Check provider logo

AWS Config recorder uses the AWSServiceRoleForConfig service-linked role

config_recorder_using_aws_service_role

Severitymedium
Serviceconfig
by Prowler
identity-access

AWS Config recorders are evaluated for use of the service‑linked IAM role AWSServiceRoleForConfig linked to config.amazonaws.com rather than a custom role.

The evaluation inspects active recorders and their role ARN to confirm the AWS‑managed service‑linked role is in use.

Risk

Using a custom or incorrect role can break recording or create blind spots, undermining the integrity and availability of configuration history. Over‑privileged roles weaken least privilege, increasing risk of unauthorized access, stealthy changes, and delayed incident response.

Run this check with Prowler CLI

prowler aws --checks config_recorder_using_aws_service_role

Run in Prowler Cloud

Recommendation

Use the AWS‑managed service‑linked role AWSServiceRoleForConfig for all recorders to enforce least privilege and consistent trust.

Avoid custom roles; restrict who can modify the recorder or role; monitor for drift and ensure recording remains enabled as part of defense in depth.

Remediation

CLI

aws configservice put-configuration-recorder --configuration-recorder name=<RECORDER_NAME>,roleARN=arn:<PARTITION>:iam::<ACCOUNT_ID>:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig

Native IAC
Resources:
  example_resource:
    Type: AWS::Config::ConfigurationRecorder
    Properties:
      Name: example_resource
      RoleARN: arn:<PARTITION>:iam::<ACCOUNT_ID>:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig  # This line fixes the security issue
Terraform
resource "aws_config_configuration_recorder" "example_resource" {
  name     = "example_resource"
  role_arn = "arn:<PARTITION>:iam::<ACCOUNT_ID>:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig"  # This line fixes the security issue
}
Other
  1. Open the AWS Console and go to AWS Config
  2. Choose Settings (or Recording) and click Edit
  3. For IAM role, select Use service-linked role (AWSServiceRoleForConfig)
  4. Save changes

Source Code

Resource Type

Other

References