AWS Config Configuration Aggregator
This page shows how to write Terraform and CloudFormation for AWS Config Configuration Aggregator and write them securely.
aws_config_configuration_aggregator (Terraform)
The Configuration Aggregator in AWS Config can be configured in Terraform with the resource name aws_config_configuration_aggregator
. The following sections describe 5 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "aws_config_configuration_aggregator" "negative1" {
name = "example"
account_aggregation_source {
all_regions = true
resource "aws_config_configuration_aggregator" "positive1" {
name = "example"
account_aggregation_source {
all_regions = false
resource "aws_config_configuration_aggregator" "organization" {
name = "config-aggregator"
organization_aggregation_source {
all_regions = true
resource "aws_config_configuration_aggregator" "negative1" {
name = "example"
account_aggregation_source {
all_regions = true
resource "aws_config_configuration_aggregator" "positive1" {
name = "example"
account_aggregation_source {
account_ids = ["123456789012"]
regions = ["us-east-2", "us-east-1", "us-west-1", "us-west-2"]
Security Best Practices for aws_config_configuration_aggregator
There is 1 setting in aws_config_configuration_aggregator that should be taken care of for security reasons. The following section explain an overview and example code.
Ensure to enable AWS Config in all Regions
It's better to enable AWS Config in all Regions. AWS Config can aggregate configurations from all regions. It will reduce the risk that unmonitored configurations might cause.
Parameters
-
arn
optional computed - string -
id
optional computed - string -
name
required - string -
tags
optional - map from string to string -
account_aggregation_source
list block-
account_ids
required - list of string -
all_regions
optional - bool -
regions
optional - list of string
-
-
organization_aggregation_source
list block-
all_regions
optional - bool -
regions
optional - list of string -
role_arn
required - string
-
Explanation in Terraform Registry
Manages an AWS Config Configuration Aggregator
AWS::Config::ConfigurationAggregator (CloudFormation)
The ConfigurationAggregator in Config can be configured in CloudFormation with the resource name AWS::Config::ConfigurationAggregator
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
Type: AWS::Config::ConfigurationAggregator
Properties:
AccountAggregationSources:
- AccountIds: !Split [",", !Ref Accounts]
AllAwsRegions: true
ConfigurationAggregatorName: !Sub ${ManagedResourcePrefix}-ConfigAggregator
Type: AWS::Config::ConfigurationAggregator
OrganizationBinding: !Ref ConfigAdminBinding
Properties:
AccountAggregationSources:
- AccountIds: Fn::EnumTargetAccounts ConfigEnableBindingPrimary '${account}'
AwsRegions: !Ref allGovCloudRegions
Type: AWS::Config::ConfigurationAggregator
Properties:
OrganizationAggregationSource:
RoleArn: !GetAtt ConfigAggregatorRole.Arn
AllAwsRegions: false
AwsRegions: !Ref Regions
Type: 'AWS::Config::ConfigurationAggregator'
Properties:
AccountAggregationSources:
- AccountIds:
- !Ref AggregatorAccountId
- !Ref MemberAccountId
Type: AWS::Config::ConfigurationAggregator
Properties:
AccountAggregationSources:
- AccountIds: !Ref SourceAccounts
AllAwsRegions: True
ConfigurationAggregatorName: ConfigurationAggregator
"Type": "AWS::Config::ConfigurationAggregator",
"Properties": {
"AccountAggregationSources": [
{
"AccountIds": [
"123456789012",
"Type": "AWS::Config::ConfigurationAggregator",
"Properties": {
"AccountAggregationSources": [
{
"AccountIds": [
"123456789012",
"Type": "AWS::Config::ConfigurationAggregator",
"Properties": {
"AccountAggregationSources": [
{
"AccountIds": [
"123456789012",
"Type": "AWS::Config::ConfigurationAggregator",
"Properties": {
"AccountAggregationSources": [
{
"AccountIds": [
"123456789012",
"Type": "AWS::Config::ConfigurationAggregator",
"Properties": {
"AccountAggregationSources": [
{
"AccountIds": [
"123456789012",
Parameters
-
AccountAggregationSources
optional - List of AccountAggregationSource -
ConfigurationAggregatorName
optional - String -
OrganizationAggregationSource
optional - OrganizationAggregationSource -
Tags
optional - List of Tag
Explanation in CloudFormation Registry
The details about the configuration aggregator, including information about source accounts, regions, and metadata of the aggregator.
Frequently asked questions
What is AWS Config Configuration Aggregator?
AWS Config Configuration Aggregator is a resource for Config of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.
Where can I find the example code for the AWS Config Configuration Aggregator?
For Terraform, the leonidweinbergcx/mykics, leonidweinbergcx/mykics and ifunky/terraform-generator source code examples are useful. See the Terraform Example section for further details.
For CloudFormation, the matsuura0831/aws, org-formation/org-formation-us-gov-cloud-reference and takomo-io/takomo-organization source code examples are useful. See the CloudFormation Example section for further details.