Configuration aggregator to all regions disabled

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: ansible-aws-config-configuration-aggregator-to-all-regions-disabled

Provider: AWS

Platform: Ansible

Severity: Low

Category: Observability

Learn More

Description

AWS Config aggregators must collect configuration data from all AWS Regions to provide centralized, complete visibility of resource state. This ensures cross-region misconfigurations and compliance violations are detected.

For Ansible tasks using the community.aws.config_aggregator or aws_config_aggregator modules, set the all_aws_regions property to true under the relevant account_sources entries or the organization_source block. Resources that omit all_aws_regions or have it set to false are flagged, as they do not provide full regional coverage.

Secure examples for Ansible (account and organization sources):

- name: Create AWS Config Aggregator (account sources)
  community.aws.config_aggregator:
    name: my-config-aggregator
    account_sources:
      - account_ids: ['123456789012']
        all_aws_regions: true

- name: Create AWS Config Aggregator (organization source)
  community.aws.config_aggregator:
    name: org-config-aggregator
    organization_source:
      role_arn: arn:aws:iam::111122223333:role/ConfigAggregatorRole
      all_aws_regions: true

Compliant Code Examples

- name: Create cross-account aggregator
  community.aws.config_aggregator:
    name: test_config_rule
    state: present
    account_sources:
      account_ids:
      - 1234567890
      - 0123456789
      - 9012345678
      all_aws_regions: yes
    organization_source:
      all_aws_regions: yes

Non-Compliant Code Examples

- name: Create cross-account aggregator
  community.aws.config_aggregator:
    name: test_config_rule
    state: present
    account_sources:
      account_ids:
      - 1234567890
      - 0123456789
      - 9012345678
      all_aws_regions: no
    organization_source:
      all_aws_regions: yes
- name: Create cross-account aggregator2
  community.aws.config_aggregator:
    name: test_config_rule
    state: present
    account_sources:
      account_ids:
      - 1234567890
      - 0123456789
      - 9012345678
      all_aws_regions: yes
    organization_source:
      all_aws_regions: no