AWS Config Recording Status

AnalysisType: policy
Filename: aws_config_recording_no_error.py
PolicyID: "AWS.Config.RecordingNoErrors"
DisplayName: "AWS Config Recording Status"
Enabled: true
ResourceTypes:
  - AWS.Config.Recorder
Tags:
  - AWS
  - Panther
Severity: Medium
Description: >
  This policy ensures that the config recorder is operational and capturing changes to
  your account without error.
Runbook: >
  Check the AWS Config console to understand and resolve the cause of the errors.
Reference: https://docs.aws.amazon.com/config/latest/developerguide/notification-delivery-failed.html
Tests:
  - Name: Recording Enabled with No Errors
    ExpectedResult: true
    Resource:
      {
        "Recorder":
          {
            "Name": "default",
            "RecordingGroup":
              {
                "AllSupported": true,
                "IncludeGlobalResourceTypes": true,
                "ResourceTypes": [],
              },
            "RoleARN": "arn:aws:iam::112233445566:role/role-name",
          },
        "Region": "us-west-2",
        "Status":
          {
            "LastErrorCode": null,
            "LastErrorMessage": null,
            "LastStartTime": "2019-01-01T00:00:00Z",
            "LastStatus": "SUCCESS",
            "LastStatusChangeTime": "2019-01-01T00:00:00Z",
            "LastStopTime": null,
            "Name": "default",
            "Recording": true,
          },
      }
  - Name: Recording Errored
    ExpectedResult: false
    Resource:
      {
        "Recorder":
          {
            "Name": "default",
            "RecordingGroup":
              {
                "AllSupported": false,
                "IncludeGlobalResourceTypes": true,
                "ResourceTypes": [],
              },
            "RoleARN": "arn:aws:iam::112233445566:role/role-name",
          },
        "Region": "us-west-2",
        "Status":
          {
            "LastErrorCode": "NoSuchBucket",
            "LastErrorMessage": "Failed to deliver notification to bucket: bucket-example for account 123456789012 in region us-west-2",
            "LastStartTime": "2019-01-01T00:00:00Z",
            "LastStatus": "SUCCESS",
            "LastStatusChangeTime": "2019-01-01T00:00:00Z",
            "LastStopTime": null,
            "Name": "default",
            "Recording": true,
          },
      }