AWS Config ExecModule

Overview

The AWS Config ExecModule gives ValkyrAI workflows a governed view of how AWS resources are configured, whether they comply with reviewed rules, and how that state changes over time. Teams can monitor configuration recorders, build bounded compliance queues, query inventory, inspect conformance packs, review remediation definitions, and request an explicit rule evaluation without passing AWS credentials through workflow data.

This connector is designed for evidence and orchestration rather than unrestricted export. It normalizes the AWS Config control plane into stable maps, bounds pagination, validates every operation-specific field, and omits sensitive nested configuration by default. A workflow can identify a non-compliant resource and route it to an owner or an approved remediation connector while keeping the AWS Config connector focused on configuration posture.

The module uses ValkyrAI's native map ABI, annotation-backed Workflow Studio discovery, and a verified IntegrationAccount. Workflow input never accepts raw access keys, secret keys, session tokens, authorization headers, endpoint overrides, or arbitrary SDK requests.

Usage

Enable AWS Config and a configuration recorder in every AWS region the workflow must inspect.
Create a least-privilege AWS identity containing only the Config actions used by the workflow.
Store its access-key pair in a ValkyrAI IntegrationAccount, verify it, and leave it in READY status.
Add AwsConfigModule and bind the account through ExecModuleConfig.authConfig.integrationAccount.
Set the exact AWS region, choose one supported operation, and provide only that operation's documented fields.
Use exact filters plus returnAll and limit to keep compliance, history, inventory, and conformance reads bounded.
Place start_config_rules_evaluation behind a human or policy approval and set confirmEvaluation: true only for reviewed rules.

AWS Config is regional. Select the region that records the intended resources, rules, and conformance packs. The connector does not create a recorder, deliver snapshots, deploy conformance packs, alter rules, or run remediation actions.

Inputs

Input	Type	Required	Default	Description
`operation`	string	Yes	—	One supported AWS Config operation.
`region`	string	Yes	—	Exact AWS region such as `us-west-2`.
`nextToken`	string	No	—	Opaque continuation token returned by AWS.
`limit`	integer	No	`100`	Total result bound from 1 to 1,000 for reads.
`returnAll`	boolean	No	`false`	Follow provider pages until `limit` or exhaustion.
`configurationRecorderNames`	array	No	—	Zero to 25 unique recorder names.
`configRuleNames`	array	Operation-specific	—	Zero to 25 unique Config rule names; at least one is required for remediation visibility and rule evaluation.
`configRuleName`	string	Operation-specific	—	Exact rule name for rule-level compliance evidence.
`complianceTypes`	array	No	—	`COMPLIANT`, `NON_COMPLIANT`, `NOT_APPLICABLE`, or `INSUFFICIENT_DATA`. Conformance-pack detail accepts at most one.
`resourceType`	string	Operation-specific	—	Exact Config resource type such as `AWS::EC2::Instance`.
`resourceId`	string	Operation-specific	—	Exact resource identifier.
`earlierTime` / `laterTime`	ISO-8601 string	No	—	Inclusive history window. The lower bound cannot follow the upper bound.
`chronologicalOrder`	string	No	`Reverse`	`Forward` or `Reverse` resource-history order.
`includeConfiguration`	boolean	No	`false`	Include bounded raw configuration JSON in history output.
`expression`	string	Query only	—	AWS Config advanced-query `SELECT` expression, bounded to 4,096 characters.
`conformancePackNames`	array	No	—	Zero to 25 unique conformance-pack names.
`conformancePackName`	string	Detail only	—	Exact conformance-pack name.
`confirmEvaluation`	boolean	Evaluation only	`false`	Confirms one exact rule-evaluation request.

Unknown or operation-inappropriate fields are rejected before any provider call. Lists are bounded and reject duplicates. Raw credentials and transport overrides are always rejected as workflow input.

Outputs

All operations return a stable envelope:

Output	Description
`status`	`success` or `error`.
`operation`	Normalized operation name.
`attempts`	Provider calls, including pages and safe read retries.
`resultType`	Result family such as `rule_compliance`, `resource_query`, or `evaluation_request`.
`items` / `count`	Bounded normalized list results and returned count.
`pages` / `hasMore` / `nextToken`	Pagination evidence for list operations.
`data`	Normalized single result, query metadata, or evaluation receipt.
`requestId`	AWS request identifier when safely available.
`error`	Stable code, redacted message, HTTP status, and retryability.

Resource history returns identity, type, status, timestamps, tags, relationships, and related event IDs. The raw configuration JSON is excluded unless includeConfiguration is explicitly true. Conformance-pack output reports input parameter names but not values. Remediation output reports parameter names but not parameter bodies. Advanced-query rows remain bounded strings so the workflow can parse only the fields it deliberately selected.

IntegrationAccount Requirements

Use an AWS IntegrationAccount with:

status: READY
verified: true
access key ID in the account API-key field
secret access key in the protected password field

The connector never reads credentials from workflow input. It creates a regional AWS SDK client only after account verification and disables SDK-level retries so ValkyrAI can report exact attempt counts.

Grant only the actions needed by selected operations. A read-oriented deployment may need a subset of:

config:DescribeConfigurationRecorders
config:DescribeConfigurationRecorderStatus
config:DescribeConfigRules
config:DescribeComplianceByConfigRule
config:GetComplianceDetailsByConfigRule
config:GetResourceConfigHistory
config:SelectResourceConfig
config:DescribeConformancePacks
config:DescribeConformancePackStatus
config:GetConformancePackComplianceDetails
config:DescribeRemediationConfigurations

Only workflows that request evaluation need config:StartConfigRulesEvaluation. Do not grant recorder mutation, rule mutation, conformance-pack deployment, remediation execution, aggregation mutation, delivery-channel mutation, or broad wildcard access merely to satisfy a read workflow.

Configuration

ExecModuleConfig supplies the IntegrationAccount and optional retry policy. Read operations may retry transient throttling, internal errors, and network failures up to the configured maximum, bounded from one to five attempts. The default is three attempts.

start_config_rules_evaluation is sent once. If AWS returns an ambiguous network or service response, inspect Config rule state before retrying. ValkyrAI never automatically replays this external write.

Operations

Recorder and rule health

describe_configuration_recorders — inspect configured recorder names, roles, recording groups, recording modes, scope, and exclusion behavior.
describe_configuration_recorder_status — inspect recording state, last start/stop times, last known status, and bounded recorder error code/message details.
describe_config_rules — list bounded rule identity, description, scope, source ownership, maximum execution frequency, and evaluation modes.

These operations help distinguish “a resource is compliant” from “the region is actually recording and evaluating the expected scope.” They do not create, start, stop, or change a recorder or rule.

Compliance evidence

describe_compliance_by_config_rule — retrieve bounded compliance summaries for exact rules and optional compliance types.
get_compliance_details_by_config_rule — retrieve resource-level evaluation evidence for one exact rule, including evaluator identity, resource identity, ordering timestamp, and result-recorded timestamp.

A practical workflow can route NON_COMPLIANT evidence to an owning team, enrich the resource through a service-specific connector, and require approval before remediation. Compliance evidence describes an evaluation result; it is not proof that a routed fix was applied.

Inventory and change history

get_resource_config_history — retrieve bounded configuration history for one exact resource type and ID, optionally within an ISO-8601 window.
select_resource_config — run a bounded AWS Config advanced query for inventory or posture reporting.

History output excludes raw configuration JSON by default. Turn on includeConfiguration only when the workflow has a reviewed need and a destination appropriate for confidential configuration data. Advanced query expressions are sent to AWS as supplied after length validation; write a narrow SELECT list rather than exporting fields the workflow does not need.

Conformance packs and remediation visibility

describe_conformance_packs — list bounded pack identity, delivery bucket details, creation/update time, and input parameter names.
describe_conformance_pack_status — inspect pack deployment status, timestamps, and last update time.
get_conformance_pack_compliance_details — retrieve bounded rule/resource evaluation results for one exact pack with optional rule, compliance, resource-type, and resource-ID filters.
describe_remediation_configurations — inspect automatic/manual mode, target type and ID, execution controls, maximum attempts, retry interval, and parameter names for one to 25 exact rules.

The module intentionally omits conformance input values, remediation parameter bodies, and provider diagnostic text. These reads show governance intent and status; they do not deploy packs or execute remediation.

Rule evaluation

start_config_rules_evaluation — request evaluation for one to 25 exact rules.

This operation requires confirmEvaluation: true, is sent once, and never retries automatically. It does not change a rule definition or remediate a resource, but it can cause AWS Config to evaluate resources and incur service activity, so it belongs behind explicit approval.

