@stacksjs/ts-cloud-core 0.1.1

package/src/cloudformation/types.ts

@@ -0,0 +1,173 @@
+/**
+ * CloudFormation Template Types
+ * Based on AWS CloudFormation Resource Specification
+ */
+
+export interface CloudFormationTemplate {
+  AWSTemplateFormatVersion: '2010-09-09'
+  Description?: string
+  Metadata?: Record<string, any>
+  Parameters?: Record<string, CloudFormationParameter>
+  Mappings?: Record<string, Record<string, Record<string, string>>>
+  Conditions?: Record<string, CloudFormationCondition>
+  Resources: Record<string, CloudFormationResource>
+  Outputs?: Record<string, CloudFormationOutput>
+}
+
+export interface CloudFormationParameter {
+  Type: 'String' | 'Number' | 'List<Number>' | 'CommaDelimitedList' | 'AWS::EC2::AvailabilityZone::Name' | 'AWS::EC2::Image::Id' | 'AWS::EC2::Instance::Id' | 'AWS::EC2::KeyPair::KeyName' | 'AWS::EC2::SecurityGroup::GroupName' | 'AWS::EC2::SecurityGroup::Id' | 'AWS::EC2::Subnet::Id' | 'AWS::EC2::Volume::Id' | 'AWS::EC2::VPC::Id' | 'AWS::Route53::HostedZone::Id' | 'List<AWS::EC2::AvailabilityZone::Name>' | 'List<AWS::EC2::Image::Id>' | 'List<AWS::EC2::Instance::Id>' | 'List<AWS::EC2::SecurityGroup::GroupName>' | 'List<AWS::EC2::SecurityGroup::Id>' | 'List<AWS::EC2::Subnet::Id>' | 'List<AWS::EC2::Volume::Id>' | 'List<AWS::EC2::VPC::Id>' | 'List<AWS::Route53::HostedZone::Id>'
+  Default?: string | number
+  Description?: string
+  AllowedValues?: string[]
+  AllowedPattern?: string
+  MinLength?: number
+  MaxLength?: number
+  MinValue?: number
+  MaxValue?: number
+  ConstraintDescription?: string
+  NoEcho?: boolean
+}
+
+export interface CloudFormationResource {
+  Type: string
+  Properties?: Record<string, any>
+  DependsOn?: string | string[]
+  Condition?: string
+  Metadata?: Record<string, any>
+  CreationPolicy?: Record<string, any>
+  UpdatePolicy?: Record<string, any>
+  DeletionPolicy?: 'Delete' | 'Retain' | 'Snapshot'
+  UpdateReplacePolicy?: 'Delete' | 'Retain' | 'Snapshot'
+}
+
+export interface CloudFormationOutput {
+  Value: any
+  Description?: string
+  Export?: {
+    Name: any
+  }
+  Condition?: string
+}
+
+export type CloudFormationCondition =
+  | CloudFormationIntrinsicFunction
+  | boolean
+
+/**
+ * CloudFormation Intrinsic Functions
+ */
+export type CloudFormationIntrinsicFunction =
+  | { Ref: string }
+  | { 'Fn::GetAtt': [string, string] }
+  | { 'Fn::Join': [string, any[]] }
+  | { 'Fn::Sub': string | [string, Record<string, any>] }
+  | { 'Fn::Select': [number, any[] | CloudFormationIntrinsicFunction] }
+  | { 'Fn::Split': [string, string] }
+  | { 'Fn::GetAZs': string }
+  | { 'Fn::ImportValue': any }
+  | { 'Fn::FindInMap': [string, any, any] }
+  | { 'Fn::Base64': any }
+  | { 'Fn::Cidr': [any, number, number] }
+  | { 'Fn::Equals': [any, any] }
+  | { 'Fn::If': [string, any, any] }
+  | { 'Fn::Not': [any] }
+  | { 'Fn::And': any[] }
+  | { 'Fn::Or': any[] }
+
+/**
+ * Helper functions for creating CloudFormation intrinsic functions
+ */
+export const Fn = {
+  ref: (logicalId: string): { Ref: string } => ({ Ref: logicalId }),
+
+  getAtt: (logicalId: string, attribute: string): { 'Fn::GetAtt': [string, string] } =>
+    ({ 'Fn::GetAtt': [logicalId, attribute] as [string, string] }),
