Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Missing "config:DescribeComplianceByConfigRule" when enable organization conformance pack

0

While enabling organization conformance pack on delegated admin, got access denied error on missing permission"config:DescribeComplianceByConfigRule". Because it's a service linked role and AWS managed policy, there is not much we can do to address the permission. A custom role doesn't apply to this case as well.

Q suggested this could be a bug, here is what Q said:

This is genuinely a bug in AWS's managed policy that only AWS can fix: Priority: High Subject: Critical Bug - ConfigConformsServiceRolePolicy Missing Required Permissions Details:

  • Service-linked role: AWSServiceRoleForConfigConforms
  • AWS managed policy: ConfigConformsServiceRolePolicy
  • Missing permission: config: GetComplianceDetailsByConfigRule
  • Impact: OrganizationConformancePack deployments fail with AccessDenied
  • CloudTrail Event ID: This is blocking organization-wide Config conformance pack deployments. Request immediate escalation to AWS Config product team
Topics
Management & GovernanceSecurity, Identity, & Compliance
Tags
AWS Identity and Access ManagementIAM PoliciesAWS Config
Language
English

asked a year ago138 views

1 Answer
0

Based on the information provided, you're encountering an access denied error related to the "config:DescribeComplianceByConfigRule" permission when trying to enable an organization conformance pack on a delegated administrator account.

This appears to be a legitimate issue with the AWS managed policy for the service-linked role used by AWS Config. Since this is a service-linked role (AWSServiceRoleForConfigConforms) with an AWS managed policy (ConfigConformsServiceRolePolicy), you cannot modify the permissions directly.

For organization-related AWS Config operations, there are some important constraints to be aware of:

  1. Organization Config Rule and Organization Conformance Pack APIs must be called from the organization management account, not member accounts.

  2. If you're using a delegated administrator, ensure that the management account has properly registered the delegated administrator for the AWS Config service principal.

  3. The delegated administrator must have the appropriate permissions to call the necessary APIs.

Since you're encountering this issue with a service-linked role that's managed by AWS, the appropriate course of action would be to contact AWS Support to report this as a potential bug in the managed policy. They would need to add the missing permission to the ConfigConformsServiceRolePolicy.

In your support case, you should include details about:

  • The specific error message you're receiving
  • The service-linked role being used (AWSServiceRoleForConfigConforms)
  • The AWS managed policy (ConfigConformsServiceRolePolicy)
  • The missing permission (config:DescribeComplianceByConfigRule)
  • Any relevant CloudTrail logs showing the access denied error

This issue would need to be addressed by AWS directly since users cannot modify AWS managed policies for service-linked roles.
Sources
DescribeOrganizationConfigRules - AWS Config
DescribeOrganizationConfigRuleStatuses - AWS Config
GetOrganizationCustomRulePolicy - AWS Config

answered a year ago

  • Jacky
    a year ago

    The exact error message is: "errorMessage": "User: arn:aws:sts::ACCOUNT-ID:assumed-role/AWSServiceRoleForConfigConforms/AwsConfigConformsWorkflow is not authorized to perform: config:DescribeComplianceByConfigRule on resource: arn:aws:config:us-east-1:ACCOUNT-ID:config-rule/* because no identity-based policy allows the config:DescribeComplianceByConfigRule action"

    So clearly, it was the service linked role "AWSServiceRoleForConfigConforms", and the missing permission is "onfig:DescribeComplianceByConfigRule"

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content