrator account, you won't be able to see the organizational rule or conformance pack in the organization administrator account from the delegated administrator account or see the organizational rule or conformance pack in the delegated administrator account from organization administrator account. The DescribeOrganizationConfigRules and DescribeOrganizationConformancePacks APIs can only see and interact with the organization-related resource that were deployed from within the account calling those APIs.

Table Definition

Column NameColumn Data Type
organization_config_rule_names Input Column

The names of organization Config rules for which you want details. If you do not specify any names, Config returns details for all your organization Config rules.

VARCHAR[]
Show child fields
organization_config_rule_names[]
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
excluded_accounts

A comma-separated list of accounts excluded from organization Config rule.

VARCHAR[]
Show child fields
excluded_accounts[]
last_update_time

The timestamp of the last update.

TIMESTAMP_S
organization_config_rule_arn

Amazon Resource Name (ARN) of organization Config rule.

VARCHAR
organization_config_rule_name

The name that you assign to organization Config rule.

VARCHAR
organization_custom_policy_rule_metadata

An object that specifies metadata for your organization's Config Custom Policy rule. The metadata includes the runtime system in use, which accounts have debug logging enabled, and other custom rule metadata, such as resource type, resource ID of Amazon Web Services resource, and organization trigger types that initiate Config to evaluate Amazon Web Services resources against a rule.

STRUCT(
    "description" VARCHAR,
    "organization_config_rule_trigger_types" VARCHAR[],
    "input_parameters" VARCHAR,
    "maximum_execution_frequency" VARCHAR,
    "resource_types_scope" VARCHAR[],
    "resource_id_scope" VARCHAR,
    "tag_key_scope" VARCHAR,
    "tag_value_scope" VARCHAR,
    "policy_runtime" VARCHAR,
    "debug_log_delivery_accounts" VARCHAR[]
)
Show child fields
organization_custom_policy_rule_metadata.debug_log_delivery_accounts[]
organization_custom_policy_rule_metadata.description

The description that you provide for your organization Config Custom Policy rule.

organization_custom_policy_rule_metadata.input_parameters

A string, in JSON format, that is passed to your organization Config Custom Policy rule.

organization_custom_policy_rule_metadata.maximum_execution_frequency

The maximum frequency with which Config runs evaluations for a rule. Your Config Custom Policy rule is triggered when Config delivers the configuration snapshot. For more information, see ConfigSnapshotDeliveryProperties.

organization_custom_policy_rule_metadata.organization_config_rule_trigger_types[]
organization_custom_policy_rule_metadata.policy_runtime

The runtime system for your organization Config Custom Policy rules. Guard is a policy-as-code language that allows you to write policies that are enforced by Config Custom Policy rules. For more information about Guard, see the Guard GitHub Repository.

organization_custom_policy_rule_metadata.resource_id_scope

The ID of the Amazon Web Services resource that was evaluated.

organization_custom_policy_rule_metadata.resource_types_scope[]
organization_custom_policy_rule_metadata.tag_key_scope

One part of a key-value pair that make up a tag. A key is a general label that acts like a category for more specific tag values.

organization_custom_policy_rule_metadata.tag_value_scope

The optional part of a key-value pair that make up a tag. A value acts as a descriptor within a tag category (key).

organization_custom_rule_metadata

An OrganizationCustomRuleMetadata object.

STRUCT(
    "description" VARCHAR,
    "lambda_function_arn" VARCHAR,
    "organization_config_rule_trigger_types" VARCHAR[],
    "input_parameters" VARCHAR,
    "maximum_execution_frequency" VARCHAR,
    "resource_types_scope" VARCHAR[],
    "resource_id_scope" VARCHAR,
    "tag_key_scope" VARCHAR,
    "tag_value_scope" VARCHAR
)
Show child fields
organization_custom_rule_metadata.description

The description that you provide for your organization Config rule.

organization_custom_rule_metadata.input_parameters

A string, in JSON format, that is passed to your organization Config rule Lambda function.

organization_custom_rule_metadata.lambda_function_arn

The lambda function ARN.

organization_custom_rule_metadata.maximum_execution_frequency

The maximum frequency with which Config runs evaluations for a rule. Your custom rule is triggered when Config delivers the configuration snapshot. For more information, see ConfigSnapshotDeliveryProperties.

By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the MaximumExecutionFrequency parameter.

organization_custom_rule_metadata.organization_config_rule_trigger_types[]
organization_custom_rule_metadata.resource_id_scope

The ID of the Amazon Web Services resource that was evaluated.

organization_custom_rule_metadata.resource_types_scope[]
organization_custom_rule_metadata.tag_key_scope

One part of a key-value pair that make up a tag. A key is a general label that acts like a category for more specific tag values.

organization_custom_rule_metadata.tag_value_scope

The optional part of a key-value pair that make up a tag. A value acts as a descriptor within a tag category (key).

organization_managed_rule_metadata

An OrganizationManagedRuleMetadata object.

STRUCT(
    "description" VARCHAR,
    "rule_identifier" VARCHAR,
    "input_parameters" VARCHAR,
    "maximum_execution_frequency" VARCHAR,
    "resource_types_scope" VARCHAR[],
    "resource_id_scope" VARCHAR,
    "tag_key_scope" VARCHAR,
    "tag_value_scope" VARCHAR
)
Show child fields
organization_managed_rule_metadata.description

The description that you provide for your organization Config rule.

organization_managed_rule_metadata.input_parameters

A string, in JSON format, that is passed to your organization Config rule Lambda function.

organization_managed_rule_metadata.maximum_execution_frequency

The maximum frequency with which Config runs evaluations for a rule. This is for an Config managed rule that is triggered at a periodic frequency.

By default, rules with a periodic trigger are evaluated every 24 hours. To change the frequency, specify a valid value for the MaximumExecutionFrequency parameter.

organization_managed_rule_metadata.resource_id_scope

The ID of the Amazon Web Services resource that was evaluated.

organization_managed_rule_metadata.resource_types_scope[]
organization_managed_rule_metadata.rule_identifier

For organization config managed rules, a predefined identifier from a list. For example, IAM_PASSWORD_POLICY is a managed rule. To reference a managed rule, see Using Config managed rules.

organization_managed_rule_metadata.tag_key_scope

One part of a key-value pair that make up a tag. A key is a general label that acts like a category for more specific tag values.

organization_managed_rule_metadata.tag_value_scope

The optional part of a key-value pair that make up a tag. A value acts as a descriptor within a tag category (key).