+
+  join: (delimiter: string, values: any[]): { 'Fn::Join': [string, any[]] } =>
+    ({ 'Fn::Join': [delimiter, values] as [string, any[]] }),
+
+  sub: (template: string, variables?: Record<string, any>): { 'Fn::Sub': string | [string, Record<string, any>] } =>
+    variables ? { 'Fn::Sub': [template, variables] as [string, Record<string, any>] } : { 'Fn::Sub': template },
+
+  select: (index: number, list: any[] | CloudFormationIntrinsicFunction): { 'Fn::Select': [number, any[] | CloudFormationIntrinsicFunction] } =>
+    ({ 'Fn::Select': [index, list] as [number, any[] | CloudFormationIntrinsicFunction] }),
+
+  split: (delimiter: string, source: string): { 'Fn::Split': [string, string] } =>
+    ({ 'Fn::Split': [delimiter, source] as [string, string] }),
+
+  getAZs: (region: string = ''): { 'Fn::GetAZs': string } => ({ 'Fn::GetAZs': region }),
+
+  importValue: (name: any): { 'Fn::ImportValue': any } => ({ 'Fn::ImportValue': name }),
+
+  findInMap: (mapName: string, topLevelKey: any, secondLevelKey: any): { 'Fn::FindInMap': [string, any, any] } =>
+    ({ 'Fn::FindInMap': [mapName, topLevelKey, secondLevelKey] as [string, any, any] }),
+
+  base64: (value: any): { 'Fn::Base64': any } => ({ 'Fn::Base64': value }),
+
+  cidr: (ipBlock: any, count: number, cidrBits: number): { 'Fn::Cidr': [any, number, number] } =>
+    ({ 'Fn::Cidr': [ipBlock, count, cidrBits] as [any, number, number] }),
+
+  equals: (value1: any, value2: any): { 'Fn::Equals': [any, any] } =>
+    ({ 'Fn::Equals': [value1, value2] as [any, any] }),
+
+  if: (conditionName: string, trueValue: any, falseValue: any): { 'Fn::If': [string, any, any] } =>
+    ({ 'Fn::If': [conditionName, trueValue, falseValue] as [string, any, any] }),
+
+  not: (condition: any): { 'Fn::Not': [any] } => ({ 'Fn::Not': [condition] as [any] }),
+
+  and: (...conditions: any[]): { 'Fn::And': any[] } => ({ 'Fn::And': conditions }),
+
+  or: (...conditions: any[]): { 'Fn::Or': any[] } => ({ 'Fn::Or': conditions }),
+}
+
+/**
+ * Common AWS resource ARN patterns
+ */
+export const Arn = {
+  s3Bucket: (bucketName: any): { 'Fn::Sub': string | [string, Record<string, any>] } =>
+    Fn.sub(`arn:aws:s3:::${bucketName}`),
+
+  s3Object: (bucketName: any, key: string = '*'): { 'Fn::Sub': string | [string, Record<string, any>] } =>
+    Fn.sub(`arn:aws:s3:::${bucketName}/${key}`),
+
+  lambda: (functionName: string, region?: string, account?: string): { 'Fn::Sub': string | [string, Record<string, any>] } =>
+    Fn.sub(
+      `arn:aws:lambda:\${AWS::Region}:\${AWS::AccountId}:function:${functionName}`,
+      region && account ? { 'AWS::Region': region, 'AWS::AccountId': account } : undefined,
+    ),
+
+  dynamodb: (tableName: string): { 'Fn::Sub': string | [string, Record<string, any>] } =>
+    Fn.sub(`arn:aws:dynamodb:\${AWS::Region}:\${AWS::AccountId}:table/${tableName}`),
+
+  sqs: (queueName: string): { 'Fn::Sub': string | [string, Record<string, any>] } =>
+    Fn.sub(`arn:aws:sqs:\${AWS::Region}:\${AWS::AccountId}:${queueName}`),
+
+  sns: (topicName: string): { 'Fn::Sub': string | [string, Record<string, any>] } =>
+    Fn.sub(`arn:aws:sns:\${AWS::Region}:\${AWS::AccountId}:${topicName}`),
+
