aws-cdk-lib 2.200.2__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/aws_config/__init__.py

@@ -345,12 +345,34 @@ from ..aws_events import (
     OnEventOptions as _OnEventOptions_8711b8b3,
     Rule as _Rule_334ed2b5,
 )
-from ..aws_iam import IRole as _IRole_235f5d8e
 from ..aws_lambda import IFunction as _IFunction_6adb0ab8
 from ..aws_sns import ITopic as _ITopic_9eca4852
+from ..interfaces.aws_config import (
+    AggregationAuthorizationReference as _AggregationAuthorizationReference_7b5e35c2,
+    ConfigRuleReference as _ConfigRuleReference_f33c4531,
+    ConfigurationAggregatorReference as _ConfigurationAggregatorReference_06645f26,
+    ConfigurationRecorderReference as _ConfigurationRecorderReference_192b42ee,
+    ConformancePackReference as _ConformancePackReference_b73482ec,
+    DeliveryChannelReference as _DeliveryChannelReference_e7d3a59b,
+    IAggregationAuthorizationRef as _IAggregationAuthorizationRef_769e70e0,
+    IConfigRuleRef as _IConfigRuleRef_d9037ddf,
+    IConfigurationAggregatorRef as _IConfigurationAggregatorRef_c6214f1c,
+    IConfigurationRecorderRef as _IConfigurationRecorderRef_d38667e9,
+    IConformancePackRef as _IConformancePackRef_2b10514c,
+    IDeliveryChannelRef as _IDeliveryChannelRef_db6e43b7,
+    IOrganizationConfigRuleRef as _IOrganizationConfigRuleRef_657a40fe,
+    IOrganizationConformancePackRef as _IOrganizationConformancePackRef_05eed40c,
+    IRemediationConfigurationRef as _IRemediationConfigurationRef_520713b3,
+    IStoredQueryRef as _IStoredQueryRef_6ddd80b7,
+    OrganizationConfigRuleReference as _OrganizationConfigRuleReference_30ef913a,
+    OrganizationConformancePackReference as _OrganizationConformancePackReference_add452aa,
+    RemediationConfigurationReference as _RemediationConfigurationReference_ac50dda2,
+    StoredQueryReference as _StoredQueryReference_385d82e9,
+)
+from ..interfaces.aws_iam import IRoleRef as _IRoleRef_8400221f
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IAggregationAuthorizationRef_769e70e0, _ITaggable_36806126)
 class CfnAggregationAuthorization(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -389,7 +411,8 @@ class CfnAggregationAuthorization(
         authorized_aws_region: builtins.str,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Config::AggregationAuthorization``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param authorized_account_id: The 12-digit account ID of the account authorized to aggregate data.
@@ -438,6 +461,14 @@ class CfnAggregationAuthorization(
         '''The CloudFormation resource type name for this resource class.'''
         return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))
 
+    @builtins.property
+    @jsii.member(jsii_name="aggregationAuthorizationRef")
+    def aggregation_authorization_ref(
+        self,
+    ) -> _AggregationAuthorizationReference_7b5e35c2:
+        '''A reference to a AggregationAuthorization resource.'''
+        return typing.cast(_AggregationAuthorizationReference_7b5e35c2, jsii.get(self, "aggregationAuthorizationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="attrAggregationAuthorizationArn")
     def attr_aggregation_authorization_arn(self) -> builtins.str:
@@ -594,7 +625,7 @@ class CfnAggregationAuthorizationProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IConfigRuleRef_d9037ddf)
 class CfnConfigRule(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -688,7 +719,8 @@ class CfnConfigRule(
         maximum_execution_frequency: typing.Optional[builtins.str] = None,
         scope: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnConfigRule.ScopeProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Config::ConfigRule``.
+
         :param scope_: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param source: Provides the rule owner ( ``AWS`` for managed rules, ``CUSTOM_POLICY`` for Custom Policy rules, and ``CUSTOM_LAMBDA`` for Custom Lambda rules), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.
@@ -779,6 +811,12 @@ class CfnConfigRule(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="configRuleRef")
+    def config_rule_ref(self) -> _ConfigRuleReference_f33c4531:
+        '''A reference to a ConfigRule resource.'''
+        return typing.cast(_ConfigRuleReference_f33c4531, jsii.get(self, "configRuleRef"))
+
     @builtins.property
     @jsii.member(jsii_name="source")
     def source(
@@ -1700,7 +1738,7 @@ class CfnConfigRuleProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IConfigurationAggregatorRef_c6214f1c, _ITaggable_36806126)
 class CfnConfigurationAggregator(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1751,7 +1789,8 @@ class CfnConfigurationAggregator(
         organization_aggregation_source: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnConfigurationAggregator.OrganizationAggregationSourceProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Config::ConfigurationAggregator``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param account_aggregation_sources: Provides a list of source accounts and regions to be aggregated.
@@ -1816,6 +1855,14 @@ class CfnConfigurationAggregator(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="configurationAggregatorRef")
+    def configuration_aggregator_ref(
+        self,
+    ) -> _ConfigurationAggregatorReference_06645f26:
+        '''A reference to a ConfigurationAggregator resource.'''
+        return typing.cast(_ConfigurationAggregatorReference_06645f26, jsii.get(self, "configurationAggregatorRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -2201,7 +2248,7 @@ class CfnConfigurationAggregatorProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IConfigurationRecorderRef_d38667e9)
 class CfnConfigurationRecorder(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2273,10 +2320,11 @@ class CfnConfigurationRecorder(
         recording_group: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnConfigurationRecorder.RecordingGroupProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         recording_mode: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnConfigurationRecorder.RecordingModeProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Config::ConfigurationRecorder``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param role_arn: Amazon Resource Name (ARN) of the IAM role assumed by AWS Config and used by the configuration recorder. For more information, see `Permissions for the IAM Role Assigned <https://docs.aws.amazon.com/config/latest/developerguide/iamrole-permissions.html>`_ to AWS Config in the AWS Config Developer Guide. .. epigraph:: *Pre-existing AWS Config role* If you have used an AWS service that uses AWS Config , such as AWS Security Hub or AWS Control Tower , and an AWS Config role has already been created, make sure that the IAM role that you use when setting up AWS Config keeps the same minimum permissions as the already created AWS Config role. You must do this so that the other AWS service continues to run as expected. For example, if AWS Control Tower has an IAM role that allows AWS Config to read Amazon Simple Storage Service ( Amazon S3 ) objects, make sure that the same permissions are granted within the IAM role you use when setting up AWS Config . Otherwise, it may interfere with how AWS Control Tower operates. For more information about IAM roles for AWS Config , see `*Identity and Access Management for AWS Config* <https://docs.aws.amazon.com/config/latest/developerguide/security-iam.html>`_ in the *AWS Config Developer Guide* .
+        :param role_arn: Amazon Resource Name (ARN) of the IAM role assumed by AWS Config and used by the configuration recorder. For more information, see `Permissions for the IAM Role Assigned <https://docs.aws.amazon.com/config/latest/developerguide/iamrole-permissions.html>`_ to AWS Config in the AWS Config Developer Guide. .. epigraph:: *Pre-existing AWS Config role* If you have used an AWS service that uses AWS Config , such as Security Hub or AWS Control Tower , and an AWS Config role has already been created, make sure that the IAM role that you use when setting up AWS Config keeps the same minimum permissions as the already created AWS Config role. You must do this so that the other AWS service continues to run as expected. For example, if AWS Control Tower has an IAM role that allows AWS Config to read Amazon Simple Storage Service ( Amazon S3 ) objects, make sure that the same permissions are granted within the IAM role you use when setting up AWS Config . Otherwise, it may interfere with how AWS Control Tower operates. For more information about IAM roles for AWS Config , see `*Identity and Access Management for AWS Config* <https://docs.aws.amazon.com/config/latest/developerguide/security-iam.html>`_ in the *AWS Config Developer Guide* .
         :param name: The name of the configuration recorder. AWS Config automatically assigns the name of "default" when creating the configuration recorder. You cannot change the name of the configuration recorder after it has been created. To change the configuration recorder name, you must delete it and create a new configuration recorder with a new name.
         :param recording_group: Specifies which resource types AWS Config records for configuration changes. .. epigraph:: *High Number of AWS Config Evaluations* You may notice increased activity in your account during your initial month recording with AWS Config when compared to subsequent months. During the initial bootstrapping process, AWS Config runs evaluations on all the resources in your account that you have selected for AWS Config to record. If you are running ephemeral workloads, you may see increased activity from AWS Config as it records configuration changes associated with creating and deleting these temporary resources. An *ephemeral workload* is a temporary use of computing resources that are loaded and run when needed. Examples include Amazon Elastic Compute Cloud ( Amazon EC2 ) Spot Instances, Amazon EMR jobs, and AWS Auto Scaling . If you want to avoid the increased activity from running ephemeral workloads, you can run these types of workloads in a separate account with AWS Config turned off to avoid increased configuration recording and rule evaluations.
         :param recording_mode: Specifies the default recording frequency for the configuration recorder. AWS Config supports *Continuous recording* and *Daily recording* . - Continuous recording allows you to record configuration changes continuously whenever a change occurs. - Daily recording allows you to receive a configuration item (CI) representing the most recent state of your resources over the last 24-hour period, only if it’s different from the previous CI recorded. .. epigraph:: *Some resource types require continuous recording* AWS Firewall Manager depends on continuous recording to monitor your resources. If you are using Firewall Manager, it is recommended that you set the recording frequency to Continuous. You can also override the recording frequency for specific resource types.
@@ -2337,6 +2385,12 @@ class CfnConfigurationRecorder(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="configurationRecorderRef")
+    def configuration_recorder_ref(self) -> _ConfigurationRecorderReference_192b42ee:
+        '''A reference to a ConfigurationRecorder resource.'''
+        return typing.cast(_ConfigurationRecorderReference_192b42ee, jsii.get(self, "configurationRecorderRef"))
+
     @builtins.property
     @jsii.member(jsii_name="roleArn")
     def role_arn(self) -> builtins.str:
@@ -3044,7 +3098,7 @@ class CfnConfigurationRecorderProps:
     ) -> None:
         '''Properties for defining a ``CfnConfigurationRecorder``.
 
-        :param role_arn: Amazon Resource Name (ARN) of the IAM role assumed by AWS Config and used by the configuration recorder. For more information, see `Permissions for the IAM Role Assigned <https://docs.aws.amazon.com/config/latest/developerguide/iamrole-permissions.html>`_ to AWS Config in the AWS Config Developer Guide. .. epigraph:: *Pre-existing AWS Config role* If you have used an AWS service that uses AWS Config , such as AWS Security Hub or AWS Control Tower , and an AWS Config role has already been created, make sure that the IAM role that you use when setting up AWS Config keeps the same minimum permissions as the already created AWS Config role. You must do this so that the other AWS service continues to run as expected. For example, if AWS Control Tower has an IAM role that allows AWS Config to read Amazon Simple Storage Service ( Amazon S3 ) objects, make sure that the same permissions are granted within the IAM role you use when setting up AWS Config . Otherwise, it may interfere with how AWS Control Tower operates. For more information about IAM roles for AWS Config , see `*Identity and Access Management for AWS Config* <https://docs.aws.amazon.com/config/latest/developerguide/security-iam.html>`_ in the *AWS Config Developer Guide* .
+        :param role_arn: Amazon Resource Name (ARN) of the IAM role assumed by AWS Config and used by the configuration recorder. For more information, see `Permissions for the IAM Role Assigned <https://docs.aws.amazon.com/config/latest/developerguide/iamrole-permissions.html>`_ to AWS Config in the AWS Config Developer Guide. .. epigraph:: *Pre-existing AWS Config role* If you have used an AWS service that uses AWS Config , such as Security Hub or AWS Control Tower , and an AWS Config role has already been created, make sure that the IAM role that you use when setting up AWS Config keeps the same minimum permissions as the already created AWS Config role. You must do this so that the other AWS service continues to run as expected. For example, if AWS Control Tower has an IAM role that allows AWS Config to read Amazon Simple Storage Service ( Amazon S3 ) objects, make sure that the same permissions are granted within the IAM role you use when setting up AWS Config . Otherwise, it may interfere with how AWS Control Tower operates. For more information about IAM roles for AWS Config , see `*Identity and Access Management for AWS Config* <https://docs.aws.amazon.com/config/latest/developerguide/security-iam.html>`_ in the *AWS Config Developer Guide* .
         :param name: The name of the configuration recorder. AWS Config automatically assigns the name of "default" when creating the configuration recorder. You cannot change the name of the configuration recorder after it has been created. To change the configuration recorder name, you must delete it and create a new configuration recorder with a new name.
         :param recording_group: Specifies which resource types AWS Config records for configuration changes. .. epigraph:: *High Number of AWS Config Evaluations* You may notice increased activity in your account during your initial month recording with AWS Config when compared to subsequent months. During the initial bootstrapping process, AWS Config runs evaluations on all the resources in your account that you have selected for AWS Config to record. If you are running ephemeral workloads, you may see increased activity from AWS Config as it records configuration changes associated with creating and deleting these temporary resources. An *ephemeral workload* is a temporary use of computing resources that are loaded and run when needed. Examples include Amazon Elastic Compute Cloud ( Amazon EC2 ) Spot Instances, Amazon EMR jobs, and AWS Auto Scaling . If you want to avoid the increased activity from running ephemeral workloads, you can run these types of workloads in a separate account with AWS Config turned off to avoid increased configuration recording and rule evaluations.
         :param recording_mode: Specifies the default recording frequency for the configuration recorder. AWS Config supports *Continuous recording* and *Daily recording* . - Continuous recording allows you to record configuration changes continuously whenever a change occurs. - Daily recording allows you to receive a configuration item (CI) representing the most recent state of your resources over the last 24-hour period, only if it’s different from the previous CI recorded. .. epigraph:: *Some resource types require continuous recording* AWS Firewall Manager depends on continuous recording to monitor your resources. If you are using Firewall Manager, it is recommended that you set the recording frequency to Continuous. You can also override the recording frequency for specific resource types.
@@ -3113,7 +3167,7 @@ class CfnConfigurationRecorderProps:
 
            *Pre-existing AWS Config role*
 
-           If you have used an AWS service that uses AWS Config , such as AWS Security Hub or AWS Control Tower , and an AWS Config role has already been created, make sure that the IAM role that you use when setting up AWS Config keeps the same minimum permissions as the already created AWS Config role. You must do this so that the other AWS service continues to run as expected.
+           If you have used an AWS service that uses AWS Config , such as Security Hub or AWS Control Tower , and an AWS Config role has already been created, make sure that the IAM role that you use when setting up AWS Config keeps the same minimum permissions as the already created AWS Config role. You must do this so that the other AWS service continues to run as expected.
 
            For example, if AWS Control Tower has an IAM role that allows AWS Config to read Amazon Simple Storage Service ( Amazon S3 ) objects, make sure that the same permissions are granted within the IAM role you use when setting up AWS Config . Otherwise, it may interfere with how AWS Control Tower operates. For more information about IAM roles for AWS Config , see `*Identity and Access Management for AWS Config* <https://docs.aws.amazon.com/config/latest/developerguide/security-iam.html>`_ in the *AWS Config Developer Guide* .
 
@@ -3187,7 +3241,7 @@ class CfnConfigurationRecorderProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IConformancePackRef_2b10514c)
 class CfnConformancePack(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -3238,7 +3292,8 @@ class CfnConformancePack(
         template_s3_uri: typing.Optional[builtins.str] = None,
         template_ssm_document_details: typing.Any = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Config::ConformancePack``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param conformance_pack_name: Name of the conformance pack you want to create.
@@ -3300,6 +3355,12 @@ class CfnConformancePack(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="conformancePackRef")
+    def conformance_pack_ref(self) -> _ConformancePackReference_b73482ec:
+        '''A reference to a ConformancePack resource.'''
+        return typing.cast(_ConformancePackReference_b73482ec, jsii.get(self, "conformancePackRef"))
+
     @builtins.property
     @jsii.member(jsii_name="conformancePackName")
     def conformance_pack_name(self) -> builtins.str:
@@ -3731,7 +3792,7 @@ class CfnConformancePackProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IDeliveryChannelRef_db6e43b7)
 class CfnDeliveryChannel(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -3792,7 +3853,8 @@ class CfnDeliveryChannel(
         s3_kms_key_arn: typing.Optional[builtins.str] = None,
         sns_topic_arn: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Config::DeliveryChannel``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param s3_bucket_name: The name of the Amazon S3 bucket to which AWS Config delivers configuration snapshots and configuration history files. If you specify a bucket that belongs to another AWS account , that bucket must have policies that grant access permissions to AWS Config . For more information, see `Permissions for the Amazon S3 Bucket <https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-policy.html>`_ in the *AWS Config Developer Guide* .
@@ -3860,6 +3922,12 @@ class CfnDeliveryChannel(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="deliveryChannelRef")
+    def delivery_channel_ref(self) -> _DeliveryChannelReference_e7d3a59b:
+        '''A reference to a DeliveryChannel resource.'''
+        return typing.cast(_DeliveryChannelReference_e7d3a59b, jsii.get(self, "deliveryChannelRef"))
+
     @builtins.property
     @jsii.member(jsii_name="s3BucketName")
     def s3_bucket_name(self) -> builtins.str:
@@ -4174,7 +4242,7 @@ class CfnDeliveryChannelProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IOrganizationConfigRuleRef_657a40fe)
 class CfnOrganizationConfigRule(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -4267,7 +4335,8 @@ class CfnOrganizationConfigRule(
         organization_custom_rule_metadata: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnOrganizationConfigRule.OrganizationCustomRuleMetadataProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         organization_managed_rule_metadata: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnOrganizationConfigRule.OrganizationManagedRuleMetadataProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Config::OrganizationConfigRule``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param organization_config_rule_name: The name that you assign to organization AWS Config rule.
@@ -4290,6 +4359,27 @@ class CfnOrganizationConfigRule(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromOrganizationConfigRuleId")
+    @builtins.classmethod
+    def from_organization_config_rule_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        organization_config_rule_id: builtins.str,
+    ) -> _IOrganizationConfigRuleRef_657a40fe:
+        '''Creates a new IOrganizationConfigRuleRef from a organizationConfigRuleId.
+
+        :param scope: -
+        :param id: -
+        :param organization_config_rule_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__5ec8d3d53086fad35210fcf7f163fa99347478d20effebbfb9e9dc8ae996cc2c)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument organization_config_rule_id", value=organization_config_rule_id, expected_type=type_hints["organization_config_rule_id"])
+        return typing.cast(_IOrganizationConfigRuleRef_657a40fe, jsii.sinvoke(cls, "fromOrganizationConfigRuleId", [scope, id, organization_config_rule_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -4333,6 +4423,12 @@ class CfnOrganizationConfigRule(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="organizationConfigRuleRef")
+    def organization_config_rule_ref(self) -> _OrganizationConfigRuleReference_30ef913a:
+        '''A reference to a OrganizationConfigRule resource.'''
+        return typing.cast(_OrganizationConfigRuleReference_30ef913a, jsii.get(self, "organizationConfigRuleRef"))
+
     @builtins.property
     @jsii.member(jsii_name="organizationConfigRuleName")
     def organization_config_rule_name(self) -> builtins.str:
@@ -5218,7 +5314,7 @@ class CfnOrganizationConfigRuleProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IOrganizationConformancePackRef_05eed40c)
 class CfnOrganizationConformancePack(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -5267,7 +5363,8 @@ class CfnOrganizationConformancePack(
         template_body: typing.Optional[builtins.str] = None,
         template_s3_uri: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Config::OrganizationConformancePack``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param organization_conformance_pack_name: The name you assign to an organization conformance pack.
@@ -5329,6 +5426,14 @@ class CfnOrganizationConformancePack(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="organizationConformancePackRef")
+    def organization_conformance_pack_ref(
+        self,
+    ) -> _OrganizationConformancePackReference_add452aa:
+        '''A reference to a OrganizationConformancePack resource.'''
+        return typing.cast(_OrganizationConformancePackReference_add452aa, jsii.get(self, "organizationConformancePackRef"))
+
     @builtins.property
     @jsii.member(jsii_name="organizationConformancePackName")
     def organization_conformance_pack_name(self) -> builtins.str:
@@ -5679,7 +5784,7 @@ class CfnOrganizationConformancePackProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IRemediationConfigurationRef_520713b3)
 class CfnRemediationConfiguration(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -5736,7 +5841,8 @@ class CfnRemediationConfiguration(
         retry_attempt_seconds: typing.Optional[jsii.Number] = None,
         target_version: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Config::RemediationConfiguration``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param config_rule_name: The name of the AWS Config rule.
@@ -5769,6 +5875,27 @@ class CfnRemediationConfiguration(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromRemediationConfigurationId")
+    @builtins.classmethod
+    def from_remediation_configuration_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        remediation_configuration_id: builtins.str,
+    ) -> _IRemediationConfigurationRef_520713b3:
+        '''Creates a new IRemediationConfigurationRef from a remediationConfigurationId.
+
+        :param scope: -
+        :param id: -
+        :param remediation_configuration_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__d8ea5c20df565d1c985e68590e4f86ff5021fdfb98b248775d3388a5b00711aa)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument remediation_configuration_id", value=remediation_configuration_id, expected_type=type_hints["remediation_configuration_id"])
+        return typing.cast(_IRemediationConfigurationRef_520713b3, jsii.sinvoke(cls, "fromRemediationConfigurationId", [scope, id, remediation_configuration_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -5812,6 +5939,14 @@ class CfnRemediationConfiguration(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="remediationConfigurationRef")
+    def remediation_configuration_ref(
+        self,
+    ) -> _RemediationConfigurationReference_ac50dda2:
+        '''A reference to a RemediationConfiguration resource.'''
+        return typing.cast(_RemediationConfigurationReference_ac50dda2, jsii.get(self, "remediationConfigurationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="configRuleName")
     def config_rule_name(self) -> builtins.str:
@@ -6531,7 +6666,7 @@ class CfnRemediationConfigurationProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IStoredQueryRef_6ddd80b7, _ITaggable_36806126)
 class CfnStoredQuery(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -6572,7 +6707,8 @@ class CfnStoredQuery(
         query_description: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Config::StoredQuery``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param query_expression: The expression of the query. For example, ``SELECT resourceId, resourceType, supplementaryConfiguration.BucketVersioningConfiguration.status WHERE resourceType = 'AWS::S3::Bucket' AND supplementaryConfiguration.BucketVersioningConfiguration.status = 'Off'.``
@@ -6648,6 +6784,12 @@ class CfnStoredQuery(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="storedQueryRef")
+    def stored_query_ref(self) -> _StoredQueryReference_385d82e9:
+        '''A reference to a StoredQuery resource.'''
