Skip to main content

🛡️ AWS Account Config is not enabled in all regions🟢

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-88fa51c81

Description​

Open File

Description​

AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.

Rationale​

The AWS configuration item history captured by AWS Config enables security analysis, resource change tracking, and compliance auditing.

Impact​

Enabling AWS Config in all regions provides comprehensive visibility into resource configurations, enhancing security and compliance monitoring. However, this may incur additional costs and require proper configuration management.

Audit​

Process to evaluate AWS Config configuration per region:

From Console​
  1. Sign in to the AWS Management Console and open the AWS Config console at https://console.aws.amazon.com/config/.
  2. On the top right of the console select target Region.

... see more

Remediation​

Open File

Remediation​

To implement AWS Config configuration:

From Console​

  1. Select the region you want to focus on in the top right of the console.
  2. Click Services.
  3. Click Config.
  4. If a Config recorder is enabled in this region, you should navigate to the Settings page from the navigation menu on the left hand side. If a Config recorder is not yet enabled in this region then you should select Get Started.
  5. Select Record all resources supported in this region.
  6. Choose to include global resources (IAM resources).
  7. Specify an S3 bucket in the same account or in another managed AWS account.
  8. Create an SNS Topic from the same AWS account or another managed AWS account.

From Command Line​

  1. Ensure there is an appropriate S3 bucket, SNS topic, and IAM role per the AWS Config Service prerequisites.
  2. Run this command to create a new configuration recorder:
aws configservice put-configuration-recorder --configuration-recorder name=default,roleARN=arn:aws:iam::012345678912:role/myConfigRole --recording-group allSupported=true,includeGlobalResourceTypes=true

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Config.1] AWS Config should be enabled and use the service-linked role for resource recording1no data
💼 CIS AWS v1.2.0 → 💼 2.5 Ensure AWS Config is enabled in all regions1no data
💼 CIS AWS v1.3.0 → 💼 3.5 Ensure AWS Config is enabled in all regions1no data
💼 CIS AWS v1.4.0 → 💼 3.5 Ensure AWS Config is enabled in all regions1no data
💼 CIS AWS v1.5.0 → 💼 3.5 Ensure AWS Config is enabled in all regions - Level 2 (Automated)1no data
💼 CIS AWS v2.0.0 → 💼 3.5 Ensure AWS Config is enabled in all regions - Level 2 (Automated)1no data
💼 CIS AWS v3.0.0 → 💼 3.3 Ensure AWS Config is enabled in all regions - Level 2 (Automated)1no data
💼 CIS AWS v4.0.0 → 💼 3.3 Ensure AWS Config is enabled in all regions (Automated)1no data
💼 CIS AWS v4.0.1 → 💼 3.3 Ensure AWS Config is enabled in all regions (Automated)1no data
💼 CIS AWS v5.0.0 → 💼 3.3 Ensure AWS Config is enabled in all regions (Automated)1no data
💼 CIS AWS v6.0.0 → 💼 4.3 Ensure AWS Config is enabled in all regions (Automated)1no data
💼 Cloudaware Framework → 💼 System Configuration45no data
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)265no data
💼 FedRAMP High Security Controls → 💼 CM-3 Configuration Change Control (M)(H)425no data
💼 FedRAMP High Security Controls → 💼 CM-6(1) Automated Management, Application, and Verification (M)(H)1no data
💼 FedRAMP High Security Controls → 💼 CM-8 System Component Inventory (L)(M)(H)45no data
💼 FedRAMP High Security Controls → 💼 CM-8(2) Automated Maintenance (H)1no data
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)4851no data
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)65no data
💼 FedRAMP Low Security Controls → 💼 CM-8 System Component Inventory (L)(M)(H)2no data
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)65no data
💼 FedRAMP Moderate Security Controls → 💼 CM-3 Configuration Change Control (M)(H)219no data
💼 FedRAMP Moderate Security Controls → 💼 CM-6(1) Automated Management, Application, and Verification (M)(H)1no data
💼 FedRAMP Moderate Security Controls → 💼 CM-8 System Component Inventory (L)(M)(H)25no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events145no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events85no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events142no data
💼 NIST CSF v2.0 → 💼 ID.AM-01: Inventories of hardware managed by the organization are maintained4no data
💼 NIST CSF v2.0 → 💼 ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained9no data
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked31no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation44765no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3 Configuration Change Control81725no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-6(1) Configuration Settings _ Automated Management, Application, and Verification1no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-8 System Component Inventory95no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-8(2) System Component Inventory _ Automated Maintenance1no data
💼 PCI DSS v3.2.1 → 💼 10.5.2 Protect audit trail files from unauthorized modifications.14no data
💼 PCI DSS v3.2.1 → 💼 11.5 Deploy a change-detection mechanism to alert personnel to unauthorized modification of critical system files, configuration files, or content files.12no data
💼 PCI DSS v4.0.1 → 💼 10.3.2 Audit log files are protected to prevent modifications by individuals.4no data
💼 PCI DSS v4.0.1 → 💼 11.5.2 A change-detection mechanism (for example, file integrity monitoring tools) is deployed.1no data
💼 PCI DSS v4.0 → 💼 10.3.2 Audit log files are protected to prevent modifications by individuals.24no data
💼 PCI DSS v4.0 → 💼 11.5.2 A change-detection mechanism (for example, file integrity monitoring tools) is deployed.1no data