The integration of AWS CloudFormation Hooks with AWS Cloud Control API (CCAPI) has been announced, which allows the use of hooks to validate the configuration of resources being provisioned through CCAPI.
CloudFormation Hooks enable the validation of resource configuration during resource create and update operations and can be triggered on change sets, entire stack templates or by each resource.
Hooks can be configured to prevent any misconfigured resources from being deployed in your account and can enforce security best practices, apply organizational policies and standardize validation across infrastructure as code solutions like CloudFormation, Terraform, and Pulumi.
The new AWS::Hooks::GuardHook enables the use of the Guard DSL inside of a hook and allows for easy implementation of organizational guidelines.
The hook can be configured to log the Guard validation report to an Amazon Simple Storage Service (S3) bucket and use rule from AWS CloudFormation Guard registry to validate that an S3 bucket is using versioning.
The Terraform AWS Cloud Control Provider allows for the use of hooks to validate the configuration of Terraform provisioned resources.
CloudFormation Hooks provide a powerful way to enforce best practices and compliance for AWS resources and, by leveraging them and the Cloud Control API, consistent validation of resources before deployment can be created across multiple infrastructure as code solutions.
The announcement will give users an additional way to use hooks to validate security and other requirements before any changes are made to stack resources.
The integration provides another way to validate AWS resources before being provisioned and makes it easier to use the same policy-as-code tool across accounts.
The Terraform AWS Cloud Control Provider allows creation of execution plans, management of AWS resources using CCAPI and Terraform and Terraform, which facilitates easier creation of AWS resources.