> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Aws config enabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are the exact console steps to enable AWS Config so it records Route 53 resources (which are global):

        1. **Sign in and pick the right Region**
           * Sign in to the **AWS Management Console**.
           * In the top-right, choose Region **US East (N. Virginia) – `us-east-1`**.\
             Route 53 is a global service; AWS Config records it only from this Region.

        2. **Open AWS Config**
           * In the search bar, type **“Config”** and open **AWS Config**.

        3. **Start the setup**
           * If AWS Config is not yet configured in this account/Region, you’ll see a welcome/setup page.
           * Click **Get started** or **Set up AWS Config**.

        4. **Select resource types to record**
           * Under **Resource types to record**:
             * Choose **Record all resources supported in this region**\
               or
             * Choose **Include specific types of resources** and then select the Route 53 types you want, for example:
               * `AWS::Route53::HostedZone`
               * `AWS::Route53::HealthCheck`
           * Very important: **Check “Include global resources (e.g., AWS IAM resources)”**.\
             This flag is required for AWS Config to record global services like Route 53.

        5. **Set up the delivery destination (S3 bucket)**
           * Under **Amazon S3 bucket**:
             * Either choose **Create a bucket** (recommended: unique name like `aws-config-logs-ACCOUNTID-REGION`)\
               or
             * Select an existing bucket.
           * Optionally specify a prefix (e.g., `aws-config/`).

        6. **(Optional) Configure SNS notifications**
           * Under **Amazon SNS topic**:
             * Either leave it empty,\
               or select **Use an existing SNS topic** or **Create a topic** if you want notifications for configuration changes/Compliance state changes.

        7. **IAM role for AWS Config**
           * Let AWS Config create a role for you:
             * Select **Create a service-linked role** or **Create a role** (depending on the UI).
           * Accept the default permissions it suggests for recording and delivering configuration snapshots.

        8. **Review and confirm**
           * Review all settings:
             * Resource recording includes **global resources**
             * S3 bucket is correctly set
             * IAM role is configured
           * Click **Confirm** / **Save** / **Enable AWS Config** (label may vary slightly).

        9. **Verify Route 53 is being recorded**
           * In AWS Config console, go to **Resources**.
           * Filter by **Resource type** and look for:
             * `AWS::Route53::HostedZone`
             * `AWS::Route53::HealthCheck`
           * You should see your existing hosted zones/health checks listed after a short delay.

        This enables AWS Config and ensures that Route 53 (a global service) is included and continuously recorded via the console.
      </Accordion>

      <Accordion title="Using CLI">
        To “enable AWS Config for Route 53” you must:

        1. Turn on an AWS Config configuration recorder that:
           * Records the Route 53 resource type(s), or
           * Records all supported resource types and includes global resources.

        2. Configure a delivery channel (S3 bucket, optionally SNS).

        Below is a minimal, CLI‑only remediation (region example: `us-east-1`).

        ***

        ### 0. Prereqs

        * You have an S3 bucket for Config logs, e.g. `my-config-logs-bucket`.
        * Your IAM role for AWS Config exists, e.g. `arn:aws:iam::123456789012:role/aws-config-role`.
        * Use a region that supports Route 53 global resource recording (e.g. `us-east-1`).

        ***

        ### 1. Create / update the Configuration Recorder

        To record **all resources including Route 53 (recommended)**:

        ```bash theme={null}
        aws configservice put-configuration-recorder \
          --configuration-recorder "name=default,roleARN=arn:aws:iam::123456789012:role/aws-config-role,recordingGroup={allSupported=true,includeGlobalResourceTypes=true}"
          --region us-east-1
        ```

        To record **only Route 53 hosted zones**:

        ```bash theme={null}
        aws configservice put-configuration-recorder \
          --configuration-recorder "name=default,roleARN=arn:aws:iam::123456789012:role/aws-config-role,recordingGroup={allSupported=false,includeGlobalResourceTypes=true,resourceTypes=[\"AWS::Route53::HostedZone\"]}"
          --region us-east-1
        ```

        > Note: `includeGlobalResourceTypes=true` is required for Route 53 because it is a global service.

        ***

        ### 2. Create / update the Delivery Channel

        ```bash theme={null}
        aws configservice put-delivery-channel \
          --delivery-channel "name=default,s3BucketName=my-config-logs-bucket" \
          --region us-east-1
        ```

        (Optionally add SNS: `,snsTopicARN=arn:aws:sns:us-east-1:123456789012:aws-config-topic`.)

        ***

        ### 3. Start the Configuration Recorder

        ```bash theme={null}
        aws configservice start-configuration-recorder \
          --configuration-recorder-name default \
          --region us-east-1
        ```

        ***

        ### 4. Verify that Config is recording Route 53

        ```bash theme={null}
        aws configservice describe-configuration-recorders --region us-east-1
        aws configservice describe-configuration-recorder-status --region us-east-1
        ```

        Ensure:

        * `recording` is `true`
        * `includeGlobalResourceTypes` is `true`
        * `AWS::Route53::HostedZone` (or `allSupported=true`) is in the recording group.
      </Accordion>

      <Accordion title="Using Python">
        To “enable AWS Config for Route 53” you need to:

        1. Turn on AWS Config in the target region.
        2. Configure a recorder that includes Route 53 resource types.
        3. Configure a delivery channel (S3 bucket, optionally SNS).
        4. Start the configuration recorder.

        Below is a step‑by‑step guide and sample Python (boto3) code.

        ***

        ## 1. Prerequisites

        * Python 3.x
        * `boto3` installed:
          ```bash theme={null}
          pip install boto3
          ```
        * An S3 bucket for AWS Config (e.g., `my-config-logs-bucket`).
        * An IAM role for AWS Config (or let the console create it and re-use it).\
          Typical role name: `AWSServiceRoleForConfig`.

        If you don’t have the role, you can:

        * Use the console once to enable Config (it creates the role), or
        * Create an IAM role with trusted entity `config.amazonaws.com` and attach AWS-managed policy `AWSConfigRole` (plus S3 permissions for your bucket).

        ***

        ## 2. Know the Route 53 AWS Config resource types

        For Route 53, relevant resource types include, for example:

        * `AWS::Route53::HostedZone`
        * `AWS::Route53::HealthCheck`
        * `AWS::Route53Resolver::ResolverEndpoint`
        * `AWS::Route53Resolver::ResolverRule`
        * `AWS::Route53Resolver::ResolverRuleAssociation`
        * `AWS::Route53Resolver::ResolverQueryLoggingConfig`
        * `AWS::Route53Resolver::ResolverQueryLoggingConfigAssociation`
        * (or you can simply record `allSupported` resources)

        ***

        ## 3. Python code to enable AWS Config (with Route 53)

        This example:

        * Uses region `us-east-1` (change as needed)
        * Uses S3 bucket `my-config-logs-bucket` (change as needed)
        * Creates/updates:
          * Configuration recorder
          * Delivery channel
        * Enables recording of **all supported** resources (which includes Route 53).\
          If you want *only* Route 53, see the variant below.

        ```python theme={null}
        import boto3
        from botocore.exceptions import ClientError

        REGION = "us-east-1"
        S3_BUCKET = "my-config-logs-bucket"
        CONFIG_ROLE_ARN = "arn:aws:iam::123456789012:role/AWSServiceRoleForConfig"  # change this

        config = boto3.client("config", region_name=REGION)

        def ensure_config_recorder():
            try:
                # Create or update the configuration recorder
                config.put_configuration_recorder(
                    ConfigurationRecorder={
                        "name": "default",
                        "roleARN": CONFIG_ROLE_ARN,
                        "recordingGroup": {
                            # Record all supported resource types (includes Route 53)
                            "allSupported": True,
                            "includeGlobalResourceTypes": True
                        }
                    }
                )
                print("Configuration recorder created/updated.")
            except ClientError as e:
                print(f"Error creating configuration recorder: {e}")
                raise

        def ensure_delivery_channel():
            try:
                # Create or update the delivery channel
                config.put_delivery_channel(
                    DeliveryChannel={
                        "name": "default",
                        "s3BucketName": S3_BUCKET,
                        # Optionally specify S3 key prefix, SNS topic, etc.
                        # "s3KeyPrefix": "aws-config",
                        # "snsTopicARN": "arn:aws:sns:REGION:ACCOUNT_ID:MyConfigTopic"
                    }
                )
                print("Delivery channel created/updated.")
            except ClientError as e:
                print(f"Error creating delivery channel: {e}")
                raise

        def start_recorder():
            try:
                config.start_configuration_recorder(
                    ConfigurationRecorderName="default"
                )
                print("Configuration recorder started.")
            except ClientError as e:
                print(f"Error starting configuration recorder: {e}")
                raise

        if __name__ == "__main__":
            ensure_config_recorder()
            ensure_delivery_channel()
            start_recorder()
        ```

