AWS Config Should Be Enabled

Documentation Index

Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt

Use this file to discover all available pages before exploring further.

​

More Info:

​

Risk Level

​

Address

​

Compliance Standards

​

Remediation

​

Using Console:

• Steps:
  1. Log in to the AWS Management Console.
  2. Navigate to the AWS Config service.
  3. Check if there are any Configuration Recorders configured.
  4. If there are no Configuration Recorders, create a new one by clicking on “Create Configuration Recorder” and follow the setup wizard.
  5. If there are Configuration Recorders:
     • Review each Configuration Recorder.
     • Ensure that the “Include global resources” option is enabled.
     • Edit the Configuration Recorder if necessary to enable global resource recording.

​

Using CLI:

• Commands:
  aws configservice put-configuration-recorder --configuration-recorder name=default --recording-group allSupported=true
  
• Steps:
  1. Use the above CLI command to update the Configuration Recorder to include global resource recording.
  2. Replace name=default with the name of your Configuration Recorder.

​

Using Python

• Logic:
  import boto3
  
  def enable_global_resource_recording():
      try:
          config = boto3.client('config')
  
          # Check if Configuration Recorders exist
          recorders = config.describe_configuration_recorders()['ConfigurationRecorders']
          if not recorders:
              # Create a new Configuration Recorder
              config.put_configuration_recorder(ConfigurationRecorder={
                  'name': 'default',
                  'recordingGroup': {'allSupported': True}
              })
              print("Configuration Recorder created with global resource recording enabled.")
          else:
              for recorder in recorders:
                  if not recorder.get('recordingGroup', {}).get('allSupported', False):
                      # Update existing Configuration Recorder to enable global resource recording
                      config.put_configuration_recorder(ConfigurationRecorder={
                          'name': recorder['name'],
                          'recordingGroup': {'allSupported': True}
                      })
                      print(f"Global resource recording enabled for Configuration Recorder: {recorder['name']}")
                      break
              else:
                  print("Global resource recording is already enabled for all Configuration Recorders.")
  
      except Exception as e:
          print(f"Error: {e}")
  
  # Execute remediation
  enable_global_resource_recording()
  

​

Additional Reading:

• [https://docs.aws.amazon.com/config/latest/developerguide/gs-console.html]