> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Config global resources remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Here’s how to enable AWS Config to record **global resources** (including Route 53) using the AWS Management Console:

        1. **Sign in and open AWS Config**
           * Go to the AWS Management Console.
           * In the search bar, type **“Config”** and open **AWS Config**.
           * Make sure you are in the **desired Region** (e.g., us-east-1). Global resources are still controlled per-region in Config.

        2. **Open Settings (or Set up recorder)**
           * If AWS Config is not yet set up:
             * Choose **“Get started”**.
           * If AWS Config is already set up:
             * In the left navigation pane, choose **“Settings”**.

        3. **Enable recording of global resources**
           * In the **Resource recording** (or **Recorder** / **Resource types to record**) section:
             * Find the option **“Record global resources (e.g., IAM resources)”**.
             * Check or turn **ON** this option.
               * This is what ensures global services such as **Route 53** are included.

        4. **Select resource types (if applicable)**
           * If you are using **Record specific resource types**:
             * Ensure **Route 53** resource types are selected, for example:
               * `AWS::Route53::HostedZone`
               * `AWS::Route53::HealthCheck`
               * Any other Route 53 types relevant to your environment.
           * If you use **Record all current and future resource types**:
             * Route 53 will automatically be included once global resources are enabled.

        5. **Confirm delivery channel**
           * In the same Settings page, confirm:
             * **S3 bucket** for configuration history and snapshots is set.
             * Optionally, **SNS topic** for notifications is set.
           * These may already be configured; if not, follow the prompts to create/select them.

        6. **Save changes**
           * Scroll down and choose **“Save” / “Save settings”**.
           * AWS Config will now begin recording **global Route 53 resources**.

        7. **Verify**
           * After a few minutes:
             * In AWS Config, go to **“Resources”**.
             * In the **Resource type** filter, search for **Route 53** types (e.g., `AWS::Route53::HostedZone`).
             * Confirm your Route 53 resources are now visible and tracked.
      </Accordion>

      <Accordion title="Using CLI">
        To have AWS Config record global resources like Route 53, you must enable **includeGlobalResourceTypes** on your configuration recorder.

        Below are the minimal CLI steps.

        ***

        ### 1. Find your existing configuration recorder (if any)

        ```bash theme={null}
        aws configservice describe-configuration-recorders
        ```

        Look for the `name` and current `recordingGroup` settings, e.g.:

        ```json theme={null}
        {
          "ConfigurationRecorders": [
            {
              "name": "default",
              "roleARN": "arn:aws:iam::123456789012:role/aws-config-role",
              "recordingGroup": {
                "allSupported": true,
                "includeGlobalResourceTypes": false
              }
            }
          ]
        }
        ```

        Note the `name` (e.g., `default`) and `roleARN`.

        ***

        ### 2. Update the recorder to include global resources

        Replace the recorder name and role ARN as appropriate:

        ```bash theme={null}
        aws configservice put-configuration-recorder \
          --configuration-recorder "name=default,roleARN=arn:aws:iam::123456789012:role/aws-config-role,recordingGroup={allSupported=true,includeGlobalResourceTypes=true}"
        ```

        Key part is `includeGlobalResourceTypes=true`.

        If you prefer to record only specific resource types and include Route 53 explicitly:

        ```bash theme={null}
        aws configservice put-configuration-recorder \
          --configuration-recorder "name=default,roleARN=arn:aws:iam::123456789012:role/aws-config-role,recordingGroup={allSupported=false,includeGlobalResourceTypes=true,resourceTypes=[\"AWS::EC2::Instance\",\"AWS::S3::Bucket\"]}"
        ```

        (Any value of `includeGlobalResourceTypes=true` will allow global resources like Route 53 to be recorded.)

        ***

        ### 3. Ensure the recorder is started

        ```bash theme={null}
        aws configservice start-configuration-recorder --configuration-recorder-name default
        ```

        ***

        ### 4. Verify the configuration

        ```bash theme={null}
        aws configservice describe-configuration-recorders
        ```

        Confirm:

        ```json theme={null}
        "recordingGroup": {
          "allSupported": true,
          "includeGlobalResourceTypes": true
        }
        ```

        AWS Config will now include global resources (including Route 53) in its recording.
      </Accordion>

      <Accordion title="Using Python">
        To record Route 53 (a global service) in AWS Config, you must enable recording of global resources in the **us-east-1** region, because AWS Config treats global resources there.

        Below are step‑by‑step instructions plus a Python (boto3) example.

        ***

        ## 1. Prerequisites

        * `boto3` installed:
          ```bash theme={null}
          pip install boto3
          ```
        * IAM permissions for:
          * `config:DescribeConfigurationRecorders`
          * `config:PutConfigurationRecorder`
          * `config:StartConfigurationRecorder`
        * Run everything in **us-east-1**:
          ```bash theme={null}
          export AWS_REGION=us-east-1
          ```

        ***

        ## 2. Logic You Need

        1. Connect to AWS Config in `us-east-1`.
        2. Get existing configuration recorder.
        3. If none exists, create one that:
           * Records all supported resource types.
           * Includes global resource types.
        4. If one exists, update it to include global resources.
        5. Start/restart the configuration recorder.

