AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
insufficient permissions Config service-role
The issue commenced when attempting to set up AWS Config for all the accounts connected to AWS Control Tower. There are issues when attempting to change the IAM role for Config to service-linked role (a pre-existing role). The admin role has greedy wildcards for config resources. Could it be the case that this is clashing with control tower recorder?
- Tags
- AWS Identity and Access ManagementAWS Account ManagementAWS ConfigSecurity, Identity, & ComplianceAWS Control Tower
- Language
- English
asked a year ago218 views
- Newest
- Most votes
- Most comments
Would suggest:
- Do Not Attempt to Replace the Service-Linked Role • AWS Config must use AWSServiceRoleForConfig when managed by Control Tower. • You cannot override this with a custom role or another service-linked role.
- Check for SCPs or Guardrails • Even with AdministratorAccess, your permissions are bounded by SCPs. • Use the AWS Organizations console to inspect SCPs applied to your OU or account. • Look for any SCPs that restrict config:*, iam:PassRole, or iam:PutRolePolicy.
- Use the Default Role and Let Control Tower Manage It • If you're setting up AWS Config manually, ensure you're not duplicating what Control Tower already manages. • Let Control Tower handle the recorder and role provisioning.
- If You Must Customize, Use a Separate Account • For advanced or custom AWS Config setups, consider using a non-Control Tower-managed account to avoid these constraints.
https://docs.aws.amazon.com/config/latest/developerguide/using-service-linked-roles.html
https://docs.aws.amazon.com/config/latest/developerguide/service-linked-awsconfig-rules.html
Hey,
Hope you're keeping well.
When AWS Config is deployed through Control Tower, it must use the AWSServiceRoleForConfig service-linked role that Control Tower provisions, and you cannot replace or modify this role with another. Attempting to change it or attach custom policies can cause permission errors, especially if SCPs in AWS Organizations restrict iam:PassRole or config:* actions. In the Organizations console, review the SCPs applied to your OU or account and confirm they allow the required AWS Config actions. The safest approach is to let Control Tower manage the recorder and role, and make any custom AWS Config changes in a non-Control Tower managed account to avoid conflicts.
Thanks and regards,
Taz
answered 9 months ago
