3 Risposte
- Più recenti
- Maggior numero di voti
- Maggior numero di commenti
2
Hi There
#1: Where are you looking for the aggregator? If you try to see it in the Config service console, you wont be able to as AWS config is not enabled in the management account. You can use the cli to view it:
[cloudshell-user@ip-1#-##-##-## ~]$ aws configservice describe-configuration-aggregators
{
"ConfigurationAggregators": [
{
"ConfigurationAggregatorName": "aws-controltower-ConfigAggregatorForOrganizations",
"ConfigurationAggregatorArn": "arn:aws:config:us-east-1:1234567890:config-aggregator/config-aggregator-9hebwzc6",
"OrganizationAggregationSource": {
"RoleArn": "arn:aws:iam::1234567890:role/service-role/AWSControlTowerConfigAggregatorRoleForOrganizations",
"AllAwsRegions": true
},
"CreationTime": "2023-06-28T12:50:26.429000+00:00",
"LastUpdatedTime": "2023-06-28T12:50:26.659000+00:00"
}
]
}
#2: Please take a look at these 2 blog posts for steps to deploy conformance packs across your org using a delegated admin account
0
Hi Matt.
Using cli, I was able to see aggregator. So, if AWS Config is not enabled in the management account, how does an aggregator appear by cli?
Thanks.
con risposta 7 mesi fa
0
Hi,
If you have default Control tower set up, then config aggregator will be set up in an Audit account and not Management account. Hope this will help.
con risposta 2 mesi fa
Contenuto pertinente
- AWS UFFICIALEAggiornata 2 anni fa
- AWS UFFICIALEAggiornata un anno fa
- AWS UFFICIALEAggiornata 2 anni fa
- AWS UFFICIALEAggiornata 2 anni fa
The aggregator does not require the full config service to be enabled. The aggregator is only there to monitor for accounts not managed by CT.
The AWS Control Tower management account creates an organization-level aggregator, which assists in detecting external AWS Config rules, so that AWS Control Tower does not need to gain access to unmanaged accounts. The AWS Control Tower console shows you how many externally created AWS Config rules you have for a given account, and links you to the AWS Config console, where you can view details about those external rules.