AWS Config Should Be Enabled - Cloud Security

More Info:

Ensure that AWS Config service is enabled in all regions in order to have complete visibility over your AWS infrastructure configuration changes.

Risk Level

High

Address

Security

Compliance Standards

CBP

Remediation

Using Console:

Steps:
1. Log in to the AWS Management Console.
2. Navigate to the AWS Config service.
3. Check if there are any Configuration Recorders configured.
4. If there are no Configuration Recorders, create a new one by clicking on "Create Configuration Recorder" and follow the setup wizard.
5. If there are Configuration Recorders:
  - Review each Configuration Recorder.
  - Ensure that the "Include global resources" option is enabled.
  - Edit the Configuration Recorder if necessary to enable global resource recording.

Using CLI:

Commands:

aws configservice put-configuration-recorder --configuration-recorder name=default --recording-group allSupported=true

Steps:
1. Use the above CLI command to update the Configuration Recorder to include global resource recording.
2. Replace name=default with the name of your Configuration Recorder.

Using Python

Logic:

import boto3

def enable_global_resource_recording():
    try:
        config = boto3.client('config')

        # Check if Configuration Recorders exist
        recorders = config.describe_configuration_recorders()['ConfigurationRecorders']
        if not recorders:
            # Create a new Configuration Recorder
            config.put_configuration_recorder(ConfigurationRecorder={
                'name': 'default',
                'recordingGroup': {'allSupported': True}
            })
            print("Configuration Recorder created with global resource recording enabled.")
        else:
            for recorder in recorders:
                if not recorder.get('recordingGroup', {}).get('allSupported', False):
                    # Update existing Configuration Recorder to enable global resource recording
                    config.put_configuration_recorder(ConfigurationRecorder={
                        'name': recorder['name'],
                        'recordingGroup': {'allSupported': True}
                    })
                    print(f"Global resource recording enabled for Configuration Recorder: {recorder['name']}")
                    break
            else:
                print("Global resource recording is already enabled for all Configuration Recorders.")

    except Exception as e:
        print(f"Error: {e}")

# Execute remediation
enable_global_resource_recording()

Ensure that you have the necessary permissions to update AWS Config settings using the AWS CLI or Python script. Also, review and test the changes before applying them to production environments.

Triage and Remediation

Remediation

Remediation

Using Console

Below are the exact console steps to enable AWS Config so it records Route 53 resources (which are global):

Sign in and pick the right Region
- Sign in to the AWS Management Console.
- In the top-right, choose Region US East (N. Virginia) – us-east-1.
  Route 53 is a global service; AWS Config records it only from this Region.
Open AWS Config
- In the search bar, type “Config” and open AWS Config.
Start the setup
- If AWS Config is not yet configured in this account/Region, you’ll see a welcome/setup page.
- Click Get started or Set up AWS Config.
Select resource types to record
- Under Resource types to record:
  - Choose Record all resources supported in this region
    or
  - Choose Include specific types of resources and then select the Route 53 types you want, for example:
    - AWS::Route53::HostedZone
    - AWS::Route53::HealthCheck
- Very important: Check “Include global resources (e.g., AWS IAM resources)”.
  This flag is required for AWS Config to record global services like Route 53.
Set up the delivery destination (S3 bucket)
- Under Amazon S3 bucket:
  - Either choose Create a bucket (recommended: unique name like aws-config-logs-ACCOUNTID-REGION)
    or
  - Select an existing bucket.
- Optionally specify a prefix (e.g., aws-config/).
(Optional) Configure SNS notifications
- Under Amazon SNS topic:
  - Either leave it empty,
    or select Use an existing SNS topic or Create a topic if you want notifications for configuration changes/Compliance state changes.
IAM role for AWS Config
- Let AWS Config create a role for you:
  - Select Create a service-linked role or Create a role (depending on the UI).
- Accept the default permissions it suggests for recording and delivering configuration snapshots.
Review and confirm
- Review all settings:
  - Resource recording includes global resources
  - S3 bucket is correctly set
  - IAM role is configured
- Click Confirm / Save / Enable AWS Config (label may vary slightly).
Verify Route 53 is being recorded
- In AWS Config console, go to Resources.
- Filter by Resource type and look for:
  - AWS::Route53::HostedZone
  - AWS::Route53::HealthCheck
- You should see your existing hosted zones/health checks listed after a short delay.

This enables AWS Config and ensures that Route 53 (a global service) is included and continuously recorded via the console.

Using CLI

To “enable AWS Config for Route 53” you must:

Turn on an AWS Config configuration recorder that:
- Records the Route 53 resource type(s), or
- Records all supported resource types and includes global resources.
Configure a delivery channel (S3 bucket, optionally SNS).

Below is a minimal, CLI‑only remediation (region example: us-east-1).

