interface CfnGuardHookProps

Language	Type name
.NET	`Amazon.CDK.CfnGuardHookProps`
Go	`github.com/aws/aws-cdk-go/awscdk/v2#CfnGuardHookProps`
Java	`software.amazon.awscdk.CfnGuardHookProps`
Python	`aws_cdk.CfnGuardHookProps`
TypeScript	`aws-cdk-lib` » `CfnGuardHookProps`

Properties for defining a CfnGuardHook.

Example

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import * as cdk from 'aws-cdk-lib';
const cfnGuardHookProps: cdk.CfnGuardHookProps = {
  alias: 'alias',
  executionRole: 'executionRole',
  failureMode: 'failureMode',
  hookStatus: 'hookStatus',
  ruleLocation: {
    uri: 'uri',

    // the properties below are optional
    versionId: 'versionId',
  },
  targetOperations: ['targetOperations'],

  // the properties below are optional
  logBucket: 'logBucket',
  options: {
    inputParams: {
      uri: 'uri',

      // the properties below are optional
      versionId: 'versionId',
    },
  },
  stackFilters: {
    filteringCriteria: 'filteringCriteria',

    // the properties below are optional
    stackNames: {
      exclude: ['exclude'],
      include: ['include'],
    },
    stackRoles: {
      exclude: ['exclude'],
      include: ['include'],
    },
  },
  targetFilters: {
    actions: ['actions'],
    invocationPoints: ['invocationPoints'],
    targetNames: ['targetNames'],
  },
};

Properties

Name	Type	Description
alias	`string`	The type name alias for the Hook. This alias must be unique per account and Region.
executionRole	`string`	The IAM role that the Hook assumes to retrieve your Guard rules from S3 and optionally write a detailed Guard output report back.
failureMode	`string`	Specifies how the Hook responds when rules fail their evaluation.
hookStatus	`string`	Specifies if the Hook is `ENABLED` or `DISABLED` .
ruleLocation	`IResolvable` `\|` `S3LocationProperty`	Specifies the S3 location of your Guard rules.
targetOperations	`string[]`	Specifies which type of operation the Hook is run against.
logBucket?	`string`	Specifies the name of an S3 bucket to store the Guard output report.
options?	`IResolvable` `\|` `OptionsProperty`	Specifies the S3 location of your input parameters.
stackFilters?	`IResolvable` `\|` `StackFiltersProperty`	Specifies the stack level filters for the Hook.
targetFilters?	`IResolvable` `\|` `TargetFiltersProperty`	Specifies the target filters for the Hook.

alias

Type: string

The type name alias for the Hook. This alias must be unique per account and Region.

The alias must be in the form Name1::Name2::Name3 and must not begin with AWS . For example, Private::Guard::MyTestHook .

executionRole

Type: string

The IAM role that the Hook assumes to retrieve your Guard rules from S3 and optionally write a detailed Guard output report back.

failureMode

Type: string

Specifies how the Hook responds when rules fail their evaluation.

FAIL : Prevents the action from proceeding. This is helpful for enforcing strict compliance or security policies.
WARN : Issues warnings to users but allows actions to continue. This is useful for non-critical validations or informational checks.