README.md

This component provisions AWS Config across all accounts in an AWS Organization. AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It continuously monitors and records configuration changes to your AWS resources and provides a detailed view of the relationships between those resources.

Component Features

This component is responsible for:

• Configuration Recording: Deploys Configuration Recorders in each account and region to track resource configurations
• Centralized Aggregation: Configures a designated account (typically security) as the central aggregation point for all AWS Config data
• Compliance Monitoring: Deploys conformance packs to monitor resources for compliance with best practices and industry standards (e.g., CMMC, CIS, HIPAA)
• Configuration Storage: Delivers configuration snapshots and history to a centralized S3 bucket (typically in the audit account)
• Organization-wide Conformance Packs: Deploys organization conformance packs from the management account that automatically apply to all member accounts
• SNS Topic Encryption: Creates encrypted SNS topics for AWS Config notifications (required for CMMC compliance)
• Account Verification: Optional safety check that validates Terraform is running in the correct AWS account
• Flexible Account Map: Supports both remote-state account-map lookups and static account map variables (default)

New Features

This version includes several enhancements:

• Local Conformance Pack Support: Load conformance packs from local files in addition to remote URLs. This enables custom packs, air-gapped deployments, and version-controlled compliance rules.
• Organization Conformance Packs: Deploy conformance packs organization-wide from the management account using the scope: organization setting.
• SNS Topic Encryption: Built-in support for KMS encryption of AWS Config SNS topics (sns_encryption_key_id variable) for CMMC compliance.
• Flexible Component Naming: The global_collector_component_name_pattern variable allows customization of how the component looks up the global collector region's remote state.
• GovCloud Support: Full support for AWS GovCloud regions and partitions.

Key AWS Config Capabilities

• Configuration History: Maintains a detailed history of changes to AWS resources, showing when changes were made, who made them, and what the changes were
• Configuration Snapshots: Takes periodic snapshots of resource configurations for point-in-time views
• Compliance Monitoring: Provides pre-built rules and checks for compliance with best practices and industry standards
• Relationship Mapping: Maps relationships between AWS resources to understand change impacts
• Notifications and Alerts: Sends notifications when configuration changes impact compliance or security posture

Architecture

The component deploys a multi-account, multi-region architecture:

┌─────────────────────────────────────────────────────────────────────────────┐
│                           AWS Organization                                   │
│                                                                              │
│  ┌────────────────────────────────────────────────────────────────────────┐ │
│  │ Management Account (Organization Conformance Packs)                    │ │
│  │  - Deploys organization-wide conformance packs                         │ │
│  │  - Packs automatically apply to all member accounts                    │ │
│  └────────────────────────────────────────────────────────────────────────┘ │
│                                                                              │
│  ┌────────────────────────────────────────────────────────────────────────┐ │
│  │ Security Account (Central Aggregator)                                  │ │
│  │  - AWS Config Aggregator (collects from ALL accounts)                  │ │
│  │  - Centralized compliance dashboard                                    │ │
│  └────────────────────────────────────────────────────────────────────────┘ │
│                              ▲ ▲ ▲                                          │
│                              │ │ │ Aggregate Authorizations                 │
│                              │ │ │                                          │
│  ┌────────────────────────────────────────────────────────────────────────┐ │
│  │ Audit Account                                                          │ │
│  │  - S3 Bucket (aws-config-bucket)                                       │ │
│  │  - Stores ALL Config data from all accounts ◄───────────────┐          │ │
│  └──────────────────────────────────────────────────────────────│──────────┘ │
│                                                                  │           │
│  ┌────────────────────────────────────────────────────────────┐ │           │
│  │ Each Member Account                                        │ │           │
│  │                                                            │ │           │
│  │  Global Collector Region (e.g., us-east-1):               │ │           │
│  │    ✓ Configuration Recorder                               │ │           │
│  │    ✓ IAM Role (created once per account)                  │ │           │
│  │    ✓ Tracks global resources (IAM, Route53, etc.)         │ │           │
│  │    ✓ Aggregate Authorization → Security Account           │─┘           │
│  │    ✓ Delivery Channel → S3 Bucket (audit) ────────────────────────────────┘
│  │                                                            │              │
│  │  Additional Regions (e.g., us-west-2):                    │              │
│  │    ✓ Configuration Recorder                               │              │
│  │    ✓ References IAM Role from global collector region     │              │
│  │    ✓ Tracks regional resources (EC2, VPC, RDS, etc.)      │              │
│  │    ✓ Delivery Channel → S3 Bucket (audit) ────────────────────────────────┘
│  └────────────────────────────────────────────────────────────┘              │
│                                                                              │
└──────────────────────────────────────────────────────────────────────────────┘

Architecture Benefits

• Centralized Compliance: Security team can view all resource configurations from one account
• Cost Efficiency: Single S3 bucket for all AWS Config data (in audit account)
• Security Best Practices: Aggregation in security account aligns with AWS Well-Architected Framework
• Scalability: Easy to add new accounts and regions without changing the aggregation setup
• GovCloud Compatible: Supports AWS GovCloud regions and partitions

Tip

👽 Use Atmos with Terraform

Cloud Posse uses atmos to easily orchestrate multiple environments using Terraform.
Works with Github Actions, Atlantis, or Spacelift.

Watch demo of using Atmos with Terraform

Example of running atmos to manage infrastructure from our Quick Start tutorial.

Usage

Prerequisites

Before deploying this AWS Config component:

1. AWS Config Bucket: The aws-config-bucket component must be provisioned first in the audit account:

   atmos terraform apply aws-config-bucket -s core-use1-audit
   

2. Support IAM Role (CIS AWS Foundations 1.20): A designated support IAM role should be deployed to every account:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "AllowSupport",
         "Effect": "Allow",
         "Action": ["support:*"],
         "Resource": "*"
       },
       {
         "Sid": "AllowTrustedAdvisor",
         "Effect": "Allow",
         "Action": "trustedadvisor:Describe*",
         "Resource": "*"
       }
     ]
   }
   

3. Service Access Principals (for organization-level conformance packs): Enable trusted access for AWS Config in your organization:

   How to Verify:

   aws organizations list-aws-service-access-for-organization | grep config
   

   Enable if Disabled:

   aws organizations enable-aws-service-access --service-principal config.amazonaws.com
   aws organizations enable-aws-service-access --service-principal config-multiaccountsetup.amazonaws.com
   

   Or if using our account component, add these principals to aws_service_access_principals.

Usage

Stack Level: Regional

AWS Config is a regional service. The component must be deployed to each region where you want to track resources.

Scope Configuration

The default_scope variable controls how conformance packs are deployed:

Key Configuration Variables

Catalog Configuration

Default Configuration (stacks/catalog/aws-config/defaults.yaml)

components:
  terraform:
    aws-config/defaults:
      metadata:
        type: abstract
        component: "aws-config"
      vars:
        enabled: true
        default_scope: account
        create_iam_role: true
        az_abbreviation_type: fixed
        account_map_component_name: "account-map"
        account_map_tenant: core
        root_account_stage: root
        global_environment: gbl
        global_resource_collector_region: "us-east-1"
        central_resource_collector_account: security
        config_bucket_component_name: "aws-config-bucket"
        config_bucket_tenant: core
        config_bucket_env: ue1
        config_bucket_stage: audit
        sns_encryption_key_id: "alias/aws/sns"
        conformance_packs: []

Member Account Configuration (stacks/catalog/aws-config/member-account.yaml)

import:
  - catalog/aws-config/defaults

components:
  terraform:
    aws-config:
      metadata:
        component: "aws-config"
        inherits:
          - "aws-config/defaults"

Organization Account Configuration (stacks/catalog/aws-config/organization.yaml)

import:
  - catalog/aws-config/defaults

components:
  terraform:
    aws-config:
      metadata:
        component: "aws-config"
        inherits:
          - "aws-config/defaults"
      vars:
        default_scope: organization
        conformance_packs:
          - name: "Operational-Best-Practices-for-CIS-AWS-v1.4-Level2"
            conformance_pack: "https://raw.githubusercontent.com/awslabs/aws-config-rules/master/aws-config-conformance-packs/Operational-Best-Practices-for-CIS-AWS-v1.4-Level2.yaml"
            parameter_overrides: {}

Conformance Packs

Conformance packs define a collection of AWS Config rules for compliance monitoring. This component supports loading conformance packs from both remote URLs and local files.

Local File Support (New Feature)

The component now supports loading conformance packs from the local filesystem in addition to remote URLs. This enables:

• Custom conformance packs: Create organization-specific compliance rules
• Modified AWS packs: Customize AWS-provided packs for your requirements
• Air-gapped environments: Deploy in environments without internet access
• Version control: Track conformance pack changes alongside infrastructure code

The component automatically detects whether the conformance_pack value is a URL (starts with http:// or https://) or a local file path. Local paths are resolved relative to the component's root directory.

Conformance Pack Examples

conformance_packs:
  # Remote URL (AWS Labs managed packs)
  - name: "CIS-AWS-v1.4-Level2"
    conformance_pack: "https://raw.githubusercontent.com/awslabs/aws-config-rules/master/aws-config-conformance-packs/Operational-Best-Practices-for-CIS-AWS-v1.4-Level2.yaml"
    parameter_overrides:
      AccessKeysRotatedParamMaxAccessKeyAge: "45"

  # Local file (relative to component directory)
  - name: "Custom-CMMC-Pack"
    conformance_pack: "conformance-packs/custom-cmmc-pack.yaml"
    parameter_overrides: {}

  # Another local file example
  - name: "CMMC-Level2-Best-Practices"
    conformance_pack: "conformance-packs/cmmc-l2-v2-AWS-Best-Practices.yaml"
    parameter_overrides:
      IamPasswordPolicyParamMaxPasswordAge: "60"

  # Override scope for specific pack
  - name: "Org-Wide-Security-Pack"
    conformance_pack: "https://example.com/pack.yaml"
    scope: "organization"  # Override default_scope
    parameter_overrides: {}

Creating Custom Conformance Packs

To create a custom conformance pack:

1. Create a conformance-packs/ directory in your component:

   components/terraform/aws-config/
   ├── conformance-packs/
   │   ├── custom-security-rules.yaml
   │   └── cmmc-l2-v2-customized.yaml
   ├── main.tf
   ├── variables.tf
   └── ...
   

2. Define rules in CloudFormation format:

   # conformance-packs/custom-security-rules.yaml
   Parameters:
     MaxAccessKeyAge:
       Default: '90'
       Type: String
   Resources:
     AccessKeysRotated:
       Type: AWS::Config::ConfigRule
       Properties:
         ConfigRuleName: custom-access-keys-rotated
         InputParameters:
           maxAccessKeyAge:
             Ref: MaxAccessKeyAge
         Source:
           Owner: AWS
           SourceIdentifier: ACCESS_KEYS_ROTATED
   

3. Reference the local file in your configuration:

   conformance_packs:
     - name: "Custom-Security-Rules"
       conformance_pack: "conformance-packs/custom-security-rules.yaml"
       parameter_overrides:
         MaxAccessKeyAge: "45"
   

SNS Topic Encryption

AWS Config creates an SNS topic for notifications. For CMMC compliance, this topic must be encrypted:

# Option 1: AWS Managed Key (Recommended)
sns_encryption_key_id: "alias/aws/sns"

# Option 2: Customer Managed KMS Key
sns_encryption_key_id: "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"

Deployment

Provisioning Order

Step 1: Deploy to Member Accounts (Global Collector Region First)

All member accounts can be deployed in parallel:

# Core tenant accounts
atmos terraform apply aws-config -s core-use1-audit
atmos terraform apply aws-config -s core-use1-security
atmos terraform apply aws-config -s core-use1-network
atmos terraform apply aws-config -s core-use1-identity
atmos terraform apply aws-config -s core-use1-dns
atmos terraform apply aws-config -s core-use1-automation

# Platform tenant accounts (if applicable)
atmos terraform apply aws-config -s plat-use1-dev
atmos terraform apply aws-config -s plat-use1-staging
atmos terraform apply aws-config -s plat-use1-prod

Step 2: Deploy to Organization/Management Account (LAST)

atmos terraform apply aws-config -s core-use1-root

Multi-Region Deployment

AWS Config is regional. For multi-region coverage, deploy to each region:

How Multi-Region Works

• Global Collector Region (e.g., us-east-1): Creates the IAM role, tracks global resources
• Additional Regions (e.g., us-west-2): References IAM role via remote state, tracks regional resources only

Prerequisites for Additional Regions

Add the aws-config import to regional baseline files:

# stacks/orgs/acme/core/security/us-west-2/baseline.yaml
import:
  - orgs/acme/core/security/_defaults
  - mixins/region/us-west-2
  - catalog/aws-config/member-account  # Add this

Deploy Additional Regions

Follow the same order: member accounts first, then organization account.

# Step 1: Member accounts in us-west-2
atmos terraform apply aws-config -s core-usw2-audit
atmos terraform apply aws-config -s core-usw2-security
# ... all other member accounts

# Step 2: Organization account in us-west-2 (LAST)
atmos terraform apply aws-config -s core-usw2-root

Known Issues and False Positives

IAM Inline Policy Check - Service-Linked Roles

The IAM_NO_INLINE_POLICY_CHECK rule flags AWS Service-Linked Roles (SLRs) as NON_COMPLIANT. This is a known false positive.

Why This Happens:

• AWS Service-Linked Roles are automatically created and managed by AWS services
• These roles must have inline policies by AWS design
• The rule cannot distinguish between user-created roles and AWS-managed SLRs

Common SLRs That Trigger This Finding:

Recommended Action:

• Document these as accepted false positives
• Focus remediation on NON_COMPLIANT findings for user-created roles (not starting with AWSServiceRole)
• Validate findings with: aws iam get-role --role-name <role> --query 'Role.Path'
  • Service-linked roles have path: /aws-service-role/<service>/

For CMMC/Compliance Auditors:

• Service-linked roles are AWS-managed and out of customer control
• CMMC framework recognizes AWS-managed resources as acceptable exceptions
• Document the exception with proper justification

Verification Commands

# Verify SNS topic encryption
aws sns get-topic-attributes \
  --topic-arn arn:aws:sns:us-east-1:123456789012:config-topic \
  --query 'Attributes.KmsMasterKeyId'

# List service-linked roles
aws iam list-roles --query 'Roles[?starts_with(RoleName, `AWSServiceRole`)].RoleName'

# Check if role is service-linked
aws iam get-role --role-name AWSServiceRoleForAmazonGuardDuty --query 'Role.Path'

Requirements

Providers

Modules

Resources

Inputs

object({
    full_account_map              = map(string)
    audit_account_account_name    = optional(string, "")
    root_account_account_name     = optional(string, "")
    identity_account_account_name = optional(string, "")
    aws_partition                 = optional(string, "aws")
    iam_role_arn_templates        = optional(map(string), {})
  })

{
  "audit_account_account_name": "",
  "aws_partition": "aws",
  "full_account_map": {},
  "iam_role_arn_templates": {},
  "identity_account_account_name": "",
  "root_account_account_name": ""
}

list(object({
    name                = string
    conformance_pack    = string
    parameter_overrides = map(any)
    scope               = optional(string, null)
  }))

{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "descriptor_formats": {},
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_key_case": null,
  "label_order": [],
  "label_value_case": null,
  "labels_as_tags": [
    "unset"
  ],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {},
  "tenant": null
}