+  kinesis: (streamName: string): { 'Fn::Sub': string | [string, Record<string, any>] } =>
+    Fn.sub(`arn:aws:kinesis:\${AWS::Region}:\${AWS::AccountId}:stream/${streamName}`),
+
+  iam: (resourceType: 'role' | 'policy' | 'user' | 'group', name: string): { 'Fn::Sub': string | [string, Record<string, any>] } =>
+    Fn.sub(`arn:aws:iam::\${AWS::AccountId}:${resourceType}/${name}`),
+
+  secretsManager: (secretName: string): { 'Fn::Sub': string | [string, Record<string, any>] } =>
+    Fn.sub(`arn:aws:secretsmanager:\${AWS::Region}:\${AWS::AccountId}:secret:${secretName}`),
+
+  cloudwatch: (logGroup: string): { 'Fn::Sub': string | [string, Record<string, any>] } =>
+    Fn.sub(`arn:aws:logs:\${AWS::Region}:\${AWS::AccountId}:log-group:${logGroup}`),
+}
+
+/**
+ * Common CloudFormation pseudo parameters
+ */
+export const AWS_PSEUDO_PARAMETERS = {
+  ACCOUNT_ID: { Ref: 'AWS::AccountId' },
+  NOTIFICATION_ARNS: { Ref: 'AWS::NotificationARNs' },
+  NO_VALUE: { Ref: 'AWS::NoValue' },
+  PARTITION: { Ref: 'AWS::Partition' },
+  REGION: { Ref: 'AWS::Region' },
+  STACK_ID: { Ref: 'AWS::StackId' },
+  STACK_NAME: { Ref: 'AWS::StackName' },
+  URL_SUFFIX: { Ref: 'AWS::URLSuffix' },
+}

package/src/compliance/aws-config.ts

@@ -0,0 +1,543 @@
+/**
+ * AWS Config Rules
+ * Automated compliance checking and configuration management
+ */
+
+export interface ConfigRule {
+  id: string
+  name: string
+  description: string
+  source: 'AWS_MANAGED' | 'CUSTOM_LAMBDA'
+  identifier?: string
+  lambdaFunctionArn?: string
+  inputParameters?: Record<string, any>
+  scope?: ConfigScope
+  maxExecutionFrequency?: 'One_Hour' | 'Three_Hours' | 'Six_Hours' | 'Twelve_Hours' | 'TwentyFour_Hours'
+}
+
+export interface ConfigScope {
+  complianceResourceTypes?: string[]
+  tagKey?: string
+  tagValue?: string
+}
+
+export interface ConfigRecorder {
+  name: string
+  roleArn: string
+  recordingGroup?: RecordingGroup
+}
+
+export interface RecordingGroup {
+  allSupported?: boolean
+  includeGlobalResourceTypes?: boolean
+  resourceTypes?: string[]
+}
+
+export interface DeliveryChannel {
+  name: string
+  s3BucketName: string
+  s3KeyPrefix?: string
+  snsTopicArn?: string
+  configSnapshotDeliveryProperties?: {
+    deliveryFrequency?: 'One_Hour' | 'Three_Hours' | 'Six_Hours' | 'Twelve_Hours' | 'TwentyFour_Hours'
+  }
+}
+
+/**
+ * AWS Config manager
+ */
+export class AWSConfigManager {
+  private configRules: Map<string, ConfigRule> = new Map()
+  private configRecorders: Map<string, ConfigRecorder> = new Map()
+  private deliveryChannels: Map<string, DeliveryChannel> = new Map()
+  private ruleCounter = 0
+
+  /**
+   * Create config recorder
+   */
+  createConfigRecorder(recorder: ConfigRecorder): ConfigRecorder {
+    this.configRecorders.set(recorder.name, recorder)
+    return recorder
+  }
+
+  /**
+   * Create delivery channel
+   */
+  createDeliveryChannel(channel: DeliveryChannel): DeliveryChannel {
+    this.deliveryChannels.set(channel.name, channel)
+    return channel
+  }
+
+  /**
+   * Create config rule
+   */
+  createConfigRule(rule: Omit<ConfigRule, 'id'>): ConfigRule {
+    const id = `config-rule-${Date.now()}-${this.ruleCounter++}`
+
+    const configRule: ConfigRule = {
