Browse the Repo

file-type-icon.circleci
file-type-icon.github
file-type-icon.patcher
file-type-icon_ci
file-type-icon_docs
file-type-iconcodegen
file-type-iconexamples
file-type-iconmodules
file-type-icon_deprecated
file-type-iconauto-update
file-type-iconaws-auth
file-type-iconaws-config-bucket
file-type-iconaws-config-multi-region
file-type-iconREADME.adoc
file-type-iconcore-concepts.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconvariables.autogen.tf
file-type-iconvariables.tf
file-type-iconaws-config-rules
file-type-iconaws-config
file-type-iconaws-organizations
file-type-iconcloudtrail-bucket
file-type-iconcloudtrail
file-type-iconcross-account-iam-roles
file-type-iconcustom-iam-entity
file-type-iconebs-encryption-multi-region
file-type-iconebs-encryption
file-type-iconfail2ban
file-type-icongithub-actions-iam-role
file-type-iconguardduty-multi-region
file-type-iconguardduty
file-type-iconiam-access-analyzer-multi-region
file-type-iconiam-groups
file-type-iconiam-policies
file-type-iconiam-user-password-policy
file-type-iconiam-users
file-type-iconip-lockdown
file-type-iconkms-cmk-replica
file-type-iconkms-grant-multi-region
file-type-iconkms-master-key-multi-region
file-type-iconkms-master-key
file-type-iconntp
file-type-iconos-hardening
file-type-iconprivate-s3-bucket
file-type-iconsaml-iam-roles
file-type-iconsecrets-manager-resource-policies
file-type-iconssh-grunt-selinux-policy
file-type-iconssh-grunt
file-type-iconssh-iam
file-type-iconssm-healthchecks-iam-permissions
file-type-icontls-cert-private
file-type-icontest
file-type-icon.editorconfig
file-type-icon.gitignore
file-type-icon.pre-commit-config.yaml
file-type-iconCODEOWNERS
file-type-iconLICENSE.txt
file-type-iconREADME.adoc
file-type-iconterraform-cloud-enterprise-private-module-...

Browse the Repo

file-type-icon.circleci
file-type-icon.github
file-type-icon.patcher
file-type-icon_ci
file-type-icon_docs
file-type-iconcodegen
file-type-iconexamples
file-type-iconmodules
file-type-icon_deprecated
file-type-iconauto-update
file-type-iconaws-auth
file-type-iconaws-config-bucket
file-type-iconaws-config-multi-region
file-type-iconREADME.adoc
file-type-iconcore-concepts.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconvariables.autogen.tf
file-type-iconvariables.tf
file-type-iconaws-config-rules
file-type-iconaws-config
file-type-iconaws-organizations
file-type-iconcloudtrail-bucket
file-type-iconcloudtrail
file-type-iconcross-account-iam-roles
file-type-iconcustom-iam-entity
file-type-iconebs-encryption-multi-region
file-type-iconebs-encryption
file-type-iconfail2ban
file-type-icongithub-actions-iam-role
file-type-iconguardduty-multi-region
file-type-iconguardduty
file-type-iconiam-access-analyzer-multi-region
file-type-iconiam-groups
file-type-iconiam-policies
file-type-iconiam-user-password-policy
file-type-iconiam-users
file-type-iconip-lockdown
file-type-iconkms-cmk-replica
file-type-iconkms-grant-multi-region
file-type-iconkms-master-key-multi-region
file-type-iconkms-master-key
file-type-iconntp
file-type-iconos-hardening
file-type-iconprivate-s3-bucket
file-type-iconsaml-iam-roles
file-type-iconsecrets-manager-resource-policies
file-type-iconssh-grunt-selinux-policy
file-type-iconssh-grunt
file-type-iconssh-iam
file-type-iconssm-healthchecks-iam-permissions
file-type-icontls-cert-private
file-type-icontest
file-type-icon.editorconfig
file-type-icon.gitignore
file-type-icon.pre-commit-config.yaml
file-type-iconCODEOWNERS
file-type-iconLICENSE.txt
file-type-iconREADME.adoc
file-type-iconterraform-cloud-enterprise-private-module-...
AWS Config Multi Region

AWS Config Multi Region

Enable AWS Config in all regions, Configure config items to be automatically archive and delete after a certain time period.

Code Preview

Preview the Code

mobile file icon

core-concepts.md

down

Using AWS Config in multiple regions and accounts

Managing AWS Config in all regions of all accounts presents considerable challenges when creating the appropriate configuration resources in the right order as well as when reviewing AWS Config output. Furthermore, it is impractical to set up S3 buckets for each account:region pair and to then review the results. We recommend the following strategy for handling Config across multiple AWS accounts:

  1. When using this module, begin with the account that should act as the "central" account for collecting AWS Config output from child accounts. In the Gruntwork reference architecture this would be the "security" account.
  2. Use the global_recorder_region variable to designate one region as the recorder for global resource types.
  3. For the central account, set should_create_s3_bucket=true and provide a name with the s3_bucket_name variable. This will create an S3 bucket with encryption enabled, public access disabled, a lifecycle policy with expiration dates for the Config logs stored in that bucket, and an access policy permitting access to all the accounts named in the linked_accounts variable. If you wish to use SNS for delivery notifications, provide a name in sns_topic_name and set should_create_sns_topic=true.
  4. Run this module on all child accounts, setting the global_recorder_region for one region as mentioned above, and passing the S3 bucket created in the previous step in the s3_bucket_name variable. Set should_create_s3_bucket=false. You must also set central_account_id to the account from the first step above. If you wish to use SNS for delivery notifications, provide a name in sns_topic_name and set should_create_sns_topic=false to use the SNS topic in the central account.

Once complete, the following configuration will be established:

  • In each account, an IAM role will exist with suitable permissions for AWS Config
  • In each region of each account, Config will be enabled. It will be configured to send objects to an S3 bucket located in the global_recorder_region of the central account, and, if SNS is enabled, to deliver SNS notifications to the topic in the corresponding region of the central account. Additionally, aggregation will be enabled for the global_recorder_region of the central account.
  • In the global_recorder_region of the central account: Config will be enabled with an aggregator, S3 bucket, and an SNS topic.

If you add more accounts, update the linked_accounts variable, then rerun terraform in the central account to ensure that permissions are configured for the new account.

Questions? Ask away.

We're here to talk about our services, answer any questions, give advice, or just to chat.

Ready to hand off the Gruntwork?