AWS Control Tower - Config aggregators

Question

Hello.

I implemented Control Tower, and according to documentation https://docs.aws.amazon.com/controltower/latest/userguide/how-control-tower-works.html, a AWS Config aggregator named aws-controltower-ConfigAggregatorForOrganizations should be created in the management account.
But I dont see any aggregator or AWS Config enabled in my management account.
My version is 3.2.

Another question is, how could I implement aws config conformance packs for all my accounts? should I do from management account? but I mentioned, in management account I dont see any AWS config enabled.
Per example I would like to implement Operational Best Practices for Amazon S3

Thank you.

Accepted Answer

Hi There

#1: Where are you looking for the aggregator? If you try to see it in the Config service console, you wont be able to as AWS config is not enabled in the management account.  You can use the cli to view it:

```
[cloudshell-user@ip-1#-##-##-## ~]$ aws configservice describe-configuration-aggregators
{
    "ConfigurationAggregators": [
        {
            "ConfigurationAggregatorName": "aws-controltower-ConfigAggregatorForOrganizations",
            "ConfigurationAggregatorArn": "arn:aws:config:us-east-1:1234567890:config-aggregator/config-aggregator-9hebwzc6",
            "OrganizationAggregationSource": {
                "RoleArn": "arn:aws:iam::1234567890:role/service-role/AWSControlTowerConfigAggregatorRoleForOrganizations",
                "AllAwsRegions": true
            },
            "CreationTime": "2023-06-28T12:50:26.429000+00:00",
            "LastUpdatedTime": "2023-06-28T12:50:26.659000+00:00"
        }
    ]
}
```

#2: Please take a look at these 2 blog posts for steps to deploy conformance packs across your org using a delegated admin account
* https://aws.amazon.com/blogs/mt/extend-aws-control-tower-governance-using-aws-config-conformance-packs/
* https://aws.amazon.com/blogs/mt/deploy-aws-config-rules-and-conformance-packs-using-a-delegated-admin/

Answer

Hi,

If you have default Control tower set up, then config aggregator will be set up in an Audit account and not Management account. Hope this will help.

Answer

Hi Matt.

Using cli, I was able to see aggregator.
So, if  AWS Config is not enabled in the management account, how does an aggregator appear by cli?

Thanks.

AWS Control Tower - Config aggregators

Relevant content