Description

Ensure that AWS Config has a configuration recorder in every region, that the recorder is turned on (recording), and that its last recording status is not a failure. AWS Config records the configuration of supported resources and keeps a history of their changes.

Rationale

Regions without an active AWS Config recorder are blind spots: configuration changes made there are not captured, which weakens change tracking, auditing and compliance evaluation. An attacker can change resources or create new ones in an unmonitored region without a configuration history. Enabling AWS Config with continuous recording in every region, and keeping the recorder healthy, ensures that all resource changes can be reviewed and investigated.

Impact

  • Provides a configuration history and change tracking for resources in every region

  • Enables AWS Config rules and conformance packs for continuous compliance evaluation

  • AWS Config charges apply for each configuration item recorded and each rule evaluation

  • Configuration snapshots and history files are delivered to an S3 bucket, which adds storage costs

Default Value

AWS Config is not enabled by default. No configuration recorder exists in any region until AWS Config is set up.

Pre-Requisites

  • IAM permissions: config:DescribeConfigurationRecorders, config:DescribeConfigurationRecorderStatus, config:PutConfigurationRecorder, config:PutDeliveryChannel, config:StartConfigurationRecorder and iam:CreateServiceLinkedRole

  • An S3 bucket to receive configuration snapshots and history (the console can create it during setup)

  • A decision on which resource types to record

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Config console and select Settings in the left menu.

  3. Check that the recorder is turned on (recording) and that its status does not show a failure. If the console shows the Set up AWS Config page instead, no recorder exists in the region.

  4. Repeat for each region.

  5. If any region has no recorder, a recorder that is not recording, or a recorder in failure state, follow the implementation steps.

CLI:

Show the recorder status in a region:

aws configservice describe-configuration-recorder-status --region <REGION> --query "ConfigurationRecordersStatus[].[name,recording,lastStatus,lastErrorCode]" --output table

A region fails if the command returns no recorder, if recording is False, or if lastStatus is Failure.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Config console in the affected region.

  3. If AWS Config is not set up, choose Set up AWS Config (or Get started):

    • select a resource recording option,

    • choose an existing S3 bucket or create a new one for delivery,

    • keep the default AWS Config service-linked role,

    • choose Confirm to start recording.

  4. If a recorder exists but is not recording, open Settings and turn recording on.

  5. If the recorder is in failure state, review the error shown on the Settings page (for example missing permissions on the S3 bucket or the IAM role) and correct it.

  6. Check on the Settings page that the recorder is recording and shows no failure.

  7. Repeat for each affected region.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Config console in the region and select Settings.

  3. Turn recording off.

CLI:

aws configservice stop-configuration-recorder --configuration-recorder-name <RECORDER_NAME> --region <REGION>

Note: while recording is off, configuration changes in that region are not recorded and AWS Config rules are not evaluated against new changes.

Reference