0. Prereqs

You have an S3 bucket for Config logs, e.g. my-config-logs-bucket.
Your IAM role for AWS Config exists, e.g. arn:aws:iam::123456789012:role/aws-config-role.
Use a region that supports Route 53 global resource recording (e.g. us-east-1).

1. Create / update the Configuration Recorder

To record all resources including Route 53 (recommended):

aws configservice put-configuration-recorder \
  --configuration-recorder "name=default,roleARN=arn:aws:iam::123456789012:role/aws-config-role,recordingGroup={allSupported=true,includeGlobalResourceTypes=true}"
  --region us-east-1

To record only Route 53 hosted zones:

aws configservice put-configuration-recorder \
  --configuration-recorder "name=default,roleARN=arn:aws:iam::123456789012:role/aws-config-role,recordingGroup={allSupported=false,includeGlobalResourceTypes=true,resourceTypes=[\"AWS::Route53::HostedZone\"]}"
  --region us-east-1

Note: includeGlobalResourceTypes=true is required for Route 53 because it is a global service.

2. Create / update the Delivery Channel

aws configservice put-delivery-channel \
  --delivery-channel "name=default,s3BucketName=my-config-logs-bucket" \
  --region us-east-1

(Optionally add SNS: ,snsTopicARN=arn:aws:sns:us-east-1:123456789012:aws-config-topic.)

3. Start the Configuration Recorder

aws configservice start-configuration-recorder \
  --configuration-recorder-name default \
  --region us-east-1

4. Verify that Config is recording Route 53

aws configservice describe-configuration-recorders --region us-east-1
aws configservice describe-configuration-recorder-status --region us-east-1

Ensure:

recording is true
includeGlobalResourceTypes is true
AWS::Route53::HostedZone (or allSupported=true) is in the recording group.

Using Python

To “enable AWS Config for Route 53” you need to:

Turn on AWS Config in the target region.
Configure a recorder that includes Route 53 resource types.
Configure a delivery channel (S3 bucket, optionally SNS).
Start the configuration recorder.

Below is a step‑by‑step guide and sample Python (boto3) code.

1. Prerequisites

Python 3.x
boto3 installed:
```
pip install boto3
```
An S3 bucket for AWS Config (e.g., my-config-logs-bucket).
An IAM role for AWS Config (or let the console create it and re-use it).
Typical role name: AWSServiceRoleForConfig.

If you don’t have the role, you can:

Use the console once to enable Config (it creates the role), or
Create an IAM role with trusted entity config.amazonaws.com and attach AWS-managed policy AWSConfigRole (plus S3 permissions for your bucket).

2. Know the Route 53 AWS Config resource types

For Route 53, relevant resource types include, for example:

AWS::Route53::HostedZone
AWS::Route53::HealthCheck
AWS::Route53Resolver::ResolverEndpoint
AWS::Route53Resolver::ResolverRule
AWS::Route53Resolver::ResolverRuleAssociation
AWS::Route53Resolver::ResolverQueryLoggingConfig
AWS::Route53Resolver::ResolverQueryLoggingConfigAssociation
(or you can simply record allSupported resources)

3. Python code to enable AWS Config (with Route 53)

This example:

Uses region us-east-1 (change as needed)
Uses S3 bucket my-config-logs-bucket (change as needed)
Creates/updates:
- Configuration recorder
- Delivery channel
Enables recording of all supported resources (which includes Route 53).
If you want only Route 53, see the variant below.

import boto3
from botocore.exceptions import ClientError

REGION = "us-east-1"
S3_BUCKET = "my-config-logs-bucket"
CONFIG_ROLE_ARN = "arn:aws:iam::123456789012:role/AWSServiceRoleForConfig"  # change this

config = boto3.client("config", region_name=REGION)

def ensure_config_recorder():
    try:
        # Create or update the configuration recorder
        config.put_configuration_recorder(
            ConfigurationRecorder={
                "name": "default",
                "roleARN": CONFIG_ROLE_ARN,
                "recordingGroup": {
                    # Record all supported resource types (includes Route 53)
                    "allSupported": True,
                    "includeGlobalResourceTypes": True
                }
            }
        )
        print("Configuration recorder created/updated.")
    except ClientError as e:
        print(f"Error creating configuration recorder: {e}")
        raise

def ensure_delivery_channel():
    try:
        # Create or update the delivery channel
        config.put_delivery_channel(
            DeliveryChannel={
                "name": "default",
                "s3BucketName": S3_BUCKET,
                # Optionally specify S3 key prefix, SNS topic, etc.
                # "s3KeyPrefix": "aws-config",
                # "snsTopicARN": "arn:aws:sns:REGION:ACCOUNT_ID:MyConfigTopic"
            }
        )
        print("Delivery channel created/updated.")
    except ClientError as e:
        print(f"Error creating delivery channel: {e}")
        raise

def start_recorder():
    try:
        config.start_configuration_recorder(
            ConfigurationRecorderName="default"
        )
        print("Configuration recorder started.")
    except ClientError as e:
        print(f"Error starting configuration recorder: {e}")
        raise

if __name__ == "__main__":
    ensure_config_recorder()
    ensure_delivery_channel()
    start_recorder()

This will enable AWS Config in us-east-1 and start recording all supported resources, including Route 53.

4. Variant: Record only Route 53 resource types

If you want to record only Route 53 resources instead of all resources:

ROUTE53_RESOURCE_TYPES = [
    "AWS::Route53::HostedZone",
    "AWS::Route53::HealthCheck",
    "AWS::Route53Resolver::ResolverEndpoint",
    "AWS::Route53Resolver::ResolverRule",
    "AWS::Route53Resolver::ResolverRuleAssociation",
    "AWS::Route53Resolver::ResolverQueryLoggingConfig",
    "AWS::Route53Resolver::ResolverQueryLoggingConfigAssociation"
]

config.put_configuration_recorder(
    ConfigurationRecorder={
        "name": "default",
        "roleARN": CONFIG_ROLE_ARN,
        "recordingGroup": {
            "allSupported": False,
            "includeGlobalResourceTypes": True,
            "resourceTypes": ROUTE53_RESOURCE_TYPES
        }
    }
)

Keep the delivery channel and start_configuration_recorder code the same.

5. Verification

After running the script:

In the AWS console, go to AWS Config → Settings in the target region.
Confirm:
- Configuration recorder is ON.
- Resource types include Route 53 (or “All resources”).
- S3 bucket is configured.
Check S3 bucket for configuration history snapshots and configuration items over time.

Using Terraform

resource "aws_s3_bucket" "config_delivery" {
  bucket = "AWS_CONFIG_BUCKET_NAME" # replace with a globally-unique bucket name
}

resource "aws_s3_bucket_ownership_controls" "config_delivery" {
  bucket = aws_s3_bucket.config_delivery.id

  rule {
    object_ownership = "BucketOwnerPreferred"
  }
}

resource "aws_s3_bucket_public_access_block" "config_delivery" {
  bucket = aws_s3_bucket.config_delivery.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_config_configuration_recorder" "main" {
  name     = "AWS_CONFIG_RECORDER_NAME" # replace with your desired recorder name
  role_arn = "AWS_CONFIG_SERVICE_ROLE_ARN" # replace with an IAM role ARN allowing AWS Config to record and write to S3

  recording_group {
    all_supported              = false
    include_global_resource_types = true

    resource_types = [
      "AWS::Route53::HostedZone",
      # add any other resource types you want recorded
    ]
  }
}

resource "aws_config_delivery_channel" "main" {
  name           = "AWS_CONFIG_DELIVERY_CHANNEL_NAME" # replace with your desired channel name
  s3_bucket_name = aws_s3_bucket.config_delivery.bucket

  snapshot_delivery_properties {
    delivery_frequency = "TwentyFour_Hours"
  }

  depends_on = [aws_config_configuration_recorder.main]
}

resource "aws_config_configuration_recorder_status" "main" {
  name       = aws_config_configuration_recorder.main.name
  is_enabled = true

  depends_on = [aws_config_delivery_channel.main]
}

This creates and enables AWS Config to record Route53 hosted zones; it does not replace existing Route53 resources, but it will create new AWS Config resources and an S3 bucket.

For verification, terraform plan should show the creation of aws_config_configuration_recorder.main, aws_config_delivery_channel.main, aws_config_configuration_recorder_status.main, the S3 bucket, and related S3 controls, with no Route53 resources being replaced.

Additional Reading:

[https://docs.aws.amazon.com/config/latest/developerguide/gs-console.html]

More Info:​

Risk Level​

Address​

Compliance Standards​

Remediation​

Using Console:​

Using CLI:​

Using Python​

Triage and Remediation​

Remediation​

0. Prereqs​

1. Create / update the Configuration Recorder​

2. Create / update the Delivery Channel​

3. Start the Configuration Recorder​

4. Verify that Config is recording Route 53​

1. Prerequisites​

2. Know the Route 53 AWS Config resource types​

3. Python code to enable AWS Config (with Route 53)​

4. Variant: Record only Route 53 resource types​

5. Verification​

Additional Reading:​

More Info:

Risk Level

Address

Compliance Standards

Remediation

Using Console:

Using CLI:

Using Python

Triage and Remediation

Remediation

0. Prereqs

1. Create / update the Configuration Recorder

2. Create / update the Delivery Channel

3. Start the Configuration Recorder

4. Verify that Config is recording Route 53

1. Prerequisites

2. Know the Route 53 AWS Config resource types

3. Python code to enable AWS Config (with Route 53)

4. Variant: Record only Route 53 resource types

5. Verification

Additional Reading: