Back to Checks
aws

AWS Config recorder is enabled and not in failure state or disabled

config_recorder_all_regions_enabled
Service: configSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:Other

AWS accounts have AWS Config recorders active and healthy in each Region. It identifies Regions with no recorder, a disabled recorder, or a recorder in a failure state.

Prowler logoProwlerprowler-provider-aws

Risk

Gaps in Config recording create blind spots. Changes in unmonitored Regions aren't captured, weakening integrity and auditability. Adversaries can alter resources or stage assets unnoticed, enabling misconfigurations and delaying incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks config_recorder_all_regions_enabled

Recommendation

Enable AWS Config in every Region with continuous recording and maintain healthy recorder status.

Remediation

Terraform

resource "aws_iam_service_linked_role" "example_resource" {
  aws_service_name = "config.amazonaws.com"
}

resource "aws_config_configuration_recorder" "example_resource" {
  name     = "example_resource"
  role_arn = aws_iam_service_linked_role.example_resource.arn
}

resource "aws_config_delivery_channel" "example_resource" {
  s3_bucket_name = "example_resource"
}

resource "aws_config_configuration_recorder_status" "example_resource" {
  name         = aws_config_configuration_recorder.example_resource.name
  is_recording = true  # This line fixes the security issue
  depends_on   = [aws_config_delivery_channel.example_resource]
}

NativeIaC

Resources:
  example_resource_recorder:
    Type: AWS::Config::ConfigurationRecorder
    Properties:
      Name: example_resource
      RoleARN: !Sub arn:aws:iam::${AWS::AccountId}:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig

  example_resource_channel:
    Type: AWS::Config::DeliveryChannel
    Properties:
      S3BucketName: example_resource

  example_resource_status:
    Type: AWS::Config::ConfigurationRecorderStatus
    Properties:
      Name: example_resource
      Recording: true  # This line fixes the security issue
    DependsOn:
      - example_resource_channel

Other

1In the AWS Console, go to Config
2Click Set up AWS Config (or Settings)
3Select a resource recording option (any) and choose an existing S3 bucket for delivery
4Keep the default AWSServiceRoleForConfig role
5Click Confirm/Turn on to start recording
6Verify on the Settings page that Status shows Recording and not Failure

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.config.config_client import config_client


class config_recorder_all_regions_enabled(Check):
    def execute(self):
        findings = []
        for recorder in config_client.recorders.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=recorder)
            report.resource_arn = config_client._get_recorder_arn_template(
                recorder.region
            )
            # Check if Config is enabled in region
            if not recorder.name:
                report.status = "FAIL"
                report.status_extended = "No AWS Config recorders in region."
            else:
                if recorder.recording:
                    if recorder.last_status == "Failure":
                        report.status = "FAIL"
                        report.status_extended = (
                            f"AWS Config recorder {recorder.name} in failure state."
                        )
                    else:
                        report.status = "PASS"
                        report.status_extended = (
                            f"AWS Config recorder {recorder.name} is enabled."
                        )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"AWS Config recorder {recorder.name} is disabled."
                    )
            if report.status == "FAIL" and (
                config_client.audit_config.get("mute_non_default_regions", False)
                and not recorder.region == config_client.region
            ):
                report.muted = True

            findings.append(report)

        return findings

References