{
  "Resources": {
    "AWSConfigRule": {
      "Type": "AWS::Config::ConfigRule",
      "Properties": {
        "ConfigRuleName": {
          "Ref": "ConfigRuleName"
        },
        "Description": "Checks whether the Amazon Relational Database Service (RDS) instances are not publicly accessible.  The rule is non-compliant if the publiclyAccessible field is true in the instance configuration item.", 
        "InputParameters": {},
        "Scope": {
          "ComplianceResourceTypes": ["AWS::RDS::DBInstance"]
        },
        "Source": {
          "Owner": "AWS",
          "SourceIdentifier": "RDS_INSTANCE_PUBLIC_ACCESS_CHECK"
        }
      }
    }
  },
  "Parameters": {
    "ConfigRuleName": {
      "Type": "String",
      "Default": "rds-instance-public-access-check",
      "Description": "The name that you assign to the AWS Config rule.", 
      "MinLength": "1",
      "ConstraintDescription": "This parameter is required." 
    }
  },
  "Metadata": {
    "AWS::CloudFormation::Interface": {
      "ParameterGroups": [
        {
          "Label": {
            "default": "Required"
          },
          "Parameters": []
        },
        {
          "Label": {
            "default": "Optional"
          },
          "Parameters": []
        }
      ]
    }
  },
  "Conditions": {}
}
