使用 AWS re:Post 即表示您同意 AWS re:Post 使用條款
AWS re:Postre:Post

AWS Config Org Aggregator Not showing accounts or results from queries

0

Hi,

Trying to set up a Config Organization Aggregator but im not getting any results.! any idea what im missing?

We have an organization, with some security delegated to a security account (Not sure if thats whats breaking things).

When i create the aggregator in the root account is was returning an error that it couldn't connect to accounts using the default IAM so i let it create one which i can see in the root org has: AWSConfigRoleForOrganizations policy attached. This creates the aggregator But no accounts are listed from it and no results are shown from it.

As a side i tried using the security account and setting it there. But got an error saying that it isnt the root account or set up as a delegate for the service.

主題
管理與治理
標籤
AWS ConfigAWS Organizations
語言
English
AWS-User-1166501
已提問 10 個月前檢視次數 633 次
3 個答案
0
已接受的答案

Hi!

So after a 3 days suddenly everything is populated! we only have 5 accounts so really wasnt expecting it to take that long! but it is now fully working.. So good note to wait a week if you aggregator builds and doesnt generate errors!

Would have been good to have tested if the aws cli gave some helpful feedback on it, while it was connecting..

Thanks for the support options

AWS-User-1166501
已回答 10 個月前
0

Hello!

Here it is a troubleshooting documentation that can help you with this issue: https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data-troubleshooting.html

For this specific case, we can consider a couple of the following checks:

  • First of all. Is AWS Config enabled in the source accounts within your organization?
  • Have you enable trusted access in the organization? [1][2]
  • Are "all features" enabled in the organization? [3]

References: [1] https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services.html#orgs_how-to-enable-disable-trusted-access [2] https://docs.aws.amazon.com/cli/latest/reference/organizations/enable-aws-service-access.html [3] https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html

AWS
rePost-User-7204974
已回答 10 個月前
  • AWS-User-1166501
    10 個月前

    Hi,

    sorry should have clarified those.

    All accounts are built via terraform and have config enabled (We use it for other things and this is all working) the org is built via:

    resource "aws_organizations_organization" "org" {
  feature_set = "ALL"
  aws_service_access_principals = [
    "sso.amazonaws.com",
    "cloudtrail.amazonaws.com",
    "guardduty.amazonaws.com",
    "securityhub.amazonaws.com",
    "config.amazonaws.com",
    "config-multiaccountsetup.amazonaws.com",
    "member.org.stacksets.cloudformation.amazonaws.com",
    "reporting.trustedadvisor.amazonaws.com",
    "access-analyzer.amazonaws.com"
  ]

  enabled_policy_types = [
    "SERVICE_CONTROL_POLICY"
  ]
}

    which i think gives me a yes to configuring all 3 of those

  • rePost-User-7204974
    10 個月前

    Another useful check would be to determine if your organization is being governed by Control Tower. If this is the case; instead of using AWSConfigRoleForOrganizations, you must use AWSControlTowerConfigAggregatorRoleForOrganizations role.

    Besides that I will recommend to use this aws cli command for troubleshooting: https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-configuration-aggregator-sources-status.html

    Using the cli would be something like this:

    aws configservice describe-configuration-aggregator-sources-status --configuration-aggregator-name <YOUR-AGREGGATOR-NAME> ``

    If everything is working fine, Last Update Status field mus be shown in this way: "LastUpdateStatus": "SUCCEEDED"

    I would recommend to share the output of this command, to figure out, why your aggregator is not retrieving data.

0

Another useful check would be to determine if your organization is being governed by Control Tower. If this is the case; instead of using AWSConfigRoleForOrganizations, you must use AWSControlTowerConfigAggregatorRoleForOrganizations role.

Besides that I will recommend to use this aws cli command for troubleshooting: https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-configuration-aggregator-sources-status.html

Using the cli would be something like this:

aws configservice describe-configuration-aggregator-sources-status --configuration-aggregator-name <YOUR-AGREGGATOR-NAME>

If everything is working fine, Last Update Status field mus be shown in this way: "LastUpdateStatus": "SUCCEEDED"

I would recommend to share the output of this command, to figure out, why your aggregator is not retrieving data.

AWS
rePost-User-7204974
已回答 10 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋，同時有助於提問者的專業成長。

回答問題指南

相關內容