AWS Config Delivery Channel

This page shows how to write Terraform and CloudFormation for AWS Config Delivery Channel and write them securely.

aws_config_delivery_channel (Terraform)

The Delivery Channel in AWS Config can be configured in Terraform with the resource name aws_config_delivery_channel. The following sections describe 3 examples of how to use the resource and its parameters.

Example Usage from GitHub

config-service.tf#L11
resource "aws_config_delivery_channel" "main" {
  name           = var.config_name
  s3_bucket_name = var.config_s3_bucket.bucket
  s3_key_prefix  = var.config_logs_prefix
  sns_topic_arn  = aws_sns_topic.config.arn

08_aws_config_delivery_channel.tf#L1
resource "aws_config_delivery_channel" "default" {
  name           = aws_config_configuration_recorder.default.name
  s3_bucket_name = module.config_log_bucket.name
  depends_on     = [aws_config_configuration_recorder.default]
}
main.tf#L7
resource "aws_config_delivery_channel" "this" {
  name           = var.name
  s3_bucket_name = var.s3_bucket_name
  s3_key_prefix  = var.s3_key_prefix
  sns_topic_arn  = var.sns_topic_arn

Review your Terraform file for AWS best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).

Parameters

Explanation in Terraform Registry

Provides an AWS Config Delivery Channel.

Note: Delivery Channel requires a Configuration Recorder to be present. Use of depends_on (as shown below) is recommended to avoid race conditions.

Tips: Best Practices for The Other AWS Config Resources

In addition to the aws_config_configuration_aggregator, AWS Config has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

risk-label

aws_config_configuration_aggregator

Ensure to enable AWS Config in all Regions

It's better to enable AWS Config in all Regions. AWS Config can aggregate configurations from all regions. It will reduce the risk that unmonitored configurations might cause.

Review your AWS Config settings

In addition to the above, there are other security points you should be aware of making sure that your .tf files are protected in Shisho Cloud.

AWS::Config::DeliveryChannel (CloudFormation)

The DeliveryChannel in Config can be configured in CloudFormation with the resource name AWS::Config::DeliveryChannel. The following sections describe 10 examples of how to use the resource and its parameters.

Example Usage from GitHub

aws-config.yml#L50
    Type: AWS::Config::DeliveryChannel
    Properties:
      ConfigSnapshotDeliveryProperties:
        DeliveryFrequency: "Six_Hours"
      S3BucketName: !Ref ConfigS3Bucket

aws-config.yml#L32
    Type: AWS::Config::DeliveryChannel
    Properties:
      Name: !Sub ${ManagedResourcePrefix}${AWS::Region}
      ConfigSnapshotDeliveryProperties:
        DeliveryFrequency: Six_Hours
      S3BucketName: !Ref BucketName
default-config.yml#L15
    Type: AWS::Config::DeliveryChannel
    Properties:
      Name: 'default-config-delivery-channel'
      ConfigSnapshotDeliveryProperties:
        DeliveryFrequency: 'One_Hour'
      S3BucketName: !Sub 'default-config-ap-southeast-1-${AWS::AccountId}'
ConfigServiceRegionalResources.yml#L15
    Type: AWS::Config::DeliveryChannel
    Properties:
      ConfigSnapshotDeliveryProperties:
        DeliveryFrequency: TwentyFour_Hours
      S3BucketName: !Sub "config-bucket-${AWS::AccountId}"
      S3KeyPrefix: !Sub "AWSLogs/${AWS::AccountId}"
configConfiguration.yml#L14
    Type: AWS::Config::DeliveryChannel
    Properties:
      ConfigSnapshotDeliveryProperties:
        DeliveryFrequency: TwentyFour_Hours
      # Name: ${self:service}
      S3BucketName: !Ref ConfigDeliveryBucket
ConfigDeliveryChannelSpecification.json#L3
    "AWS::Config::DeliveryChannel.ConfigSnapshotDeliveryProperties": {
      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-deliverychannel-configsnapshotdeliveryproperties.html",
      "Properties": {
        "DeliveryFrequency": {
          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-deliverychannel-configsnapshotdeliveryproperties.html#cfn-config-deliverychannel-configsnapshotdeliveryproperties-deliveryfrequency",
          "PrimitiveType": "String",
EnableConfig.json#L19
      "Type": "AWS::Config::DeliveryChannel",
      "Properties": {
        "Name": "default",
        "S3BucketName": "your s3 bucket"
      }
    }
Config.json#L115
  "resourceType" : "AWS::Config::DeliveryChannel",
  "properties" : [ {
    "propertyName" : "ConfigSnapshotDeliveryProperties",
    "propertyType" : "AWS::Config::DeliveryChannel::ConfigSnapshotDeliveryProperty",
    "required" : false,
    "propertyHref" : "aws-properties-config-deliverychannel-configsnapshotdeliveryproperties.html"
config.template.json#L11
      "Type": "AWS::Config::DeliveryChannel",
      "Properties": {
        "ConfigSnapshotDeliveryProperties": {
          "DeliveryFrequency": "One_Hour"
        },
        "S3BucketName": {
config.template.json#L11
      "Type": "AWS::Config::DeliveryChannel",
      "Properties": {
        "ConfigSnapshotDeliveryProperties": {
          "DeliveryFrequency": "One_Hour"
        },
        "S3BucketName": {

Parameters

Explanation in CloudFormation Registry

Specifies a delivery channel object to deliver configuration information to an Amazon S3 bucket and Amazon SNS topic.

Before you can create a delivery channel, you must create a configuration recorder. You can use this action to change the Amazon S3 bucket or an Amazon SNS topic of the existing delivery channel. To change the Amazon S3 bucket or an Amazon SNS topic, call this action and specify the changed values for the S3 bucket and the SNS topic. If you specify a different value for either the S3 bucket or the SNS topic, this action will keep the existing value for the parameter that is not changed.

You can have only one delivery channel per region per AWS account, and the delivery channel is required to use AWS Config.

Note AWS Config does not support the delivery channel to an Amazon S3 bucket bucket where object lock is enabled. For more information, see How S3 Object Lock works.

When you create the delivery channel, you can specify; how often AWS Config delivers configuration snapshots to your Amazon S3 bucket (for example, 24 hours), the S3 bucket to which AWS Config sends configuration snapshots and configuration history files, and the Amazon SNS topic to which AWS Config sends notifications about configuration changes, such as updated resources, AWS Config rule evaluations, and when AWS Config delivers the configuration snapshot to your S3 bucket. For more information, see Deliver Configuration Items in the AWS Config Developer Guide. Note To enable AWS Config, you must create a configuration recorder and a delivery channel. If you want to create the resources separately, you must create a configuration recorder before you can create a delivery channel. AWS Config uses the configuration recorder to capture configuration changes to your resources. For more information, see AWS::Config::ConfigurationRecorder. For more information, see Managing the Delivery Channel in the AWS Config Developer Guide.

Frequently asked questions

What is AWS Config Delivery Channel?

AWS Config Delivery Channel is a resource for Config of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.

Where can I find the example code for the AWS Config Delivery Channel?

For Terraform, the ministryofjustice/opg-aws-config-service, tmknom/example-cloud-bankruptcy-iac and niveklabs/aws source code examples are useful. See the Terraform Example section for further details.

For CloudFormation, the PatrickJD/AWS, takomo-io/takomo-organization and rafikurnia/matools source code examples are useful. See the CloudFormation Example section for further details.