AWS Config has a delegated administrator and an organization aggregator covering all AWS regions
config_delegated_admin_and_org_aggregator_all_regions
AWS Config has a delegated administrator registered via AWS Organizations and at least one Configuration Aggregator with an OrganizationAggregationSource that covers all AWS regions, ensuring centralized org-wide configuration visibility.
Risk
Without an org-wide AWS Config aggregator and a delegated administrator, configuration data is fragmented across accounts and regions, compliance reporting is incomplete, and drift detection is delayed. Adversaries or misconfigurations can persist in unmonitored accounts, eroding audit readiness and regulatory posture.
prowler aws --checks config_delegated_admin_and_org_aggregator_all_regions
Recommendation
Register a delegated administrator for AWS Config via AWS Organizations and create at least one Configuration Aggregator with an OrganizationAggregationSource that covers all AWS regions. This centralizes configuration data across the organization for unified compliance and audit reporting.
Remediation
aws organizations register-delegated-administrator --account-id <ADMIN_ACCOUNT_ID> --service-principal config.amazonaws.com && aws configservice put-configuration-aggregator --configuration-aggregator-name org-aggregator --organization-aggregation-source RoleArn=<ROLE_ARN>,AllAwsRegions=true
- From the AWS Organizations management account, register the delegated administrator for config.amazonaws.com
- In the delegated admin account, open AWS Config
- Create a Configuration Aggregator and select Add my organization as the source
- Enable Include all AWS Regions
- Confirm an IAM role with AWSConfigRoleForOrganizations is attached
- Verify the aggregator status reaches SUCCEEDED for all member accounts
Source Code
Resource Type
AwsConfigConfigurationAggregator
References
Related To
- config_recorder_all_regions_enabled
- guardduty_delegated_admin_enabled_all_regions