Config deployment via stackset failed

Question

Hey,
I tried many times to deploy custom config with specific record items (meaning, record only designated resources i choose and not all). I get an error the the RecordingGroup isn't valid.
But, when i deploy the same cloudformation but recording all resources the stackset operation succeeded.

By any chance someone can help?
```{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Resources": {
    "ConfigRecorder": {
      "Type": "AWS::Config::ConfigurationRecorder",
      "Properties": {
        "RecordingGroup": {
          "AllSupported": false,
          "IncludeGlobalResourceTypes": true,
          "ResourceTypes": [
            "AWS::EC2::Instance",
            "AWS::S3::Bucket"
          ]
        },
        "RoleARN": {
          "Fn::Sub": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig"
        },
        "RecordingMode": {
          "RecordingFrequency": "CONTINUOUS"
        }
      }
    }
  }
}
```
Error:

```
ResourceLogicalId:ConfigRecorder, ResourceType:AWS::Config::ConfigurationRecorder, ResourceStatusReason:The recording group provided is not valid (Service: AmazonConfig; Status Code: 400; Error Code: InvalidRecordingGroupException; Request ID: 4e4cf2ef-24a2-4de2-a925-0c900bfd098b; Proxy: null).
```

Riku_Kobayashi · Answer

Hello.

I tried configuring it in my environment using the same template as yours, but I couldn't configure it unless "IncludeGlobalResourceTypes" was false.  
After setting it to false and deploying the template, I was able to configure the settings as shown below. (To keep costs down, the interval has been changed to DAILY.)  
```
aws configservice describe-configuration-recorders
{
    "ConfigurationRecorders": [
        {
            "arn": "arn:aws:config:ap-northeast-1:123456789012:configuration-recorder/default/yyyyyyyyyyyyy",
            "name": "default",
            "roleARN": "arn:aws:iam::123456789012:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig",
            "recordingGroup": {
                "allSupported": false,
                "includeGlobalResourceTypes": false,
                "resourceTypes": [
                    "AWS::S3::Bucket",
                    "AWS::EC2::Instance"
                ],
                "exclusionByResourceTypes": {
                    "resourceTypes": []
                },
                "recordingStrategy": {
                    "useOnly": "INCLUSION_BY_RESOURCE_TYPES"
                }
            },
            "recordingMode": {
                "recordingFrequency": "DAILY",
                "recordingModeOverrides": [
                    {
                        "resourceTypes": [
                            "AWS::S3::Bucket",
                            "AWS::EC2::Instance"
                        ],
                        "recordingFrequency": "DAILY"
                    }
                ]
            },
            "recordingScope": "PAID"
        }
    ]
}
```

As explained in the document below, "IncludeGlobalResourceTypes" is used to also record IAM settings, so in your case I think it needs to be set to false since you are only recording S3 and EC2.  
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configurationrecorder-recordinggroup.html#cfn-config-configurationrecorder-recordinggroup-includeglobalresourcetypes  
> This option is a bundle which only applies to the global IAM resource types: IAM users, groups, roles, and customer managed policies. These global IAM resource types can only be recorded by AWS Config in Regions where AWS Config was available before February 2022. You cannot be record the global IAM resouce types in Regions supported by AWS Config after February 2022. This list where you cannot record the global IAM resource types includes the following Regions:

Config deployment via stackset failed

Add your answer

Relevant content