Posted On: Apr 3, 2024
Amazon Config lets you assess, audit, and evaluate how your resources are configured, and helps you determine your overall compliance against the configurations specified in your internal guidelines. You can use Amazon Config aggregators to collect your configuration and compliance data from the below sources, and aggregate that data into a single account and Amazon Web Services Region to get a centralized view of your resource inventory and compliance.
1. Multiple accounts and multiple regions.
2. A single account and multiple regions.
3. An organization in Amazon Organizations and all the accounts in the organization that have Amazon Config enabled.
Starting today, in addition to the management account, you can use a delegated administrator account to aggregate data from all member accounts of an organization in Amazon Organizations without any additional authorization. This capability provides more flexibility as it enables different teams within an organization, such as auditing, security, and compliance to use separate accounts and to aggregate organization-wide data in their respective administration accounts for centralized governance. This also enables the separation of duties within an organization and eliminates the need for those teams to gain access to the management account to access the aggregated data.
You can get started by registering a member account of your organization as a delegated administrator account using the RegisterDelegatedAdministrator API. You can deploy Amazon Config rules across your organization and use the Amazon Config console or APIs to create an aggregator to collect data from all member accounts and aggregate the data into that delegated administrator account.
This feature is available in Amazon Web Services China (Beijing) Region, operated by Sinnet and Amazon Web Services China (Ningxia) Region, operated by NWCD. For more information about Amazon Config and the Aggregators feature, see the Amazon Config webpage and the Amazon Config Developer Guide.