+      id,
+      ...rule,
+    }
+
+    this.configRules.set(id, configRule)
+
+    return configRule
+  }
+
+  /**
+   * Create S3 bucket encryption rule
+   */
+  createS3EncryptionRule(): ConfigRule {
+    return this.createConfigRule({
+      name: 's3-bucket-server-side-encryption-enabled',
+      description: 'Checks that S3 buckets have server-side encryption enabled',
+      source: 'AWS_MANAGED',
+      identifier: 'S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED',
+      scope: {
+        complianceResourceTypes: ['AWS::S3::Bucket'],
+      },
+    })
+  }
+
+  /**
+   * Create S3 bucket public access block rule
+   */
+  createS3PublicAccessBlockRule(): ConfigRule {
+    return this.createConfigRule({
+      name: 's3-bucket-public-read-prohibited',
+      description: 'Checks that S3 buckets do not allow public read access',
+      source: 'AWS_MANAGED',
+      identifier: 'S3_BUCKET_PUBLIC_READ_PROHIBITED',
+      scope: {
+        complianceResourceTypes: ['AWS::S3::Bucket'],
+      },
+    })
+  }
+
+  /**
+   * Create S3 bucket versioning rule
+   */
+  createS3VersioningRule(): ConfigRule {
+    return this.createConfigRule({
+      name: 's3-bucket-versioning-enabled',
+      description: 'Checks whether versioning is enabled for S3 buckets',
+      source: 'AWS_MANAGED',
+      identifier: 'S3_BUCKET_VERSIONING_ENABLED',
+      scope: {
+        complianceResourceTypes: ['AWS::S3::Bucket'],
+      },
+    })
+  }
+
+  /**
+   * Create RDS encryption rule
+   */
+  createRdsEncryptionRule(): ConfigRule {
+    return this.createConfigRule({
+      name: 'rds-storage-encrypted',
+      description: 'Checks whether storage encryption is enabled for RDS DB instances',
+      source: 'AWS_MANAGED',
+      identifier: 'RDS_STORAGE_ENCRYPTED',
+      scope: {
+        complianceResourceTypes: ['AWS::RDS::DBInstance'],
+      },
+    })
+  }
+
+  /**
+   * Create RDS snapshot encryption rule
+   */
+  createRdsSnapshotEncryptionRule(): ConfigRule {
+    return this.createConfigRule({
+      name: 'rds-snapshots-public-prohibited',
+      description: 'Checks if RDS snapshots are public',
+      source: 'AWS_MANAGED',
+      identifier: 'RDS_SNAPSHOTS_PUBLIC_PROHIBITED',
+      scope: {
+        complianceResourceTypes: ['AWS::RDS::DBSnapshot', 'AWS::RDS::DBClusterSnapshot'],
+      },
+    })
+  }
+
+  /**
+   * Create RDS backup rule
+   */
+  createRdsBackupRule(retentionPeriod: number = 7): ConfigRule {
+    return this.createConfigRule({
+      name: 'db-backup-enabled',
+      description: 'Checks whether RDS DB instances have backups enabled',
+      source: 'AWS_MANAGED',
+      identifier: 'DB_BACKUP_ENABLED',
+      inputParameters: {
+        backupRetentionPeriod: retentionPeriod,
+      },
+      scope: {
+        complianceResourceTypes: ['AWS::RDS::DBInstance'],
+      },
+    })
+  }
+
+  /**
+   * Create EC2 instance profile rule
+   */
+  createEc2InstanceProfileRule(): ConfigRule {
+    return this.createConfigRule({
+      name: 'ec2-instance-managed-by-systems-manager',
+      description: 'Checks if EC2 instances are managed by Systems Manager',
+      source: 'AWS_MANAGED',
+      identifier: 'EC2_INSTANCE_MANAGED_BY_SSM',
+      scope: {
+        complianceResourceTypes: ['AWS::EC2::Instance'],
+      },
+    })
+  }
+
+  /**
+   * Create EBS encryption rule
+   */
+  createEbsEncryptionRule(): ConfigRule {
+    return this.createConfigRule({
+      name: 'encrypted-volumes',
+      description: 'Checks whether EBS volumes are encrypted',
+      source: 'AWS_MANAGED',
+      identifier: 'ENCRYPTED_VOLUMES',
+      scope: {
+        complianceResourceTypes: ['AWS::EC2::Volume'],
+      },
+    })
+  }
+
+  /**
+   * Create IAM password policy rule
+   */
+  createIamPasswordPolicyRule(): ConfigRule {
+    return this.createConfigRule({
+      name: 'iam-password-policy',
+      description: 'Checks whether the IAM password policy meets specified requirements',
+      source: 'AWS_MANAGED',
+      identifier: 'IAM_PASSWORD_POLICY',
+      inputParameters: {
+        RequireUppercaseCharacters: true,
+        RequireLowercaseCharacters: true,
+        RequireSymbols: true,
+        RequireNumbers: true,
+        MinimumPasswordLength: 14,
+        PasswordReusePrevention: 24,
+        MaxPasswordAge: 90,
+      },
+    })
+  }
+
+  /**
+   * Create IAM MFA rule
+   */
+  createIamMfaRule(): ConfigRule {
+    return this.createConfigRule({
+      name: 'iam-user-mfa-enabled',
+      description: 'Checks whether IAM users have MFA enabled',
+      source: 'AWS_MANAGED',
+      identifier: 'IAM_USER_MFA_ENABLED',
+    })
+  }
+
+  /**
+   * Create IAM root account MFA rule
+   */
+  createRootAccountMfaRule(): ConfigRule {
+    return this.createConfigRule({
+      name: 'root-account-mfa-enabled',
+      description: 'Checks whether the root account has MFA enabled',
+      source: 'AWS_MANAGED',
+      identifier: 'ROOT_ACCOUNT_MFA_ENABLED',
+    })
+  }
+
+  /**
+   * Create VPC flow logs rule
+   */
+  createVpcFlowLogsRule(): ConfigRule {
+    return this.createConfigRule({
+      name: 'vpc-flow-logs-enabled',
+      description: 'Checks whether VPC Flow Logs is enabled',
+      source: 'AWS_MANAGED',
+      identifier: 'VPC_FLOW_LOGS_ENABLED',
+      scope: {
+        complianceResourceTypes: ['AWS::EC2::VPC'],
+      },
+    })
+  }
+
+  /**
+   * Create CloudTrail enabled rule
+   */
+  createCloudTrailEnabledRule(): ConfigRule {
+    return this.createConfigRule({
+      name: 'cloudtrail-enabled',
+      description: 'Checks whether CloudTrail is enabled',
+      source: 'AWS_MANAGED',
+      identifier: 'CLOUD_TRAIL_ENABLED',
+      maxExecutionFrequency: 'TwentyFour_Hours',
+    })
+  }
+
+  /**
+   * Create CloudWatch alarm rule
+   */
+  createCloudWatchAlarmRule(): ConfigRule {
+    return this.createConfigRule({
+      name: 'cloudwatch-alarm-action-check',
+      description: 'Checks whether CloudWatch alarms have actions configured',
+      source: 'AWS_MANAGED',
+      identifier: 'CLOUDWATCH_ALARM_ACTION_CHECK',
+      inputParameters: {
+        alarmActionRequired: true,
+        insufficientDataActionRequired: false,
+        okActionRequired: false,
+      },
+      scope: {
+        complianceResourceTypes: ['AWS::CloudWatch::Alarm'],
+      },
+    })
+  }
+
+  /**
+   * Create custom Lambda rule
+   */
+  createCustomLambdaRule(options: {
+    name: string
+    description: string
+    lambdaFunctionArn: string
+    resourceTypes?: string[]
+    maxExecutionFrequency?: ConfigRule['maxExecutionFrequency']
+    inputParameters?: Record<string, any>
+  }): ConfigRule {
+    return this.createConfigRule({
+      name: options.name,
+      description: options.description,
+      source: 'CUSTOM_LAMBDA',
+      lambdaFunctionArn: options.lambdaFunctionArn,
+      scope: options.resourceTypes
+        ? {
+            complianceResourceTypes: options.resourceTypes,
+          }
+        : undefined,
+      maxExecutionFrequency: options.maxExecutionFrequency,
+      inputParameters: options.inputParameters,
+    })
+  }
+
+  /**
+   * Create compliance preset rules
+   */
+  createCompliancePreset(preset: 'hipaa' | 'pci-dss' | 'sox' | 'gdpr' | 'basic'): ConfigRule[] {
+    const rules: ConfigRule[] = []
+
+    switch (preset) {
+      case 'hipaa':
+        rules.push(
+          this.createS3EncryptionRule(),
+          this.createRdsEncryptionRule(),
+          this.createEbsEncryptionRule(),
+          this.createCloudTrailEnabledRule(),
+          this.createIamPasswordPolicyRule(),
+          this.createRdsBackupRule(7),
+          this.createVpcFlowLogsRule(),
+        )
+        break
+
+      case 'pci-dss':
+        rules.push(
+          this.createS3EncryptionRule(),
+          this.createS3PublicAccessBlockRule(),
+          this.createRdsEncryptionRule(),
+          this.createEbsEncryptionRule(),
+          this.createCloudTrailEnabledRule(),
+          this.createIamPasswordPolicyRule(),
+          this.createIamMfaRule(),
+          this.createRootAccountMfaRule(),
+          this.createVpcFlowLogsRule(),
+        )
+        break
+
+      case 'sox':
+        rules.push(
+          this.createS3VersioningRule(),
+          this.createCloudTrailEnabledRule(),
+          this.createRdsBackupRule(30),
+          this.createIamPasswordPolicyRule(),
+        )
+        break
+
+      case 'gdpr':
+        rules.push(
+          this.createS3EncryptionRule(),
+          this.createRdsEncryptionRule(),
+          this.createEbsEncryptionRule(),
+          this.createCloudTrailEnabledRule(),
+          this.createRdsSnapshotEncryptionRule(),
+        )
+        break
+
+      case 'basic':
+        rules.push(
+          this.createS3EncryptionRule(),
+          this.createS3PublicAccessBlockRule(),
+          this.createRdsEncryptionRule(),
+          this.createCloudTrailEnabledRule(),
+          this.createIamMfaRule(),
+          this.createRootAccountMfaRule(),
+        )
+        break
+    }
+
+    return rules
+  }
+
+  /**
+   * Get config rule
+   */
+  getConfigRule(id: string): ConfigRule | undefined {
+    return this.configRules.get(id)
+  }
+
+  /**
+   * List config rules
+   */
+  listConfigRules(): ConfigRule[] {
+    return Array.from(this.configRules.values())
+  }
+
+  /**
+   * Get config recorder
+   */
+  getConfigRecorder(name: string): ConfigRecorder | undefined {
+    return this.configRecorders.get(name)
+  }
+
+  /**
+   * List config recorders
+   */
+  listConfigRecorders(): ConfigRecorder[] {
+    return Array.from(this.configRecorders.values())
+  }
+
+  /**
+   * Get delivery channel
