Aws/config Compliance
Observe AWS Config compliance evaluations as typed queryable data.
This model reads evaluation results from AWS Config rules — it does not manage Config rules or recorders. Use @swamp/aws/config for infrastructure.
AWS Config continuously evaluates resources against policy rules. Non-compliant resources represent drift from desired state. This model stores those verdicts as typed data queryable via CEL, feeding into @webframp/aws/drift-state as a fourth upstream source.
Quick Start
swamp extension pull @webframp/aws/config-compliance
swamp model create @webframp/aws/config-compliance aws-config-compliance
swamp model method run aws-config-compliance get_non_compliant
swamp model method run aws-config-compliance get_compliance_summaryMethods
- get_non_compliant — Fetch non-compliant evaluations across all Config rules
- get_compliance_summary — Rule-level compliance counts with metadata
- list_rules — Active Config rule inventory
Prerequisites
AWS Config must be enabled with active rules. Requires IAM permissions:
- config:DescribeComplianceByConfigRule
- config:GetComplianceDetailsByConfigRule
- config:DescribeConfigRules
- sts:GetCallerIdentity
2026.08.21.1
Changed: AWS Config and STS API failures across get_non_compliant,
get_compliance_summary, and list_rules now raise an error naming the
failing operation (GetCallerIdentity, DescribeComplianceByConfigRule,
GetComplianceDetailsByConfigRule, DescribeConfigRules) plus the region
and, where relevant, the specific Config rule name and page being fetched.
Previously these calls surfaced the raw AWS SDK error with no indication of
which rule or request had failed.
Global Arguments
| Argument | Type | Description |
|---|---|---|
| region | string | AWS region to query |
| Argument | Type | Description |
|---|---|---|
| includeCompliant? | boolean | Also include COMPLIANT evaluations (larger output) |
Resources
2026.08.20.1
Changed: Bump @aws-sdk/* 3.1111.0 → 3.1114.0 (3 packages)
2026.08.15.1
Changed: Bump @aws-sdk/* 3.1104.0 → 3.1111.0 (3 packages)
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (3 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.08.15.1
Changed: Bump @aws-sdk/* 3.1104.0 → 3.1111.0 (3 packages)
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (3 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (3 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @aws-sdk/* 3.1094.0 → 3.1096.0 (2 packages)
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
2026.07.21.1
Changed: Bumped AWS SDK dependencies to 3.1091.0 (from 3.1090.0).
Upgrade note: No behavioral changes. Routine dependency maintenance.
2026.07.18.2
Added: An upgrades array entry (no-op) to config_compliance.ts for proper typeVersion tracking on existing instances. No schema or behavior changes.
2026.07.18.1
Changed: Bumped @aws-sdk/client-config-service and
@aws-sdk/client-sts from 3.1069.0 to 3.1090.0 for dependency freshness.
No behavior change.
2026.07.18.1
Changed: Bumped @aws-sdk/client-config-service and
@aws-sdk/client-sts from 3.1069.0 to 3.1090.0 for dependency freshness.
No behavior change.
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned