Module validate 

AWS Config data-plane logic: cross-service configuration recording, managed rule evaluation, and the SelectResourceConfig query subset.

Recording reaches into the live state of other FakeCloud services (S3, EC2, IAM) and synthesizes genuine ConfigurationItems from what actually exists, rather than fabricating placeholder resources. Rule evaluation runs real checks against those recorded items and produces true COMPLIANT / NON_COMPLIANT results.

Structs

CrossServiceStates

Handles to the other services’ state that AWS Config records from. All optional so the service degrades gracefully in a minimal deployment (and in unit tests) — a resource type whose backing service is absent simply records nothing rather than panicking.

DiscoveredResource

A single discovered resource, before it is turned into a full ConfigurationItem.

RuleOutcome

The compliance verdict Config reports for a resource under a rule.

Constants

SUPPORTED_RESOURCE_TYPES

AWS resource types Config records natively in this implementation.

Functions

apply_recorded_items

Fold discovered cross-service resources into the account’s recorded configuration-item history. A new item is appended only when a resource is new or its configuration changed since the last recorded item, so history grows exactly like real Config (one item per configuration state). Externally recorded items (PutResourceConfig) are never delete-marked here.

discover_all

Discover every supported resource that currently exists across the wired services for account_id.

evaluate_managed_rule

Evaluate one config rule against the recorded configuration items. Returns per-resource outcomes for the resource types the rule applies to. For AWS managed rules that are not implemented here, returns a single INSUFFICIENT_DATA outcome rather than falsely reporting COMPLIANT.

evaluate_proactive

Proactively evaluate a single supplied resource configuration against the account’s AWS-managed rules, without recording it into history. Used by StartResourceEvaluation so a proactive/detective evaluation reports the real compliance of the supplied config rather than a canned COMPLIANT.

outcome_to_result

Turn a RuleOutcome into a persisted [EvaluationResult].

run_select

Evaluate a Config advanced-query SELECT expression against recorded items.

s3_bucket_exists

Whether an S3 bucket with bucket_name exists in the wired S3 service. Returns None when S3 is not wired (validation is then skipped so the service degrades gracefully in minimal deployments and unit tests). S3 bucket names are globally unique, so every account is searched.

sync_would_change

Read-only check: would folding discovered into account’s recorded history change anything? Lets the caller skip taking a write lock (and the full re-record) on a pure read when nothing has changed since last sync.