+   */
+  getDeliveryChannel(name: string): DeliveryChannel | undefined {
+    return this.deliveryChannels.get(name)
+  }
+
+  /**
+   * List delivery channels
+   */
+  listDeliveryChannels(): DeliveryChannel[] {
+    return Array.from(this.deliveryChannels.values())
+  }
+
+  /**
+   * Generate CloudFormation for config rule
+   */
+  generateConfigRuleCF(rule: ConfigRule): any {
+    const cfRule: any = {
+      Type: 'AWS::Config::ConfigRule',
+      Properties: {
+        ConfigRuleName: rule.name,
+        Description: rule.description,
+        Source: {
+          Owner: rule.source === 'AWS_MANAGED' ? 'AWS' : 'CUSTOM_LAMBDA',
+        },
+      },
+    }
+
+    if (rule.source === 'AWS_MANAGED' && rule.identifier) {
+      cfRule.Properties.Source.SourceIdentifier = rule.identifier
+    }
+
+    if (rule.source === 'CUSTOM_LAMBDA' && rule.lambdaFunctionArn) {
+      cfRule.Properties.Source.SourceIdentifier = rule.lambdaFunctionArn
+      cfRule.Properties.Source.SourceDetails = [
+        {
+          EventSource: 'aws.config',
+          MessageType: 'ConfigurationItemChangeNotification',
+        },
+      ]
+    }
+
+    if (rule.inputParameters) {
+      cfRule.Properties.InputParameters = JSON.stringify(rule.inputParameters)
+    }
+
+    if (rule.scope) {
+      cfRule.Properties.Scope = {}
+
+      if (rule.scope.complianceResourceTypes) {
+        cfRule.Properties.Scope.ComplianceResourceTypes = rule.scope.complianceResourceTypes
+      }
+
+      if (rule.scope.tagKey) {
+        cfRule.Properties.Scope.TagKey = rule.scope.tagKey
+      }
+
+      if (rule.scope.tagValue) {
+        cfRule.Properties.Scope.TagValue = rule.scope.tagValue
+      }
+    }
+
+    if (rule.maxExecutionFrequency) {
+      cfRule.Properties.MaximumExecutionFrequency = rule.maxExecutionFrequency
+    }
+
+    return cfRule
+  }
+
+  /**
+   * Generate CloudFormation for config recorder
+   */
+  generateConfigRecorderCF(recorder: ConfigRecorder): any {
+    return {
+      Type: 'AWS::Config::ConfigurationRecorder',
+      Properties: {
+        Name: recorder.name,
+        RoleArn: recorder.roleArn,
+        RecordingGroup: recorder.recordingGroup || {
+          AllSupported: true,
+          IncludeGlobalResourceTypes: true,
+        },
+      },
+    }
+  }
+
+  /**
+   * Generate CloudFormation for delivery channel
+   */
+  generateDeliveryChannelCF(channel: DeliveryChannel): any {
+    return {
+      Type: 'AWS::Config::DeliveryChannel',
+      Properties: {
+        Name: channel.name,
+        S3BucketName: channel.s3BucketName,
+        ...(channel.s3KeyPrefix && { S3KeyPrefix: channel.s3KeyPrefix }),
+        ...(channel.snsTopicArn && { SnsTopicARN: channel.snsTopicArn }),
+        ...(channel.configSnapshotDeliveryProperties && {
+          ConfigSnapshotDeliveryProperties: channel.configSnapshotDeliveryProperties,
+        }),
+      },
+    }
+  }
+
+  /**
+   * Clear all data
+   */
+  clear(): void {
+    this.configRules.clear()
+    this.configRecorders.clear()
+    this.deliveryChannels.clear()
+    this.ruleCounter = 0
+  }
+}
+
+/**
+ * Global AWS Config manager instance
+ */
+export const awsConfigManager: AWSConfigManager = new AWSConfigManager()