HIGH
Source
Trivy
ID
AVD-AWS-0019

Config configuration aggregator should be using all regions for source

The configuration aggregator should be configured with all_regions for the source.

This will help limit the risk of any unmonitored configuration in regions that are thought to be unused.

Impact

Sources that aren’t covered by the aggregator are not include in the configuration

Follow the appropriate remediation steps below to resolve the issue.

Set the aggregator to cover all regions

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
---
AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
Resources:
  GoodExample:
    Type: AWS::Config::ConfigurationAggregator
    Properties:
      AccountAggregationSources:
        - AllAwsRegions: true
      ConfigurationAggregatorName: "GoodAccountLevelAggregation"
  1. Log into the AWS Management Console.
  2. Select the “Services” option and search for AWS Config. Step
  3. If the AWS console redirects to “Get Started” page then the Config Service is not enabled in the selected region. Step
  4. Repeat steps number 2 - 3 to verify “Config Service” is enabled or not in the other regions.
  5. Navigate on “AWS Config” and click on the “Get Started” button. Step
  6. On the “Settings” page under the “Resource types to record” select both “Record all resources supported in this region” to track configuration changes for all AWS resource and “Include global resources” to include any type of global AWS resource such as “AWS IAM resource”.Step
  7. On the “Amazon S3 bucket” option choose either of the options available as “Create a bucket” to create a new bucket, “Choose a bucket from your account” to use an existing S3 bucket, “Choose a bucket from another account” as to use S3 bucket from another AWS account as per the requirement.Step
  8. On the “Amazon SNS topic” choose either of the options available as “Create a topic” to create a new simple notification service topic, “Choose a topic from your account” to choose the existing SNS topic and “Choose a topic from another account” to choose the “SNS Topic” from the another AWS account and in the “Topic Name” field enter an unique name for the “SNS Topic”. Step
  9. On the “AWS Config role” choose the “Use an existing AWS Config service-linked role” and click on the “Next” button.Step
  10. On the “AWS Config rules” option scroll down the page and click on the “Select All” option to select all the Config can check the configuration of the resources against rules that are defined or can select either one of them and click on the “Next” button. Step
  11. Review the changes and click on the “Confirm” button to make the necessary changes. Step
  12. Repeat steps number 5 - 11 to enable the AWS Config Service for all regions and resources in an account.

Set the aggregator to cover all regions

1
2
3
4
5
6
7
8
resource "aws_config_configuration_aggregator" "good_example" {
  name = "example"
  
  account_aggregation_source {
    account_ids = ["123456789012"]
    all_regions = true
  }
}