> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # AWS Config Should Include Global Resources ### More Info: Ensure that AWS Config service is configured to include Global resources in order to have complete visibility over the configuration changes made within your AWS account. Global resources are not tied to a specific AWS region and can be used in all regions. Supported Global resource types are IAM users, groups, roles and customer managed policies. ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Here’s how to enable AWS Config to record **global resources** (including Route 53) using the AWS Management Console: 1. **Sign in and open AWS Config** * Go to the AWS Management Console. * In the search bar, type **“Config”** and open **AWS Config**. * Make sure you are in the **desired Region** (e.g., us-east-1). Global resources are still controlled per-region in Config. 2. **Open Settings (or Set up recorder)** * If AWS Config is not yet set up: * Choose **“Get started”**. * If AWS Config is already set up: * In the left navigation pane, choose **“Settings”**. 3. **Enable recording of global resources** * In the **Resource recording** (or **Recorder** / **Resource types to record**) section: * Find the option **“Record global resources (e.g., IAM resources)”**. * Check or turn **ON** this option. * This is what ensures global services such as **Route 53** are included. 4. **Select resource types (if applicable)** * If you are using **Record specific resource types**: * Ensure **Route 53** resource types are selected, for example: * `AWS::Route53::HostedZone` * `AWS::Route53::HealthCheck` * Any other Route 53 types relevant to your environment. * If you use **Record all current and future resource types**: * Route 53 will automatically be included once global resources are enabled. 5. **Confirm delivery channel** * In the same Settings page, confirm: * **S3 bucket** for configuration history and snapshots is set. * Optionally, **SNS topic** for notifications is set. * These may already be configured; if not, follow the prompts to create/select them. 6. **Save changes** * Scroll down and choose **“Save” / “Save settings”**. * AWS Config will now begin recording **global Route 53 resources**. 7. **Verify** * After a few minutes: * In AWS Config, go to **“Resources”**. * In the **Resource type** filter, search for **Route 53** types (e.g., `AWS::Route53::HostedZone`). * Confirm your Route 53 resources are now visible and tracked. To have AWS Config record global resources like Route 53, you must enable **includeGlobalResourceTypes** on your configuration recorder. Below are the minimal CLI steps. *** ### 1. Find your existing configuration recorder (if any) ```bash theme={null} aws configservice describe-configuration-recorders ``` Look for the `name` and current `recordingGroup` settings, e.g.: ```json theme={null} { "ConfigurationRecorders": [ { "name": "default", "roleARN": "arn:aws:iam::123456789012:role/aws-config-role", "recordingGroup": { "allSupported": true, "includeGlobalResourceTypes": false } } ] } ``` Note the `name` (e.g., `default`) and `roleARN`. *** ### 2. Update the recorder to include global resources Replace the recorder name and role ARN as appropriate: ```bash theme={null} aws configservice put-configuration-recorder \ --configuration-recorder "name=default,roleARN=arn:aws:iam::123456789012:role/aws-config-role,recordingGroup={allSupported=true,includeGlobalResourceTypes=true}" ``` Key part is `includeGlobalResourceTypes=true`. If you prefer to record only specific resource types and include Route 53 explicitly: ```bash theme={null} aws configservice put-configuration-recorder \ --configuration-recorder "name=default,roleARN=arn:aws:iam::123456789012:role/aws-config-role,recordingGroup={allSupported=false,includeGlobalResourceTypes=true,resourceTypes=[\"AWS::EC2::Instance\",\"AWS::S3::Bucket\"]}" ``` (Any value of `includeGlobalResourceTypes=true` will allow global resources like Route 53 to be recorded.) *** ### 3. Ensure the recorder is started ```bash theme={null} aws configservice start-configuration-recorder --configuration-recorder-name default ``` *** ### 4. Verify the configuration ```bash theme={null} aws configservice describe-configuration-recorders ``` Confirm: ```json theme={null} "recordingGroup": { "allSupported": true, "includeGlobalResourceTypes": true } ``` AWS Config will now include global resources (including Route 53) in its recording. To record Route 53 (a global service) in AWS Config, you must enable recording of global resources in the **us-east-1** region, because AWS Config treats global resources there. Below are step‑by‑step instructions plus a Python (boto3) example. *** ## 1. Prerequisites * `boto3` installed: ```bash theme={null} pip install boto3 ``` * IAM permissions for: * `config:DescribeConfigurationRecorders` * `config:PutConfigurationRecorder` * `config:StartConfigurationRecorder` * Run everything in **us-east-1**: ```bash theme={null} export AWS_REGION=us-east-1 ``` *** ## 2. Logic You Need 1. Connect to AWS Config in `us-east-1`. 