AWS Config Delivery Channel

This page shows how to write Terraform and CloudFormation for AWS Config Delivery Channel and write them securely.

aws_config_delivery_channel (Terraform)

The Delivery Channel in AWS Config can be configured in Terraform with the resource name aws_config_delivery_channel. The following sections describe 3 examples of how to use the resource and its parameters.

Example Usage from GitHub

resource "aws_config_delivery_channel" "main" {
  name           = var.config_name
  s3_bucket_name = var.config_s3_bucket.bucket
  s3_key_prefix  = var.config_logs_prefix
  sns_topic_arn  = aws_sns_topic.config.arn

resource "aws_config_delivery_channel" "default" {
  name           =
  s3_bucket_name =
  depends_on     = [aws_config_configuration_recorder.default]
resource "aws_config_delivery_channel" "this" {
  name           =
  s3_bucket_name = var.s3_bucket_name
  s3_key_prefix  = var.s3_key_prefix
  sns_topic_arn  = var.sns_topic_arn


Explanation in Terraform Registry

Provides an AWS Config Delivery Channel.

Note: Delivery Channel requires a Configuration Recorder to be present. Use of depends_on (as shown below) is recommended to avoid race conditions.

AWS::Config::DeliveryChannel (CloudFormation)

The DeliveryChannel in Config can be configured in CloudFormation with the resource name AWS::Config::DeliveryChannel. The following sections describe how to use the resource and its parameters.


Explanation in CloudFormation Registry

Specifies a delivery channel object to deliver configuration information to an Amazon S3 bucket and Amazon SNS topic.

Before you can create a delivery channel, you must create a configuration recorder. You can use this action to change the Amazon S3 bucket or an Amazon SNS topic of the existing delivery channel. To change the Amazon S3 bucket or an Amazon SNS topic, call this action and specify the changed values for the S3 bucket and the SNS topic. If you specify a different value for either the S3 bucket or the SNS topic, this action will keep the existing value for the parameter that is not changed.

You can have only one delivery channel per region per AWS account, and the delivery channel is required to use AWS Config.

Note AWS Config does not support the delivery channel to an Amazon S3 bucket bucket where object lock is enabled. For more information, see How S3 Object Lock works.

When you create the delivery channel, you can specify; how often AWS Config delivers configuration snapshots to your Amazon S3 bucket (for example, 24 hours), the S3 bucket to which AWS Config sends configuration snapshots and configuration history files, and the Amazon SNS topic to which AWS Config sends notifications about configuration changes, such as updated resources, AWS Config rule evaluations, and when AWS Config delivers the configuration snapshot to your S3 bucket. For more information, see Deliver Configuration Items in the AWS Config Developer Guide. Note To enable AWS Config, you must create a configuration recorder and a delivery channel. If you want to create the resources separately, you must create a configuration recorder before you can create a delivery channel. AWS Config uses the configuration recorder to capture configuration changes to your resources. For more information, see AWS::Config::ConfigurationRecorder. For more information, see Managing the Delivery Channel in the AWS Config Developer Guide.

Frequently asked questions

What is AWS Config Delivery Channel?

AWS Config Delivery Channel is a resource for Config of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.

Where can I find the example code for the AWS Config Delivery Channel?

For Terraform, the ministryofjustice/opg-aws-config-service, tmknom/example-cloud-bankruptcy-iac and niveklabs/aws source code examples are useful. See the Terraform Example section for further details.