[
  "default"
]

managed_rules = {
  access-keys-rotated = {
    identifier  = "ACCESS_KEYS_ROTATED"
    description = "Checks whether the active access keys are rotated within the number of days specified in maxAccessKeyAge. The rule is NON_COMPLIANT if the access keys have not been rotated for more than maxAccessKeyAge number of days."
    input_parameters = {
      maxAccessKeyAge : "90"
    }
    enabled = true
    tags = {}
  }
}

map(object({
    description      = string
    identifier       = string
    input_parameters = any
    tags             = map(string)
    enabled          = bool
  }))

Outputs

Related Projects

Check out these related projects.

• Cloud Posse Terraform Modules - Our collection of reusable Terraform modules used by our reference architectures.
• Atmos - Atmos is like docker-compose but for your infrastructure

References

For additional context, refer to some of these links.

• AWS Config Documentation - Official AWS Config documentation
• CloudPosse terraform-aws-config Module - The underlying Terraform module used by this component
• Conformance Packs Documentation - AWS documentation for conformance packs
• AWS Managed Sample Conformance Packs - Pre-built conformance packs for CIS, HIPAA, NIST, PCI-DSS, and more
• AWS Config Managed Rules - List of all AWS managed Config rules
• AWS Service-Linked Roles - Understanding AWS service-linked roles and their inline policies
• Organization Conformance Packs - Deploying conformance packs across an AWS Organization
• Multi-Account Multi-Region Data Aggregation - Setting up AWS Config aggregators across accounts and regions
• CIS AWS Foundations Benchmark - CIS benchmark controls for AWS
• CMMC Compliance on AWS - AWS resources for CMMC compliance

✨ Contributing

This project is under active development, and we encourage contributions from our community.

Many thanks to our outstanding contributors:

For 🐛 bug reports & feature requests, please use the issue tracker.

In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.

1. Review our Code of Conduct and Contributor Guidelines.
2. Fork the repo on GitHub
3. Clone the project to your own machine
4. Commit changes to your own branch
5. Push your work back up to your fork
6. Submit a Pull Request so that we can review your changes

NOTE: Be sure to merge the latest changes from "upstream" before making a pull request!

Running Terraform Tests

We use Atmos to streamline how Terraform tests are run. It centralizes configuration and wraps common test workflows with easy-to-use commands.

All tests are located in the test/ folder.

Under the hood, tests are powered by Terratest together with our internal Test Helpers library, providing robust infrastructure validation.

Setup dependencies:

• Install Atmos (installation guide)
• Install Go 1.24+ or newer
• Install Terraform or OpenTofu

To run tests:

• Run all tests:

  atmos test run
  

• Clean up test artifacts:

  atmos test clean
  

• Explore additional test options:

  atmos test --help
  

The configuration for test commands is centrally managed. To review what's being imported, see the atmos.yaml file.

Learn more about our automated testing in our documentation or implementing custom commands with atmos.

🌎 Slack Community

Join our Open Source Community on Slack. It's FREE for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build totally sweet infrastructure.

📰 Newsletter

Sign up for our newsletter and join 3,000+ DevOps engineers, CTOs, and founders who get insider access to the latest DevOps trends, so you can always stay in the know. Dropped straight into your Inbox every week — and usually a 5-minute read.

📆 Office Hours

Join us every Wednesday via Zoom for your weekly dose of insider DevOps trends, AWS news and Terraform insights, all sourced from our SweetOps community, plus a live Q&A that you can’t find anywhere else. It's FREE for everyone!

License

Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements.  See the NOTICE file
distributed with this work for additional information
regarding copyright ownership.  The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License.  You may obtain a copy of the License at

  https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied.  See the License for the
specific language governing permissions and limitations
under the License.

Trademarks

All other trademarks referenced herein are the property of their respective owners.

Copyright © 2017-2026 Cloud Posse, LLC