        ***

        ## 3. Python Script (boto3)

        This script:

        * Ensures there is a recorder called `default`.
        * Sets `includeGlobalResourceTypes=True` (legacy style) or adjusts the recording strategy as needed.
        * Starts the recorder.

        ```python theme={null}
        import boto3
        from botocore.exceptions import ClientError

        REGION = "us-east-1"
        RECORDER_NAME = "default"

        config = boto3.client("config", region_name=REGION)

        def ensure_config_recorder():
            try:
                resp = config.describe_configuration_recorders()
                recorders = resp.get("ConfigurationRecorders", [])
            except ClientError as e:
                raise SystemExit(f"Error describing recorders: {e}")

            if recorders:
                recorder = recorders[0]
                name = recorder["name"]
                role_arn = recorder["roleARN"]
                # Legacy style properties
                recording_group = recorder.get("recordingGroup", {})

                # Ensure we record all supported + global resources
                recording_group["allSupported"] = True
                recording_group["includeGlobalResourceTypes"] = True

                try:
                    config.put_configuration_recorder(
                        ConfigurationRecorder={
                            "name": name,
                            "roleARN": role_arn,
                            "recordingGroup": recording_group
                        }
                    )
                    print(f"Updated recorder '{name}' to include global resources.")
                except ClientError as e:
                    raise SystemExit(f"Error updating recorder: {e}")
            else:
                # You must supply an IAM role ARN that AWS Config can assume
                role_arn = "arn:aws:iam::<ACCOUNT_ID>:role/<AWS_Config_Service_Role>"

                try:
                    config.put_configuration_recorder(
                        ConfigurationRecorder={
                            "name": RECORDER_NAME,
                            "roleARN": role_arn,
                            "recordingGroup": {
                                "allSupported": True,
                                "includeGlobalResourceTypes": True
                            }
                        }
                    )
                    print(f"Created recorder '{RECORDER_NAME}' with global resources enabled.")
                except ClientError as e:
                    raise SystemExit(f"Error creating recorder: {e}")


        def start_recorder():
            try:
                config.start_configuration_recorder(
                    ConfigurationRecorderName=RECORDER_NAME
                )
                print(f"Started configuration recorder '{RECORDER_NAME}'.")
            except ClientError as e:
                if e.response["Error"]["Code"] == "NoSuchConfigurationRecorderException":
                    raise SystemExit("Recorder does not exist. Create it first.")
                raise SystemExit(f"Error starting recorder: {e}")


        if __name__ == "__main__":
            ensure_config_recorder()
            start_recorder()
        ```

        ***

        ## 4. What This Fixes For Route 53

        * Route 53 is a **global** service.
        * By setting `includeGlobalResourceTypes=True` in **us-east-1**, AWS Config starts recording Route 53 resources (and other global resources like IAM), satisfying the requirement: “AWS Config Should Include Global Resources” for Route 53.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_iam_role" "config_role" {
          name = "AWSConfigRole"

          assume_role_policy = data.aws_iam_policy_document.config_assume_role_policy.json
        }

        data "aws_iam_policy_document" "config_assume_role_policy" {
          statement {
            actions = ["sts:AssumeRole"]

            principals {
              type        = "Service"
              identifiers = ["config.amazonaws.com"]
            }
          }
        }

        resource "aws_iam_role_policy_attachment" "config_role_attach" {
          role       = aws_iam_role.config_role.name
          policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole"
        }

        resource "aws_config_configuration_recorder" "this" {
          name     = "default"
          role_arn = aws_iam_role.config_role.arn

          recording_group {
            all_supported                 = true
            include_global_resource_types = true
          }
        }

        resource "aws_s3_bucket" "config_bucket" {
          bucket = "AWS_CONFIG_BUCKET_NAME" # replace with your Config bucket name
        }

        resource "aws_config_delivery_channel" "this" {
          name           = "default"
          s3_bucket_name = aws_s3_bucket.config_bucket.bucket

          depends_on = [aws_config_configuration_recorder.this]
        }

        resource "aws_config_configuration_recorder_status" "this" {
          name       = aws_config_configuration_recorder.this.name
          is_enabled = true
        }
        ```

        Replace `AWS_CONFIG_BUCKET_NAME` with your S3 bucket name for Config logs. Changing `include_global_resource_types` from `false` to `true` is an in-place update and does not force replacement of the recorder.

        To verify, `terraform plan` should show an in-place update to `aws_config_configuration_recorder.this.recording_group.include_global_resource_types` from `false` (or `null`) to `true`, with no resource recreation.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>