Errors and Failure Modes

Code	Meaning	Retry guidance
`VALIDATION_ERROR`	A required field, name, enum, bound, time window, query, filter, or confirmation is invalid.	Correct input; no provider call was made.
`INTEGRATION_ACCOUNT_ERROR`	The bound account is missing, unverified, not `READY`, or incomplete.	Repair and verify the account.
`UNSUPPORTED_OPERATION`	The operation is outside this release.	Select one documented operation.
`AWS_CONFIG_HTTP_400`	AWS rejected an input, state, expression, or regional prerequisite.	Correct the target or request; inspect the request ID.
`AWS_CONFIG_HTTP_403`	IAM denied an AWS Config action.	Add only the missing least-privilege permission.
`AWS_CONFIG_HTTP_404`	A rule, resource, or conformance pack was not found.	Confirm region and exact identifier.
`AWS_CONFIG_HTTP_429` / `500` / `502` / `503` / `504`	Throttling or transient provider pressure.	Reads retry; evaluation state must be reconciled first.
`NETWORK_ERROR`	ValkyrAI could not reach AWS.	Reads may retry; inspect rule state before replaying an evaluation.
`EXECUTION_ERROR`	An unexpected local failure was safely contained.	Inspect server logs; secrets remain redacted.

Provider exception messages are not returned to workflow output. AWS request IDs are retained when safely available for CloudTrail and support correlation.

Example

The following workflow step retrieves non-compliant evidence for one reviewed encryption rule:

{
  "operation": "get_compliance_details_by_config_rule",
  "region": "us-west-2",
  "configRuleName": "encrypted-volumes",
  "complianceTypes": ["NON_COMPLIANT"],
  "returnAll": true,
  "limit": 250
}

Expected result shape:

{
  "status": "success",
  "operation": "get_compliance_details_by_config_rule",
  "attempts": 1,
  "resultType": "compliance_evidence",
  "items": [
    {
      "complianceType": "NON_COMPLIANT",
      "configRuleName": "encrypted-volumes",
      "resourceType": "AWS::EC2::Volume",
      "resourceId": "vol-0123456789abcdef0",
      "orderingTimestamp": "2026-10-24T12:00:00Z",
      "resultRecordedTime": "2026-10-24T12:01:00Z"
    }
  ],
  "count": 1,
  "pages": 1,
  "hasMore": false,
  "requestId": "example-request-id"
}

A follow-up workflow can deduplicate by rule and resource identity, route the evidence to the owning team, enrich the target with an EC2 or CloudTrail connector, and wait for reviewed remediation. A later Config read can confirm evaluation state without treating the routing step itself as a fix.

Notes

Pagination: Opaque AWS tokens are preserved. returnAll follows no more than 100 pages and never returns more than 1,000 items.
Rate limits: Only reads retry transient failures, with bounded backoff and at most five configured attempts.
API limits: Name lists accept at most 25 unique values. Conformance detail accepts at most one compliance type. Advanced query text is bounded to 4,096 characters.
Idempotency: Reads are repeatable. Rule evaluation is single-attempt; reconcile rule state after an ambiguous response.
Destructive behavior: No operation deletes or rewrites AWS Config resources. Evaluation can cause provider activity and therefore requires confirmation.
Regional scope: Recorders, rules, resource history, conformance packs, and evaluation state are region-scoped. Endpoint overrides are not accepted.
Data minimization: Raw resource configuration is opt-in; conformance parameter values, remediation parameter bodies, raw provider exception messages, and raw SDK payloads are not returned. Recorder status may include AWS's bounded last error code/message for operational diagnosis.
Credential boundary: Live AWS behavior remains unverified until an authorized least-privilege non-production account and reviewed Config resources are supplied.
Deferred capabilities: Recorder, delivery-channel, rule, conformance-pack, aggregation, retention, remediation, and organization mutation are intentionally deferred.
Runtime boundary: Merged source and published documentation do not update the deployed Workflow Studio catalog until a ValkyrAI backend release exposes AwsConfigModule through /v1/modules/metadata.

Overview​

Usage​

Inputs​

Outputs​

IntegrationAccount Requirements​

Configuration​

Operations​

Recorder and rule health​

Compliance evidence​

Inventory and change history​

Conformance packs and remediation visibility​

Rule evaluation​

Errors and Failure Modes​

Example​

Notes​

Related resources​