Back to Checks
aws

AWS Config recorder uses the AWSServiceRoleForConfig service-linked role

config_recorder_using_aws_service_role
Service: configSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

AWS Config recorders are evaluated for use of the service‑linked IAM role AWSServiceRoleForConfig linked to config.amazonaws.com rather than a custom role.

The evaluation inspects active recorders and their role ARN to confirm the AWS‑managed service‑linked role is in use.

Prowler logoProwlerprowler-provider-aws

Risk

Using a custom or incorrect role can break recording or create blind spots, undermining the integrity and availability of configuration history. Over‑privileged roles weaken least privilege, increasing risk of unauthorized access, stealthy changes, and delayed incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks config_recorder_using_aws_service_role

Recommendation

Use the AWS‑managed service‑linked role AWSServiceRoleForConfig for all recorders to enforce least privilege and consistent trust.

Avoid custom roles; restrict who can modify the recorder or role; monitor for drift and ensure recording remains enabled as part of defense in depth.

Remediation

CLI

aws configservice put-configuration-recorder --configuration-recorder name=<RECORDER_NAME>,roleARN=arn:<PARTITION>:iam::<ACCOUNT_ID>:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig

Terraform

resource "aws_config_configuration_recorder" "example_resource" {
  name     = "example_resource"
  role_arn = "arn:<PARTITION>:iam::<ACCOUNT_ID>:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig"  # This line fixes the security issue
}

NativeIaC

Resources:
  example_resource:
    Type: AWS::Config::ConfigurationRecorder
    Properties:
      Name: example_resource
      RoleARN: arn:<PARTITION>:iam::<ACCOUNT_ID>:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig  # This line fixes the security issue

Other

1Open the AWS Console and go to AWS Config
2Choose Settings (or Recording) and click Edit
3For IAM role, select Use service-linked role (AWSServiceRoleForConfig)
4Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.config.config_client import config_client


class config_recorder_using_aws_service_role(Check):
    def execute(self):
        findings = []
        for recorder in config_client.recorders.values():
            if recorder.name and recorder.recording:
                report = Check_Report_AWS(metadata=self.metadata(), resource=recorder)
                report.resource_arn = config_client._get_recorder_arn_template(
                    recorder.region
                )
                if (
                    recorder.role_arn
                    == f"arn:{config_client.audited_partition}:iam::{config_client.audited_account}:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig"
                ):
                    report.status = "PASS"
                    report.status_extended = f"AWS Config recorder {recorder.name} is using AWSServiceRoleForConfig."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"AWS Config recorder {recorder.name} is not using AWSServiceRoleForConfig."

                findings.append(report)

        return findings

References