How to disable Config Mandatory Control

1. Disabling Config Recordings for Specific Accounts

AWS Control Tower uses Service Control Policies (SCPs) to enforce governance and compliance across member accounts in your organization. If you want to disable AWS Config recordings for specific accounts, you generally need to manage this through SCPs. However, directly modifying SCPs attached to OUs (Organizational Units) managed by Control Tower is not recommended due to potential unintended consequences, such as controls entering an unknown state.

Understanding SCPs in AWS Control Tower:

Service Control Policies (SCPs): These are policy documents that specify the maximum permissions for AWS accounts in your organization. SCPs can either allow or deny access to AWS services or actions.

**Control Tower and SCPs: **AWS Control Tower uses SCPs to enforce governance and compliance. SCPs are applied at the organization root or specific OUs, controlling what actions accounts within those OUs can perform.

Addressing Your Concerns:

Bypassing SCPs for Config Recordings:

AWS Control Tower typically applies a set of SCPs that enforce AWS Config recordings to ensure compliance and governance.

Directly modifying these SCPs can lead to controls entering an unknown state, which means the expected governance and compliance mechanisms may no longer function correctly.

Alternative Approach:

Instead of modifying SCPs, consider adjusting AWS Config settings directly within each AWS account:

Log in to each AWS account where you want to disable Config recordings.

Navigate to AWS Config service settings and disable recording configurations.

This approach avoids modifying SCPs and their intended governance controls enforced by AWS Control Tower.

Risk and Compliance Considerations:

Disabling Config recordings may affect your ability to track and audit changes to AWS resources, impacting compliance and security auditing requirements. Ensure any changes align with your organization's risk management and compliance policies.