+        return typing.cast(_StoredQueryReference_385d82e9, jsii.get(self, "storedQueryRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -12984,7 +13126,7 @@ class CloudFormationStackDriftDetectionCheck(
         id: builtins.str,
         *,
         own_stack_only: typing.Optional[builtins.bool] = None,
-        role: typing.Optional[_IRole_235f5d8e] = None,
+        role: typing.Optional[_IRoleRef_8400221f] = None,
         config_rule_name: typing.Optional[builtins.str] = None,
         description: typing.Optional[builtins.str] = None,
         evaluation_modes: typing.Optional[EvaluationMode] = None,
@@ -13053,7 +13195,7 @@ class CloudFormationStackDriftDetectionCheckProps(RuleProps):
         maximum_execution_frequency: typing.Optional[MaximumExecutionFrequency] = None,
         rule_scope: typing.Optional[RuleScope] = None,
         own_stack_only: typing.Optional[builtins.bool] = None,
-        role: typing.Optional[_IRole_235f5d8e] = None,
+        role: typing.Optional[_IRoleRef_8400221f] = None,
     ) -> None:
         '''Construction properties for a CloudFormationStackDriftDetectionCheck.
 
@@ -13172,7 +13314,7 @@ class CloudFormationStackDriftDetectionCheckProps(RuleProps):
         return typing.cast(typing.Optional[builtins.bool], result)
 
     @builtins.property
-    def role(self) -> typing.Optional[_IRole_235f5d8e]:
+    def role(self) -> typing.Optional[_IRoleRef_8400221f]:
         '''The IAM role to use for this rule.
 
         It must have permissions to detect drift
@@ -13183,7 +13325,7 @@ class CloudFormationStackDriftDetectionCheckProps(RuleProps):
         :default: - A role will be created
         '''
         result = self._values.get("role")
-        return typing.cast(typing.Optional[_IRole_235f5d8e], result)
+        return typing.cast(typing.Optional[_IRoleRef_8400221f], result)
 
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
@@ -15124,6 +15266,14 @@ def _typecheckingstub__dbb132a46c30059a4907d7496d2b696999321fd7c5b82f7812c5a4d9b
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__5ec8d3d53086fad35210fcf7f163fa99347478d20effebbfb9e9dc8ae996cc2c(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    organization_config_rule_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__7e581ed53a72e9f3241819d7b60aee8c45b6d8882e96a3754518305e3004fbe5(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -15331,6 +15481,14 @@ def _typecheckingstub__7d77d8d51b1a809acec3ca2be829980e6b8f99140bb4eb3ce00b9209c
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__d8ea5c20df565d1c985e68590e4f86ff5021fdfb98b248775d3388a5b00711aa(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    remediation_configuration_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__74c36a39512198e1aaa76b683ab3d6faa2dedf6814529e3325ab9fdf03a47934(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -15705,7 +15863,7 @@ def _typecheckingstub__0a22b3986125c76fb9e9557349b6727e4d1c0b600ef5e07d36a6ef323
     id: builtins.str,
     *,
     own_stack_only: typing.Optional[builtins.bool] = None,
-    role: typing.Optional[_IRole_235f5d8e] = None,
+    role: typing.Optional[_IRoleRef_8400221f] = None,
     config_rule_name: typing.Optional[builtins.str] = None,
     description: typing.Optional[builtins.str] = None,
     evaluation_modes: typing.Optional[EvaluationMode] = None,
@@ -15725,7 +15883,7 @@ def _typecheckingstub__a6e3aa47b4b02ba66dc0d2476d22bede4156332edf92696248dc715d6
     maximum_execution_frequency: typing.Optional[MaximumExecutionFrequency] = None,
     rule_scope: typing.Optional[RuleScope] = None,
     own_stack_only: typing.Optional[builtins.bool] = None,
-    role: typing.Optional[_IRole_235f5d8e] = None,
+    role: typing.Optional[_IRoleRef_8400221f] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -15956,3 +16114,6 @@ def _typecheckingstub__feaff635e0230e65515841ea744975d751e424acf376b8ed530119931
 ) -> None:
     """Type checking stubs"""
     pass
+
+for cls in [IRule]:
+    typing.cast(typing.Any, cls).__protocol_attrs__ = typing.cast(typing.Any, cls).__protocol_attrs__ - set(['__jsii_proxy_class__', '__jsii_type__'])