---
title: AWS Config should be enabled and recording in all active regions
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > AWS Config should be enabled and
  recording in all active regions
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# AWS Config should be enabled and recording in all active regions
 
## Description{% #description %}

AWS regions should have an AWS Config configuration recorder that is enabled and actively recording. AWS Config continuously records resource configurations, enabling change tracking and compliance evaluation across every region of the account. This applies equally to environments where AWS Config is deployed centrally through AWS Control Tower or Landing Zone Accelerator. This rule passes a region when a recorder there records all supported resource types (`allSupported: true`), reports `recording: true`, and has a last status of `SUCCESS`, and when at least one such recorder in the account also records global resource types (`includeGlobalResourceTypes: true`). The S3 bucket and SNS topic of the delivery channel are not evaluated by this rule and should be reviewed separately.

## Remediation{% #remediation %}

1. In the [AWS Config console](https://docs.aws.amazon.com/config/latest/developerguide/gs-console.html), select the target region, open **Settings** (or **Get Started** if no recorder exists), select **Record all resources supported in this region**, include global resources (IAM) in at least one region, and specify an S3 bucket and SNS topic for the delivery channel. In Control Tower or Landing Zone Accelerator environments, make these changes through the centralized governance framework.
1. Alternatively, create the configuration recorder and delivery channel and start recording with the AWS CLI, as described in [Setting up AWS Config with the AWS CLI](https://docs.aws.amazon.com/config/latest/developerguide/gs-cli.html).
1. Confirm that the recorder is recording, as described in [Starting the configuration recorder](https://docs.aws.amazon.com/config/latest/developerguide/managing-recorder_console-start.html).

## References{% #references %}

- [Setting up AWS Config with the console](https://docs.aws.amazon.com/config/latest/developerguide/gs-console.html)
- [Starting the configuration recorder](https://docs.aws.amazon.com/config/latest/developerguide/managing-recorder_console-start.html)
- [Setting up AWS Config with the AWS CLI](https://docs.aws.amazon.com/config/latest/developerguide/gs-cli.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)