aws-config-cli

aws configservice put-config-rule

Deploy AWS Config rules via CLI, managing account configuration evaluation as code.

Run it in the infrastructure pipeline when you want Config rules as code: aws configservice put-config-rule deploys the rule (AWS managed or custom) with its configuration — evaluating resources (private buckets, encryption, security groups) against the rule. It's Config management via CLI (or IaC): versioned rules deployed with the pipeline. In AWS DevSecOps, Config rules are the continuous evaluation layer: the rule deployed with put-config-rule (or in Terraform/CloudFormation) and NON_COMPLIANT resources detected.

Don't use it without the recorder active: Config evaluates with the recorder — without the recorder (and delivery to S3), evaluations aren't generated. And note: managed rules cover common controls — organization-specific ones (conventions) require custom rules (custom lambdas). Config cost (continuous evaluations) is sized: rules cover the critical. For IaC deployment, rules in Terraform/CloudFormation; CLI is for point management (and the sheet documents it).