AWS Config

Protocol: JSON 1.1 (X-Amz-Target: StarlingDoveService.*) Endpoint: POST http://localhost:4566/

Supported Actions

Config Rules

Action	Description
`PutConfigRule`	Create or update a config rule (full rule shape round-trips: description, scope, source details, input parameters, execution frequency, evaluation modes)
`DeleteConfigRule`	Delete a config rule and its evaluation results
`DescribeConfigRules`	List config rules, optionally filtered by name, paginated via `NextToken`
`DescribeConfigRuleEvaluationStatus`	Get evaluation status for config rules
`StartConfigRulesEvaluation`	Trigger evaluation for config rules

Compliance & Evaluations

Action	Description
`PutEvaluations`	Report evaluation results for a config rule (supports `TestMode`)
`PutExternalEvaluation`	Report a single external evaluation for a config rule
`DeleteEvaluationResults`	Delete all evaluation results for a config rule
`DescribeComplianceByConfigRule`	Get rule-level compliance aggregated from reported evaluations
`DescribeComplianceByResource`	Get resource-level compliance aggregated across rules
`GetComplianceDetailsByConfigRule`	List the evaluation results recorded for a rule
`GetComplianceDetailsByResource`	List the evaluation results recorded for a resource
`GetComplianceSummaryByConfigRule`	Count compliant and non-compliant rules
`GetComplianceSummaryByResourceType`	Count compliant and non-compliant resources, grouped by type

Configuration Recorder

Action	Description
`PutConfigurationRecorder`	Create or update a configuration recorder
`DescribeConfigurationRecorders`	List configuration recorders
`DeleteConfigurationRecorder`	Delete a configuration recorder
`StartConfigurationRecorder`	Start recording configuration changes
`StopConfigurationRecorder`	Stop recording configuration changes
`DescribeConfigurationRecorderStatus`	Get the status of configuration recorders

Delivery Channel

Action	Description
`PutDeliveryChannel`	Create or update a delivery channel
`DescribeDeliveryChannels`	List delivery channels
`DeleteDeliveryChannel`	Delete a delivery channel (fails while the recorder is running)

Retention Configuration

Action	Description
`PutRetentionConfiguration`	Set the retention period (30-2557 days)
`DescribeRetentionConfigurations`	List retention configurations
`DeleteRetentionConfiguration`	Delete the retention configuration

Conformance Packs

Action	Description
`PutConformancePack`	Create or update a conformance pack
`DeleteConformancePack`	Delete a conformance pack
`DescribeConformancePacks`	List conformance packs, paginated via `Limit`/`NextToken`
`DescribeConformancePackStatus`	Get the deployment status of conformance packs

Aggregation Authorizations

Action	Description
`PutAggregationAuthorization`	Authorize an account and region to aggregate this account's Config data
`DescribeAggregationAuthorizations`	List aggregation authorizations, paginated via `Limit`/`NextToken`
`DeleteAggregationAuthorization`	Revoke an aggregation authorization

Tagging

Action	Description
`TagResource`	Add tags to a Config resource
`UntagResource`	Remove tags from a Config resource
`ListTagsForResource`	List tags on a Config resource

Configuration

Variable	Default	Description
`FLOCI_SERVICES_CONFIGSERVICE_ENABLED`	`true`	Enable or disable the service

Examples

export AWS_ENDPOINT_URL=http://localhost:4566

# Create a config rule
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "s3-bucket-versioning",
  "Description": "Checks that versioning is enabled",
  "Scope": {"ComplianceResourceTypes": ["AWS::S3::Bucket"]},
  "Source": {
    "Owner": "AWS",
    "SourceIdentifier": "S3_BUCKET_VERSIONING_ENABLED"
  }
}'

# List config rules
aws configservice describe-config-rules

# Report evaluation results (the ResultToken is the rule name, see Deviations)
aws configservice put-evaluations \
  --result-token s3-bucket-versioning \
  --evaluations '[{
    "ComplianceResourceType": "AWS::S3::Bucket",
    "ComplianceResourceId": "my-bucket",
    "ComplianceType": "NON_COMPLIANT",
    "Annotation": "Versioning is suspended",
    "OrderingTimestamp": 1700000000.0
  }]'

# Rule compliance now reflects the reported evaluations
aws configservice describe-compliance-by-config-rule \
  --config-rule-names s3-bucket-versioning

# Inspect per-resource evaluation results
aws configservice get-compliance-details-by-config-rule \
  --config-rule-name s3-bucket-versioning

# Set the retention period
aws configservice put-retention-configuration --retention-period-in-days 365

# Create a configuration recorder
aws configservice put-configuration-recorder --configuration-recorder '{
  "name": "default",
  "roleARN": "arn:aws:iam::012345678901:role/config-role",
  "recordingGroup": {
    "allSupported": true,
    "includeGlobalResourceTypes": true
  }
}'

# Start recording
aws configservice start-configuration-recorder --configuration-recorder-name default

# Check recorder status
aws configservice describe-configuration-recorder-status

# Create a conformance pack
aws configservice put-conformance-pack \
  --conformance-pack-name my-pack \
  --template-body "Resources: {}"

# List conformance packs
aws configservice describe-conformance-packs

# Authorize another account to aggregate this account's data
aws configservice put-aggregation-authorization \
  --authorized-account-id 111122223333 \
  --authorized-aws-region eu-west-1

# List aggregation authorizations
aws configservice describe-aggregation-authorizations

# Tag a resource
aws configservice tag-resource \
  --resource-arn arn:aws:config:us-east-1:000000000000:config-rule/config-rule-abc123 \
  --tags Key=env,Value=dev

# Delete a config rule
aws configservice delete-config-rule --config-rule-name s3-bucket-versioning

Deviations

Note

Compliance is driven entirely by evaluations reported through PutEvaluations and PutExternalEvaluation — Floci does not record resource configurations or run rule evaluations itself. Until an evaluation is reported, compliance returns INSUFFICIENT_DATA.

ResultToken: real AWS hands custom rules an opaque token inside the evaluation event. Floci has no evaluation event, so PutEvaluations expects the config rule name as the token (a <rule-name>:<suffix> form is also accepted).
StartConfigRulesEvaluation marks the rule as invoked but does not call the rule's Lambda function.
FirstActivatedTime and invocation timestamps are runtime state and are not persisted across restarts.
DescribeConfigRules and DescribeComplianceByConfigRule use a fixed page size of 25.
Configuration recorders and delivery channels are stored and validated, but no configuration items or snapshots are produced.
Conformance pack status is always CREATE_SUCCESSFUL; pack templates are stored, not evaluated.
PutAggregationAuthorization records the authorization and returns its ARN, but no data is aggregated: configuration aggregators are not emulated. DeleteAggregationAuthorization on an authorization that does not exist succeeds, because the Config API models no "not found" error for that operation.