AWS Config Conformance Packs: Continuous Compliance Guards for Coding-Agent Accounts

# ✅ ensure Config recorder + delivery channel exist (per account)
aws configservice put-configuration-recorder \
  --configuration-recorder name=default,roleARN=arn:aws:iam::111122223333:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig \
  --recording-group allSupported=true,includeGlobalResourceTypes=true

aws configservice put-delivery-channel \
  --delivery-channel name=default,s3BucketName=org-config-snapshot-111122223333

aws configservice start-configuration-recorder --configuration-recorder-name default

# ✅ deploy a conformance pack from a template URL or local YAML
aws configservice put-conformance-pack \
  --conformance-pack-name coding-agent-baseline \
  --template-body file://coding-agent-conformance-pack.yaml \
  --delivery-s3-bucket org-config-snapshot-111122223333

# ✅ coding-agent-conformance-pack.yaml (illustrative managed + custom rules)
Resources:
  S3PublicReadProhibited:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: agent-s3-public-read-prohibited
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED

  S3SslRequestsOnly:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: agent-s3-ssl-only
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY

  EncryptedVolumes:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: agent-encrypted-volumes
      Source:
        Owner: AWS
        SourceIdentifier: ENCRYPTED_VOLUMES

  IamUserMfa:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: agent-root-mfa
      Source:
        Owner: AWS
        SourceIdentifier: ROOT_ACCOUNT_MFA_ENABLED

  # Custom: tool roles must not allow iam:PassRole to *
  AgentNoWildcardPassRole:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: agent-no-wildcard-passrole
      Source:
        Owner: CUSTOM_LAMBDA
        SourceDetails:
          - EventSource: aws.config
            MessageType: ConfigurationItemChangeNotification
            MaximumExecutionFrequency: TwentyFour_Hours
        # SourceIdentifier set to your custom rule Lambda ARN in real packs

# ✅ Config custom rule Lambda — NON_COMPLIANT if IAM policy has Action "*"
import json
import boto3

config = boto3.client("config")
iam = boto3.client("iam")

def evaluate(role_name: str) -> str:
    pols = iam.list_attached_role_policies(RoleName=role_name)["AttachedPolicies"]
    for p in pols:
        doc = iam.get_policy_version(
            PolicyArn=p["PolicyArn"],
            VersionId=iam.get_policy(PolicyArn=p["PolicyArn"])["Policy"]["DefaultVersionId"],
        )["PolicyVersion"]["Document"]
        if isinstance(doc, str):
            doc = json.loads(doc)
        for stmt in doc.get("Statement", []):
            actions = stmt.get("Action", [])
            if isinstance(actions, str):
                actions = [actions]
            if "*" in actions and stmt.get("Effect") == "Allow":
                return "NON_COMPLIANT"
    return "COMPLIANT"

def handler(event, _ctx):
    invoking = event["invokingEvent"]
    if isinstance(invoking, str):
        invoking = json.loads(invoking)
    item = invoking.get("configurationItem") or {}
    if item.get("resourceType") != "AWS::IAM::Role":
        return
    tags = {t["key"]: t["value"] for t in item.get("tags", [])}
    if tags.get("workload") != "coding-agent":
        # ✅ only police agent roles
        annotation = "skipped_non_agent"
        compliance = "NOT_APPLICABLE"
    else:
        compliance = evaluate(item["resourceName"])
        annotation = "wildcard_action" if compliance == "NON_COMPLIANT" else "ok"
    config.put_evaluations(
        Evaluations=[{
            "ComplianceResourceType": item["resourceType"],
            "ComplianceResourceId": item["resourceId"],
            "ComplianceType": compliance,
            "Annotation": annotation,
            "OrderingTimestamp": item["configurationItemCaptureTime"],
        }],
        ResultToken=event["resultToken"],
    )

# ✅ EventBridge rule: Config compliance change → SNS / ticket
aws events put-rule \
  --name coding-agent-config-noncompliant \
  --event-pattern '{
    "source": ["aws.config"],
    "detail-type": ["Config Rules Compliance Change"],
    "detail": {
      "newEvaluationResult": {"complianceType": ["NON_COMPLIANT"]},
      "resourceType": ["AWS::S3::Bucket", "AWS::IAM::Role", "AWS::EC2::SecurityGroup"]
    }
  }'