AWS Config Should Be Enabled - Cloud Security

More Info:

Ensure that AWS Config service is enabled in all regions in order to have complete visibility over your AWS infrastructure configuration changes.

Risk Level

High

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Here are the step-by-step instructions to remediate the AWS Config Should Be Enabled misconfiguration using the AWS console:

1. Log in to the AWS Management Console.
2. Navigate to the AWS Config service.
3. Click on the "Get started" button to begin setting up AWS Config.
4. On the "AWS Config" page, select the region you want to enable AWS Config in.
5. Choose the resource types that you want AWS Config to monitor for changes.
6. For "Amazon S3 bucket for AWS Config snapshots", choose an S3 bucket to store configuration snapshots.
7. For "Amazon SNS topic for AWS Config notifications", select an SNS topic to receive notifications.
8. Click on the "Next" button to proceed to the "Rules" page.
9. On the "Rules" page, select the rules that you want AWS Config to evaluate.
10. Click on the "Next" button to proceed to the "Review" page.
11. Review the settings and click on the "Confirm" button to enable AWS Config.
12. Wait for AWS Config to finish setting up and start monitoring your resources.

Once AWS Config is enabled, it will continuously monitor your resources and notify you of any configuration changes or violations.

Using CLI

To remediate the misconfiguration "AWS Config Should Be Enabled" for AWS using AWS CLI, follow these steps:

1. Open the AWS CLI on your local machine or terminal.

2. Run the following command to enable AWS Config:

aws configservice put-config-rule --config-rule file://rule.json

Note: Make sure to replace rule.json with the name of the JSON file that contains the configuration rule. You can create a new JSON file with the following contents:

{
    "ConfigRuleName": "aws-config-enabled",
    "Description": "Checks whether AWS Config is enabled in the account",
    "Scope": {
        "ComplianceResourceTypes": [
            "AWS::::Account"
        ]
    },
    "Source": {
        "Owner": "AWS",
        "SourceIdentifier": "CONFIG_SERVICE_ENABLED"
    }
}

3. After running the command, AWS Config will be enabled in your AWS account. You can verify this by going to the AWS Config console and checking the status.

Note: It may take a few minutes for the configuration changes to take effect.

4. You can also use the following command to check the status of AWS Config:

aws configservice describe-configuration-recorders

This command will show you the status of the configuration recorders for AWS Config.

5. Once you have verified that AWS Config is enabled, you can close the AWS CLI.

Congratulations! You have successfully remediated the misconfiguration "AWS Config Should Be Enabled" for AWS using AWS CLI.

Using Python

To remediate the misconfiguration "AWS Config Should Be Enabled" for AWS using python, follow these steps:

1. Import the boto3 library to interact with AWS services using Python.

import boto3

2. Create a boto3 client for AWS Config.

config_client = boto3.client('config')

3. Check if AWS Config is enabled. If it is not enabled, enable it using the put_config_rule method.

response = config_client.describe_configuration_recorder_status()
if not response['ConfigurationRecordersStatus'][0]['recording']:
    response = config_client.put_configuration_recorder(
        ConfigurationRecorder={
            'name': 'default',
            'roleARN': 'arn:aws:iam::123456789012:role/config-role',
            'recordingGroup': {
                'allSupported': True,
                'includeGlobalResourceTypes': True
            }
        }
    )

4. Set the delivery channel for AWS Config. This will specify where the AWS Config data will be delivered.

response = config_client.put_delivery_channel(
    DeliveryChannel={
        'name': 'default',
        's3BucketName': 'myconfigbucket',
        'configSnapshotDeliveryProperties': {
            'deliveryFrequency': 'TwentyFour_Hours'
        }
    }
)

5. Confirm that AWS Config is enabled.

response = config_client.describe_configuration_recorder_status()
if response['ConfigurationRecordersStatus'][0]['recording']:
    print('AWS Config is enabled.')

Note: Replace 123456789012 with your AWS account number and myconfigbucket with the name of your S3 bucket where you want to store the AWS Config data.

Using Terraform

resource "aws_config_configuration_recorder" "default" {
  name     = "default"
  role_arn = aws_iam_role.config_role.arn

  recording_group {
    all_supported                 = true
    include_global_resource_types = true
  }
}

resource "aws_config_delivery_channel" "default" {
  name           = "default"
  s3_bucket_name = aws_s3_bucket.config_bucket.bucket

  depends_on = [aws_config_configuration_recorder.default]
}

resource "aws_config_configuration_recorder_status" "default" {
  name       = aws_config_configuration_recorder.default.name
  is_enabled = true

  depends_on = [aws_config_delivery_channel.default]
}

resource "aws_s3_bucket" "config_bucket" {
  bucket = "CONFIG_BUCKET_NAME" # replace with a globally-unique bucket name, e.g. config-bucket-ACCOUNT_NAME-AWS_REGION
}

data "aws_iam_policy_document" "config_bucket_policy" {
  statement {
    sid     = "AWSConfigBucketPermissionsCheck"
    effect  = "Allow"
    actions = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["config.amazonaws.com"]
    }

    resources = [
      aws_s3_bucket.config_bucket.arn,
    ]
  }

  statement {
    sid     = "AWSConfigBucketDelivery"
    effect  = "Allow"
    actions = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["config.amazonaws.com"]
    }

    resources = [
      "${aws_s3_bucket.config_bucket.arn}/AWSLogs/ACCOUNT_ID/Config/*", # replace ACCOUNT_ID with the numeric AWS account ID
    ]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"

      values = ["bucket-owner-full-control"]
    }
  }
}

resource "aws_s3_bucket_policy" "config_bucket" {
  bucket = aws_s3_bucket.config_bucket.id
  policy = data.aws_iam_policy_document.config_bucket_policy.json
}

resource "aws_iam_role" "config_role" {
  name = "CONFIG_ROLE_NAME" # replace with the name you want for the AWS Config IAM role

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = ""
        Effect = "Allow"
        Principal = {
          Service = "config.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "config_role_managed_policy" {
  role       = aws_iam_role.config_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole"
}

This enables AWS Config in the target region, recording all supported resources (including Route53 as a global resource), writing to the specified S3 bucket with the same permissions and behavior as the provided CLI remediation. No resource here is forced to be replaced unless you already manage any of these with different names in Terraform.

To verify, terraform plan should show:

• creation of aws_s3_bucket.config_bucket and aws_s3_bucket_policy.config_bucket
• creation of aws_iam_role.config_role and its aws_iam_role_policy_attachment
• creation (or in-place update, if they already exist with the same names) of aws_config_configuration_recorder.default, aws_config_delivery_channel.default, and aws_config_configuration_recorder_status.default, with all_supported = true and include_global_resource_types = true.

Additional Reading:

• https://docs.aws.amazon.com/config/latest/developerguide/gs-console.html