Ensure AWS Config recorder is enabled and recording all supported resources

AWS Remediation

Service-wide fix (recommended): standardize AWS Config in every required region with the same recorder settings, delivery channel, and log bucket controls.

When to use service-wide remediation

Use the service-wide path when many accounts or regions are affected. AWS Config is a platform dependency for many compliance controls, so inconsistent regional setup creates large blind spots.

Console

1. Open AWS Config in the affected region.
2. Go to Settings.
3. Configure the recorder to record All resources.
4. Turn on global resource recording if your standard requires IAM and other global resource coverage.
5. Configure a delivery channel to an approved S3 bucket. Add SNS if your process uses notifications.
6. Start recording and confirm the recorder status is Recording.

AWS CLI

Create or update the recorder:

aws configservice put-configuration-recorder \
  --configuration-recorder name=default,roleARN=<role-arn>,recordingGroup={allSupported=true,includeGlobalResourceTypes=true}

Create or update the delivery channel:

aws configservice put-delivery-channel \
  --delivery-channel name=default,s3BucketName=<config-bucket-name>

Start recording:

aws configservice start-configuration-recorder \
  --configuration-recorder-name default

Validate status:

aws configservice describe-configuration-recorder-status
aws configservice describe-configuration-recorders

Operational notes

• The IAM role used by AWS Config must trust config.amazonaws.com and have permission to write configuration history and snapshots to the destination bucket.
• Make sure the S3 bucket policy permits AWS Config delivery from every in-scope account and region.
• If you manage multiple accounts, use StackSets, Control Tower customizations, or your landing-zone pipeline instead of fixing accounts one by one.

References

• https://docs.aws.amazon.com/config/latest/developerguide/manage-delivery-channel.html
• https://docs.aws.amazon.com/config/latest/developerguide/managing-recorder_console-start.html