I’m trying to enable AWS Config in multiple AWS subaccounts (members of an AWS Organization) + enable AWS Config in multiple regions. I’ve got it working for a single region, but since the resources don’t accept Region values i’m struggling to figure out a good way to enable it in multiple regions.
I can’t just tell the Config Recorder/delivery channel/recorder status to deploy into multiple regions within the module as regions arent supported arguments in those resources.
If i declare the module multiple times, using a provider for AWS with each provider configured for a different region, i end up deploying multiple, identical, IAM resources and S3 buckets to store the Config logs. because it’ll deploy the same resources in each region, including the IAM pieces and S3 buckets. I guess this is doable but not ideal. if i deploy to every region available id end up with 22 duplicates per IAM resource type and 22 S3 buckets. per account.
Does anyone know of another alternative for how to do this that allows multiple regions to be deployed but minimizes the duplication of IAM resources and reuse of an S3 bucket?
Hi,
I’m struggling with the same issue and wondering if I could get a few tips on this please?
Thanks
Were you able to figure out a solution to this? The AWS Console supports an Org wide aggregator, but do I need a recorder and bucket in each account and region?