Check ID: config_recorder_all_regions_enabled
Provider: AWS
Service: config
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: Other

​
What this check verifies

AWS accounts have AWS Config recorders active and healthy in each Region. It identifies Regions with no recorder, a disabled recorder, or a recorder in a failure state.

​
Risk

Gaps in Config recording create blind spots. Changes in unmonitored Regions aren’t captured, weakening integrity and auditability. Adversaries can alter resources or stage assets unnoticed, enabling misconfigurations and delaying incident response.

​
Recommendation

Enable AWS Config in every Region with continuous recording and maintain healthy recorder status.

​
Remediation

resource "aws_iam_service_linked_role" "example_resource" {
  aws_service_name = "config.amazonaws.com"
}

resource "aws_config_configuration_recorder" "example_resource" {
  name     = "example_resource"
  role_arn = aws_iam_service_linked_role.example_resource.arn
}

resource "aws_config_delivery_channel" "example_resource" {
  s3_bucket_name = "example_resource"
}

resource "aws_config_configuration_recorder_status" "example_resource" {
  name         = aws_config_configuration_recorder.example_resource.name
  is_recording = true  # This line fixes the security issue
  depends_on   = [aws_config_delivery_channel.example_resource]
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = config_recorder_all_regions_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks