AWS Config recorder uses the service-linked role

Check ID: config_recorder_using_aws_service_role
Provider: AWS
Service: config
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

AWS Config recorders are evaluated for use of the service‑linked IAM role AWSServiceRoleForConfig linked to config.amazonaws.com rather than a custom role. The evaluation inspects active recorders and their role ARN to confirm the AWS‑managed service‑linked role is in use.

Risk

Using a custom or incorrect role can break recording or create blind spots, undermining the integrity and availability of configuration history. Over‑privileged roles weaken least privilege, increasing risk of unauthorized access, stealthy changes, and delayed incident response.

Recommendation

Use the AWS‑managed service‑linked role AWSServiceRoleForConfig for all recorders to enforce least privilege and consistent trust. Avoid custom roles; restrict who can modify the recorder or role; monitor for drift and ensure recording remains enabled as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws configservice put-configuration-recorder --configuration-recorder name=<RECORDER_NAME>,roleARN=arn:<PARTITION>:iam::<ACCOUNT_ID>:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig

resource "aws_config_configuration_recorder" "example_resource" {
  name     = "example_resource"
  role_arn = "arn:<PARTITION>:iam::<ACCOUNT_ID>:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig"  # This line fixes the security issue
}

Resources:
  example_resource:
    Type: AWS::Config::ConfigurationRecorder
    Properties:
      Name: example_resource
      RoleARN: arn:<PARTITION>:iam::<ACCOUNT_ID>:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig  # This line fixes the security issue

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = config_recorder_using_aws_service_role. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS Config recorder is enabled and not failing DataSync task logs to a CloudWatch Logs log group

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires