It captures these changes as configuration items. The configuration recorder is used to detect configuration changes in the resources that you’re monitoring. To use AWS Config organization Rules, you must create a configuration recorder and delivery channel.

aggregator_name: Name of the AWS Config aggregator that resides in the parent account.

config_role_name: Name of the IAM role AWS Config uses used for the service and organization aggregator.

password_parameters: Mapped string that feeds a JSON object into input parameters for the AWS Organizations AWS Config Rule.

encryption_enabled: Takes in a Boolean value and determines if S3 bucket will have server-side encryption enabled.

The variables are for the bucket policy, to allow AWS Config to post its findings into the bucket and determine is server-side encryption is enabled in the bucket. The attached variables.tf file contains the following variables for the S3 bucket that’s used for the AWS Config history. The process of creating the aggregator is done from the account aggregator because otherwise users would have to specify the accounts that are aggregated and find some method for updating the aggregation.

After the data is collected from the accounts, you can aggregate the findings into one account – ideally the administrator account where the aggregator is created. For more information, see Evaluating Resources with AWS Config Rules in the AWS Config Developer Guide.ĪWS Organizations allows us to take an approach of centralizing our rules so that they’re deployed out automatically to other accounts in the Organization. In the secondary/member accounts, Config is collecting data on resources in the environment, and making a determination of compliant or non-compliant based on the AWS Config rules. The administrator account aggregates its findings through AWS Organizations. In this solution, AWS Config and the configuration recorder and delivery channel must be run in the delegated administrator and member accounts. Figure 1: Architecture shows interaction between Terraform, AWS Config rule, and aggregator.

Terraform aws waf