> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Config enabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Here are the step-by-step instructions to remediate the AWS Config Should Be Enabled misconfiguration using the AWS console:

        1. Log in to the AWS Management Console.
        2. Navigate to the AWS Config service.
        3. Click on the "Get started" button to begin setting up AWS Config.
        4. On the "AWS Config" page, select the region you want to enable AWS Config in.
        5. Choose the resource types that you want AWS Config to monitor for changes.
        6. For "Amazon S3 bucket for AWS Config snapshots", choose an S3 bucket to store configuration snapshots.
        7. For "Amazon SNS topic for AWS Config notifications", select an SNS topic to receive notifications.
        8. Click on the "Next" button to proceed to the "Rules" page.
        9. On the "Rules" page, select the rules that you want AWS Config to evaluate.
        10. Click on the "Next" button to proceed to the "Review" page.
        11. Review the settings and click on the "Confirm" button to enable AWS Config.
        12. Wait for AWS Config to finish setting up and start monitoring your resources.

        Once AWS Config is enabled, it will continuously monitor your resources and notify you of any configuration changes or violations.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "AWS Config Should Be Enabled" for AWS using AWS CLI, follow these steps:

        1. Open the AWS CLI on your local machine or terminal.

        2. Run the following command to enable AWS Config:

        ```
        aws configservice put-config-rule --config-rule file://rule.json
        ```

        Note: Make sure to replace `rule.json` with the name of the JSON file that contains the configuration rule. You can create a new JSON file with the following contents:

        ```
        {
            "ConfigRuleName": "aws-config-enabled",
            "Description": "Checks whether AWS Config is enabled in the account",
            "Scope": {
                "ComplianceResourceTypes": [
                    "AWS::::Account"
                ]
            },
            "Source": {
                "Owner": "AWS",
                "SourceIdentifier": "CONFIG_SERVICE_ENABLED"
            }
        }
        ```

        3. After running the command, AWS Config will be enabled in your AWS account. You can verify this by going to the AWS Config console and checking the status.

        Note: It may take a few minutes for the configuration changes to take effect.

        4. You can also use the following command to check the status of AWS Config:

        ```
        aws configservice describe-configuration-recorders
        ```

        This command will show you the status of the configuration recorders for AWS Config.

        5. Once you have verified that AWS Config is enabled, you can close the AWS CLI.

        Congratulations! You have successfully remediated the misconfiguration "AWS Config Should Be Enabled" for AWS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "AWS Config Should Be Enabled" for AWS using python, follow these steps:

        1. Import the boto3 library to interact with AWS services using Python.

        ```
        import boto3
        ```

        2. Create a boto3 client for AWS Config.

        ```
        config_client = boto3.client('config')
        ```

        3. Check if AWS Config is enabled. If it is not enabled, enable it using the `put_config_rule` method.

        ```
        response = config_client.describe_configuration_recorder_status()
        if not response['ConfigurationRecordersStatus'][0]['recording']:
            response = config_client.put_configuration_recorder(
                ConfigurationRecorder={
                    'name': 'default',
                    'roleARN': 'arn:aws:iam::123456789012:role/config-role',
                    'recordingGroup': {
                        'allSupported': True,
                        'includeGlobalResourceTypes': True
                    }
                }
            )
        ```

        4. Set the delivery channel for AWS Config. This will specify where the AWS Config data will be delivered.

        ```
        response = config_client.put_delivery_channel(
            DeliveryChannel={
                'name': 'default',
                's3BucketName': 'myconfigbucket',
                'configSnapshotDeliveryProperties': {
                    'deliveryFrequency': 'TwentyFour_Hours'
                }
            }
        )
        ```

        5. Confirm that AWS Config is enabled.

        ```
        response = config_client.describe_configuration_recorder_status()
        if response['ConfigurationRecordersStatus'][0]['recording']:
            print('AWS Config is enabled.')
        ```

        Note: Replace `123456789012` with your AWS account number and `myconfigbucket` with the name of your S3 bucket where you want to store the AWS Config data.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_config_configuration_recorder" "default" {
          name     = "default"
          role_arn = aws_iam_role.config_role.arn

          recording_group {
            all_supported                 = true
            include_global_resource_types = true
          }
        }

        resource "aws_config_delivery_channel" "default" {
          name           = "default"
          s3_bucket_name = aws_s3_bucket.config_bucket.bucket

          depends_on = [aws_config_configuration_recorder.default]
        }

        resource "aws_config_configuration_recorder_status" "default" {
          name       = aws_config_configuration_recorder.default.name
          is_enabled = true

          depends_on = [aws_config_delivery_channel.default]
        }

        resource "aws_s3_bucket" "config_bucket" {
          bucket = "CONFIG_BUCKET_NAME" # replace with a globally-unique bucket name, e.g. config-bucket-ACCOUNT_NAME-AWS_REGION
        }

        data "aws_iam_policy_document" "config_bucket_policy" {
          statement {
            sid     = "AWSConfigBucketPermissionsCheck"
            effect  = "Allow"
            actions = ["s3:GetBucketAcl"]

            principals {
              type        = "Service"
              identifiers = ["config.amazonaws.com"]
            }

            resources = [
              aws_s3_bucket.config_bucket.arn,
            ]
          }

          statement {
            sid     = "AWSConfigBucketDelivery"
            effect  = "Allow"
            actions = ["s3:PutObject"]

            principals {
              type        = "Service"
              identifiers = ["config.amazonaws.com"]
            }

            resources = [
              "${aws_s3_bucket.config_bucket.arn}/AWSLogs/ACCOUNT_ID/Config/*", # replace ACCOUNT_ID with the numeric AWS account ID
            ]

            condition {
              test     = "StringEquals"
              variable = "s3:x-amz-acl"

              values = ["bucket-owner-full-control"]
            }
          }
        }

        resource "aws_s3_bucket_policy" "config_bucket" {
          bucket = aws_s3_bucket.config_bucket.id
          policy = data.aws_iam_policy_document.config_bucket_policy.json
        }

        resource "aws_iam_role" "config_role" {
          name = "CONFIG_ROLE_NAME" # replace with the name you want for the AWS Config IAM role

          assume_role_policy = jsonencode({
            Version = "2012-10-17"
            Statement = [
              {
                Sid    = ""
                Effect = "Allow"
                Principal = {
                  Service = "config.amazonaws.com"
                }
                Action = "sts:AssumeRole"
              }
            ]
          })
        }

        resource "aws_iam_role_policy_attachment" "config_role_managed_policy" {
          role       = aws_iam_role.config_role.name
          policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole"
        }
        ```

        This enables AWS Config in the target region, recording all supported resources (including Route53 as a global resource), writing to the specified S3 bucket with the same permissions and behavior as the provided CLI remediation. No resource here is forced to be replaced unless you already manage any of these with different names in Terraform.

        To verify, `terraform plan` should show:

        * creation of `aws_s3_bucket.config_bucket` and `aws_s3_bucket_policy.config_bucket`
        * creation of `aws_iam_role.config_role` and its `aws_iam_role_policy_attachment`
        * creation (or in-place update, if they already exist with the same names) of `aws_config_configuration_recorder.default`, `aws_config_delivery_channel.default`, and `aws_config_configuration_recorder_status.default`, with `all_supported = true` and `include_global_resource_types = true`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>