        This will enable AWS Config in `us-east-1` and start recording all supported resources, including Route 53.

        ***

        ## 4. Variant: Record **only Route 53** resource types

        If you want to record only Route 53 resources instead of all resources:

        ```python theme={null}
        ROUTE53_RESOURCE_TYPES = [
            "AWS::Route53::HostedZone",
            "AWS::Route53::HealthCheck",
            "AWS::Route53Resolver::ResolverEndpoint",
            "AWS::Route53Resolver::ResolverRule",
            "AWS::Route53Resolver::ResolverRuleAssociation",
            "AWS::Route53Resolver::ResolverQueryLoggingConfig",
            "AWS::Route53Resolver::ResolverQueryLoggingConfigAssociation"
        ]

        config.put_configuration_recorder(
            ConfigurationRecorder={
                "name": "default",
                "roleARN": CONFIG_ROLE_ARN,
                "recordingGroup": {
                    "allSupported": False,
                    "includeGlobalResourceTypes": True,
                    "resourceTypes": ROUTE53_RESOURCE_TYPES
                }
            }
        )
        ```

        Keep the delivery channel and `start_configuration_recorder` code the same.

        ***

        ## 5. Verification

        After running the script:

        1. In the AWS console, go to **AWS Config → Settings** in the target region.
        2. Confirm:
           * Configuration recorder is **ON**.
           * Resource types include Route 53 (or “All resources”).
           * S3 bucket is configured.
        3. Check S3 bucket for configuration history snapshots and configuration items over time.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_s3_bucket" "config_delivery" {
          bucket = "AWS_CONFIG_BUCKET_NAME" # replace with a globally-unique bucket name
        }

        resource "aws_s3_bucket_ownership_controls" "config_delivery" {
          bucket = aws_s3_bucket.config_delivery.id

          rule {
            object_ownership = "BucketOwnerPreferred"
          }
        }

        resource "aws_s3_bucket_public_access_block" "config_delivery" {
          bucket = aws_s3_bucket.config_delivery.id

          block_public_acls       = true
          block_public_policy     = true
          ignore_public_acls      = true
          restrict_public_buckets = true
        }

        resource "aws_config_configuration_recorder" "main" {
          name     = "AWS_CONFIG_RECORDER_NAME" # replace with your desired recorder name
          role_arn = "AWS_CONFIG_SERVICE_ROLE_ARN" # replace with an IAM role ARN allowing AWS Config to record and write to S3

          recording_group {
            all_supported              = false
            include_global_resource_types = true

            resource_types = [
              "AWS::Route53::HostedZone",
              # add any other resource types you want recorded
            ]
          }
        }

        resource "aws_config_delivery_channel" "main" {
          name           = "AWS_CONFIG_DELIVERY_CHANNEL_NAME" # replace with your desired channel name
          s3_bucket_name = aws_s3_bucket.config_delivery.bucket

          snapshot_delivery_properties {
            delivery_frequency = "TwentyFour_Hours"
          }

          depends_on = [aws_config_configuration_recorder.main]
        }

        resource "aws_config_configuration_recorder_status" "main" {
          name       = aws_config_configuration_recorder.main.name
          is_enabled = true

          depends_on = [aws_config_delivery_channel.main]
        }
        ```

        This creates and enables AWS Config to record Route53 hosted zones; it does not replace existing Route53 resources, but it will create new AWS Config resources and an S3 bucket.

        For verification, `terraform plan` should show the creation of `aws_config_configuration_recorder.main`, `aws_config_delivery_channel.main`, `aws_config_configuration_recorder_status.main`, the S3 bucket, and related S3 controls, with no Route53 resources being replaced.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>