2026/11/11 - AWS Config - 4 updated api methods
Changes AWS Config now supports connectors for Google Cloud. PutConnector accepts a Google Cloud connector configuration, and ListConnectors returns Google Cloud connector details.
{'Connector': {'connectorConfiguration': {'gcp': {'gcpOrganizationId': 'string',
'serviceAccountEmail': 'string',
'workloadIdentityPoolProvider': 'string'}}}}
Returns the details of the specified connector.
See also: AWS API Documentation
Request Syntax
client.get_connector(
Arn='string'
)
string
[REQUIRED]
The Amazon Resource Name (ARN) of the connector.
dict
Response Syntax
{
'Connector': {
'name': 'string',
'arn': 'string',
'connectorConfiguration': {
'azure': {
'tenantIdentifier': 'string',
'clientIdentifier': 'string'
},
'gcp': {
'gcpOrganizationId': 'string',
'serviceAccountEmail': 'string',
'workloadIdentityPoolProvider': 'string'
}
},
'createdTime': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
Connector (dict) --
The details of the specified connector.
name (string) --
The name of the connector.
arn (string) --
The Amazon Resource Name (ARN) of the connector.
connectorConfiguration (dict) --
The provider-specific configuration for connecting to the third-party cloud service provider.
azure (dict) --
The configuration for an Azure connector.
tenantIdentifier (string) --
The Azure tenant identifier.
clientIdentifier (string) --
The Azure client identifier.
gcp (dict) --
The configuration for a Google Cloud connector.
gcpOrganizationId (string) --
The ID of the Google Cloud organization that contains the connector's management project, which is the project of the service account in serviceAccountEmail.
Required if the management project belongs to an organization. A connector needs an organization ID to record an entire organization or more than one project. Omit it only if the management project doesn't belong to an organization. In that case, the connector can record only the management project.
serviceAccountEmail (string) --
The email address of the Google Cloud service account that Config uses to access your Google Cloud resources. The format is SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com.
The project that contains this service account is the connector's management project. If the connector has no gcpOrganizationId, it can record only the management project.
workloadIdentityPoolProvider (string) --
The full resource name of the Google Cloud workload identity pool provider that trusts Config. The format is projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID.
createdTime (datetime) --
The date and time that the connector was created.
{'ConfigurationRecorderSummaries': {'provider': {'GCP'}}}
Returns a list of configuration recorders depending on the filters you specify.
See also: AWS API Documentation
Request Syntax
client.list_configuration_recorders(
Filters=[
{
'filterName': 'recordingScope',
'filterValue': [
'string',
]
},
],
MaxResults=123,
NextToken='string'
)
list
Filters the results based on a list of ConfigurationRecorderFilter objects that you specify.
(dict) --
Filters configuration recorders by recording scope.
filterName (string) --
The name of the type of filter. Currently, only recordingScope is supported.
filterValue (list) --
The value of the filter. For recordingScope, valid values include: INTERNAL and PAID.
INTERNAL indicates that the ConfigurationItems in scope for the configuration recorder are recorded for free.
PAID indicates that the ConfigurationItems in scope for the configuration recorder impact the costs to your bill.
(string) --
integer
The maximum number of results to include in the response.
string
The NextToken string returned on a previous page that you use to get the next page of results in a paginated response.
dict
Response Syntax
{
'ConfigurationRecorderSummaries': [
{
'arn': 'string',
'name': 'string',
'servicePrincipal': 'string',
'recordingScope': 'INTERNAL'|'PAID',
'provider': 'AZURE'|'GCP'
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
ConfigurationRecorderSummaries (list) --
A list of ConfigurationRecorderSummary objects that includes.
(dict) --
A summary of a configuration recorder, including the arn, name, servicePrincipal, recordingScope, and provider.
arn (string) --
The Amazon Resource Name (ARN) of the configuration recorder.
name (string) --
The name of the configuration recorder.
servicePrincipal (string) --
For service-linked configuration recorders, indicates which Amazon Web Services service the configuration recorder is linked to.
recordingScope (string) --
Indicates whether the ConfigurationItems in scope for the configuration recorder are recorded for free ( INTERNAL) or if you are charged a service fee for recording ( PAID).
provider (string) --
For service-linked configuration recorders that record resources from a third-party cloud service provider, indicates the cloud service provider. Valid values:
AZURE – The recorder records resources from Microsoft Azure
GCP – The recorder records resources from Google Cloud
NextToken (string) --
The NextToken string returned on a previous page that you use to get the next page of results in a paginated response.
{'ConnectorSummaries': {'gcpOrganizationId': 'string',
'provider': {'GCP'},
'serviceAccountEmail': 'string'}}
Returns a list of connectors depending on the filters you specify.
See also: AWS API Documentation
Request Syntax
client.list_connectors(
MaxResults=123,
NextToken='string',
Filters=[
{
'filterName': 'provider',
'filterValues': [
'string',
]
},
]
)
integer
The maximum number of results to include in the response.
string
The NextToken string returned on a previous page that you use to get the next page of results in a paginated response.
list
Filters the results based on a list of ConnectorFilter objects that you specify.
(dict) --
Filters connectors based on the connector provider.
filterName (string) --
The name of the filter. Currently, only provider is supported.
filterValues (list) --
The value of the filter. For provider, valid values include:
AZURE – The connector is for Microsoft Azure
GCP – The connector is for Google Cloud
(string) --
dict
Response Syntax
{
'ConnectorSummaries': [
{
'arn': 'string',
'name': 'string',
'provider': 'AZURE'|'GCP',
'tenantIdentifier': 'string',
'gcpOrganizationId': 'string',
'serviceAccountEmail': 'string',
'createdTime': datetime(2015, 1, 1)
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
ConnectorSummaries (list) --
A list of ConnectorSummary objects.
(dict) --
A summary of a connector.
arn (string) --
The Amazon Resource Name (ARN) of the connector.
name (string) --
The name of the connector.
provider (string) --
The third-party cloud service provider. Valid values:
AZURE – The connector is for Microsoft Azure
GCP – The connector is for Google Cloud
tenantIdentifier (string) --
The Azure tenant identifier for the connector. Returned only for Azure connectors.
gcpOrganizationId (string) --
The Google Cloud organization ID for the connector. Returned only for Google Cloud connectors.
serviceAccountEmail (string) --
The email address of the Google Cloud service account for the connector. Returned only for Google Cloud connectors.
createdTime (datetime) --
The date and time that the connector was created.
NextToken (string) --
The NextToken string returned on a previous page that you use to get the next page of results in a paginated response.
{'ConnectorConfiguration': {'gcp': {'gcpOrganizationId': 'string',
'serviceAccountEmail': 'string',
'workloadIdentityPoolProvider': 'string'}}}
Creates a connector that specifies the connection between a third-party cloud service provider and Config.
A connector is required to create a service-linked configuration recorder for a third-party cloud service provider using the PutThirdPartyServiceLinkedConfigurationRecorder operation.
This API creates a service-linked role AWSServiceRoleForConfigThirdParty in your account. The service-linked role is created only when the role does not exist in your account.
See also: AWS API Documentation
Request Syntax
client.put_connector(
ConnectorConfiguration={
'azure': {
'tenantIdentifier': 'string',
'clientIdentifier': 'string'
},
'gcp': {
'gcpOrganizationId': 'string',
'serviceAccountEmail': 'string',
'workloadIdentityPoolProvider': 'string'
}
},
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
dict
[REQUIRED]
The provider-specific configuration for connecting to the third-party cloud service provider.
azure (dict) --
The configuration for an Azure connector.
tenantIdentifier (string) -- [REQUIRED]
The Azure tenant identifier.
clientIdentifier (string) -- [REQUIRED]
The Azure client identifier.
gcp (dict) --
The configuration for a Google Cloud connector.
gcpOrganizationId (string) --
The ID of the Google Cloud organization that contains the connector's management project, which is the project of the service account in serviceAccountEmail.
Required if the management project belongs to an organization. A connector needs an organization ID to record an entire organization or more than one project. Omit it only if the management project doesn't belong to an organization. In that case, the connector can record only the management project.
serviceAccountEmail (string) -- [REQUIRED]
The email address of the Google Cloud service account that Config uses to access your Google Cloud resources. The format is SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com.
The project that contains this service account is the connector's management project. If the connector has no gcpOrganizationId, it can record only the management project.
workloadIdentityPoolProvider (string) -- [REQUIRED]
The full resource name of the Google Cloud workload identity pool provider that trusts Config. The format is projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID.
list
The tags for the connector. Each tag consists of a key and an optional value, both of which you define.
(dict) --
The tags for the resource. The metadata that you apply to a resource to help you categorize and organize them. Each tag consists of a key and an optional value, both of which you define. Tag keys can have a maximum character length of 128 characters, and tag values can have a maximum length of 256 characters.
Key (string) --
One part of a key-value pair that make up a tag. A key is a general label that acts like a category for more specific tag values.
Value (string) --
The optional part of a key-value pair that make up a tag. A value acts as a descriptor within a tag category (key).
dict
Response Syntax
{
'Arn': 'string'
}
Response Structure
(dict) --
Arn (string) --
The Amazon Resource Name (ARN) of the connector.