2. Get existing configuration recorder. 3. If none exists, create one that: * Records all supported resource types. * Includes global resource types. 4. If one exists, update it to include global resources. 5. Start/restart the configuration recorder. *** ## 3. Python Script (boto3) This script: * Ensures there is a recorder called `default`. * Sets `includeGlobalResourceTypes=True` (legacy style) or adjusts the recording strategy as needed. * Starts the recorder. ```python theme={null} import boto3 from botocore.exceptions import ClientError REGION = "us-east-1" RECORDER_NAME = "default" config = boto3.client("config", region_name=REGION) def ensure_config_recorder(): try: resp = config.describe_configuration_recorders() recorders = resp.get("ConfigurationRecorders", []) except ClientError as e: raise SystemExit(f"Error describing recorders: {e}") if recorders: recorder = recorders[0] name = recorder["name"] role_arn = recorder["roleARN"] # Legacy style properties recording_group = recorder.get("recordingGroup", {}) # Ensure we record all supported + global resources recording_group["allSupported"] = True recording_group["includeGlobalResourceTypes"] = True try: config.put_configuration_recorder( ConfigurationRecorder={ "name": name, "roleARN": role_arn, "recordingGroup": recording_group } ) print(f"Updated recorder '{name}' to include global resources.") except ClientError as e: raise SystemExit(f"Error updating recorder: {e}") else: # You must supply an IAM role ARN that AWS Config can assume role_arn = "arn:aws:iam:::role/" try: config.put_configuration_recorder( ConfigurationRecorder={ "name": RECORDER_NAME, "roleARN": role_arn, "recordingGroup": { "allSupported": True, "includeGlobalResourceTypes": True } } ) print(f"Created recorder '{RECORDER_NAME}' with global resources enabled.") except ClientError as e: raise SystemExit(f"Error creating recorder: {e}") def start_recorder(): try: config.start_configuration_recorder( ConfigurationRecorderName=RECORDER_NAME ) print(f"Started configuration recorder '{RECORDER_NAME}'.") except ClientError as e: if e.response["Error"]["Code"] == "NoSuchConfigurationRecorderException": raise SystemExit("Recorder does not exist. Create it first.") raise SystemExit(f"Error starting recorder: {e}") if __name__ == "__main__": ensure_config_recorder() start_recorder() ``` *** ## 4. What This Fixes For Route 53 * Route 53 is a **global** service. * By setting `includeGlobalResourceTypes=True` in **us-east-1**, AWS Config starts recording Route 53 resources (and other global resources like IAM), satisfying the requirement: “AWS Config Should Include Global Resources” for Route 53. ```hcl theme={null} resource "aws_iam_role" "config_role" { name = "AWSConfigRole" assume_role_policy = data.aws_iam_policy_document.config_assume_role_policy.json } data "aws_iam_policy_document" "config_assume_role_policy" { statement { actions = ["sts:AssumeRole"] principals { type = "Service" identifiers = ["config.amazonaws.com"] } } } resource "aws_iam_role_policy_attachment" "config_role_attach" { role = aws_iam_role.config_role.name policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole" } resource "aws_config_configuration_recorder" "this" { name = "default" role_arn = aws_iam_role.config_role.arn recording_group { all_supported = true include_global_resource_types = true } } resource "aws_s3_bucket" "config_bucket" { bucket = "AWS_CONFIG_BUCKET_NAME" # replace with your Config bucket name } resource "aws_config_delivery_channel" "this" { name = "default" s3_bucket_name = aws_s3_bucket.config_bucket.bucket depends_on = [aws_config_configuration_recorder.this] } resource "aws_config_configuration_recorder_status" "this" { name = aws_config_configuration_recorder.this.name is_enabled = true } ``` Replace `AWS_CONFIG_BUCKET_NAME` with your S3 bucket name for Config logs. Changing `include_global_resource_types` from `false` to `true` is an in-place update and does not force replacement of the recorder. To verify, `terraform plan` should show an in-place update to `aws_config_configuration_recorder.this.recording_group.include_global_resource_types` from `false` (or `null`) to `true`, with no resource recreation. ### Additional Reading: * [https://docs.aws.amazon.com/config/latest/developerguide/select-resources.html](https://docs.aws.amazon.com/config/latest/developerguide/select-resources.html)