Ensure AWS Config is enabled in all regions

AWS Remediation

Service-wide fix (recommended): deploy the same AWS Config baseline in every required region and account through your landing zone, StackSets, or account factory process.

Console

1. Open AWS Config in the affected region.
2. Go to Settings.
3. Configure recording for all required resources.
4. Include global IAM resource types if your baseline requires them.
5. Choose an approved S3 delivery bucket and optional SNS topic.
6. Start the recorder and verify it is recording.

AWS CLI

Create or update the recorder:

aws configservice put-configuration-recorder \
  --configuration-recorder name=default,roleARN=<role-arn>,recordingGroup={allSupported=true,includeGlobalResourceTypes=true}

Create or update the delivery channel:

aws configservice put-delivery-channel \
  --delivery-channel name=default,s3BucketName=<config-bucket-name>

Start the recorder:

aws configservice start-configuration-recorder \
  --configuration-recorder-name default

Validate the status:

aws configservice describe-configuration-recorder-status
aws configservice describe-configuration-recorders

Operational notes

• The older aws configservice subscribe workflow is obsolete for most modern AWS Config setups. Use put-configuration-recorder, put-delivery-channel, and start-configuration-recorder.
• AWS Config is regional. A working recorder in one region does not cover the others.
• The destination S3 bucket policy and the AWS Config service role must allow delivery or the recorder can exist without recording correctly.

References

• https://docs.aws.amazon.com/config/latest/APIReference/API_PutConfigurationRecorder.html
• https://docs.aws.amazon.com/config/latest/developerguide/managing-recorder_console-start.html
• https://docs.aws.amazon.com/config/latest/developerguide/manage-delivery-channel.html