Config global resources remediation

Using Console

Here’s how to enable AWS Config to record global resources (including Route 53) using the AWS Management Console:

Sign in and open AWS Config
- Go to the AWS Management Console.
- In the search bar, type “Config” and open AWS Config.
- Make sure you are in the desired Region (e.g., us-east-1). Global resources are still controlled per-region in Config.
Open Settings (or Set up recorder)
- If AWS Config is not yet set up:
  - Choose “Get started”.
- If AWS Config is already set up:
  - In the left navigation pane, choose “Settings”.
Enable recording of global resources
- In the Resource recording (or Recorder / Resource types to record) section:
  - Find the option “Record global resources (e.g., IAM resources)”.
  - Check or turn ON this option.
    - This is what ensures global services such as Route 53 are included.
Select resource types (if applicable)
- If you are using Record specific resource types:
  - Ensure Route 53 resource types are selected, for example:
    - AWS::Route53::HostedZone
    - AWS::Route53::HealthCheck
    - Any other Route 53 types relevant to your environment.
- If you use Record all current and future resource types:
  - Route 53 will automatically be included once global resources are enabled.
Confirm delivery channel
- In the same Settings page, confirm:
  - S3 bucket for configuration history and snapshots is set.
  - Optionally, SNS topic for notifications is set.
- These may already be configured; if not, follow the prompts to create/select them.
Save changes
- Scroll down and choose “Save” / “Save settings”.
- AWS Config will now begin recording global Route 53 resources.
Verify
- After a few minutes:
  - In AWS Config, go to “Resources”.
  - In the Resource type filter, search for Route 53 types (e.g., AWS::Route53::HostedZone).
  - Confirm your Route 53 resources are now visible and tracked.

Using CLI

To have AWS Config record global resources like Route 53, you must enable includeGlobalResourceTypes on your configuration recorder.Below are the minimal CLI steps.

1. Find your existing configuration recorder (if any)

aws configservice describe-configuration-recorders

Look for the name and current recordingGroup settings, e.g.:

{
  "ConfigurationRecorders": [
    {
      "name": "default",
      "roleARN": "arn:aws:iam::123456789012:role/aws-config-role",
      "recordingGroup": {
        "allSupported": true,
        "includeGlobalResourceTypes": false
      }
    }
  ]
}

Note the name (e.g., default) and roleARN.

2. Update the recorder to include global resources

Replace the recorder name and role ARN as appropriate:

aws configservice put-configuration-recorder \
  --configuration-recorder "name=default,roleARN=arn:aws:iam::123456789012:role/aws-config-role,recordingGroup={allSupported=true,includeGlobalResourceTypes=true}"

Key part is includeGlobalResourceTypes=true.If you prefer to record only specific resource types and include Route 53 explicitly:

aws configservice put-configuration-recorder \
  --configuration-recorder "name=default,roleARN=arn:aws:iam::123456789012:role/aws-config-role,recordingGroup={allSupported=false,includeGlobalResourceTypes=true,resourceTypes=[\"AWS::EC2::Instance\",\"AWS::S3::Bucket\"]}"

(Any value of includeGlobalResourceTypes=true will allow global resources like Route 53 to be recorded.)

3. Ensure the recorder is started

aws configservice start-configuration-recorder --configuration-recorder-name default

4. Verify the configuration

aws configservice describe-configuration-recorders

Confirm:

"recordingGroup": {
  "allSupported": true,
  "includeGlobalResourceTypes": true
}

AWS Config will now include global resources (including Route 53) in its recording.

Using Python

To record Route 53 (a global service) in AWS Config, you must enable recording of global resources in the us-east-1 region, because AWS Config treats global resources there.Below are step‑by‑step instructions plus a Python (boto3) example.

1. Prerequisites

boto3 installed:
pip install boto3
IAM permissions for:
- config:DescribeConfigurationRecorders
- config:PutConfigurationRecorder
- config:StartConfigurationRecorder
Run everything in us-east-1:
export AWS_REGION=us-east-1

2. Logic You Need

Connect to AWS Config in us-east-1.
Get existing configuration recorder.
If none exists, create one that:
- Records all supported resource types.
- Includes global resource types.
If one exists, update it to include global resources.
Start/restart the configuration recorder.

3. Python Script (boto3)

This script:

Ensures there is a recorder called default.
Sets includeGlobalResourceTypes=True (legacy style) or adjusts the recording strategy as needed.
Starts the recorder.

import boto3
from botocore.exceptions import ClientError

REGION = "us-east-1"
RECORDER_NAME = "default"

config = boto3.client("config", region_name=REGION)

def ensure_config_recorder():
    try:
        resp = config.describe_configuration_recorders()
        recorders = resp.get("ConfigurationRecorders", [])
    except ClientError as e:
        raise SystemExit(f"Error describing recorders: {e}")

    if recorders:
        recorder = recorders[0]
        name = recorder["name"]
        role_arn = recorder["roleARN"]
        # Legacy style properties
        recording_group = recorder.get("recordingGroup", {})

        # Ensure we record all supported + global resources
        recording_group["allSupported"] = True
        recording_group["includeGlobalResourceTypes"] = True

        try:
            config.put_configuration_recorder(
                ConfigurationRecorder={
                    "name": name,
                    "roleARN": role_arn,
                    "recordingGroup": recording_group
                }
            )
            print(f"Updated recorder '{name}' to include global resources.")
        except ClientError as e:
            raise SystemExit(f"Error updating recorder: {e}")
    else:
        # You must supply an IAM role ARN that AWS Config can assume
        role_arn = "arn:aws:iam::<ACCOUNT_ID>:role/<AWS_Config_Service_Role>"

        try:
            config.put_configuration_recorder(
                ConfigurationRecorder={
                    "name": RECORDER_NAME,
                    "roleARN": role_arn,
                    "recordingGroup": {
                        "allSupported": True,
                        "includeGlobalResourceTypes": True
                    }
                }
            )
            print(f"Created recorder '{RECORDER_NAME}' with global resources enabled.")
        except ClientError as e:
            raise SystemExit(f"Error creating recorder: {e}")


def start_recorder():
    try:
        config.start_configuration_recorder(
            ConfigurationRecorderName=RECORDER_NAME
        )
        print(f"Started configuration recorder '{RECORDER_NAME}'.")
    except ClientError as e:
        if e.response["Error"]["Code"] == "NoSuchConfigurationRecorderException":
            raise SystemExit("Recorder does not exist. Create it first.")
        raise SystemExit(f"Error starting recorder: {e}")


if __name__ == "__main__":
    ensure_config_recorder()
    start_recorder()

4. What This Fixes For Route 53

Route 53 is a global service.
By setting includeGlobalResourceTypes=True in us-east-1, AWS Config starts recording Route 53 resources (and other global resources like IAM), satisfying the requirement: “AWS Config Should Include Global Resources” for Route 53.

Using Terraform

resource "aws_iam_role" "config_role" {
  name = "AWSConfigRole"

  assume_role_policy = data.aws_iam_policy_document.config_assume_role_policy.json
}

data "aws_iam_policy_document" "config_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["config.amazonaws.com"]
    }
  }
}

resource "aws_iam_role_policy_attachment" "config_role_attach" {
  role       = aws_iam_role.config_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole"
}

resource "aws_config_configuration_recorder" "this" {
  name     = "default"
  role_arn = aws_iam_role.config_role.arn

  recording_group {
    all_supported                 = true
    include_global_resource_types = true
  }
}

resource "aws_s3_bucket" "config_bucket" {
  bucket = "AWS_CONFIG_BUCKET_NAME" # replace with your Config bucket name
}

resource "aws_config_delivery_channel" "this" {
  name           = "default"
  s3_bucket_name = aws_s3_bucket.config_bucket.bucket

  depends_on = [aws_config_configuration_recorder.this]
}

resource "aws_config_configuration_recorder_status" "this" {
  name       = aws_config_configuration_recorder.this.name
  is_enabled = true
}

Replace AWS_CONFIG_BUCKET_NAME with your S3 bucket name for Config logs. Changing include_global_resource_types from false to true is an in-place update and does not force replacement of the recorder.To verify, terraform plan should show an in-place update to aws_config_configuration_recorder.this.recording_group.include_global_resource_types from false (or null) to true, with no resource recreation.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Config global resources remediation

Triage and Remediation

Remediation

1. Find your existing configuration recorder (if any)

2. Update the recorder to include global resources

3. Ensure the recorder is started

4. Verify the configuration

1. Prerequisites

2. Logic You Need

3. Python Script (boto3)

4. What This Fixes For Route 53

​Triage and Remediation

​Remediation

​1. Find your existing configuration recorder (if any)

​2. Update the recorder to include global resources

​3. Ensure the recorder is started

​4. Verify the configuration

​1. Prerequisites

​2. Logic You Need

​3. Python Script (boto3)

​4. What This Fixes For Route 53

Triage and Remediation

Remediation

1. Find your existing configuration recorder (if any)

2. Update the recorder to include global resources

3. Ensure the recorder is started

4. Verify the configuration

1. Prerequisites

2. Logic You Need

3. Python Script (boto3)

4. What This Fixes For Route 53