Check AWS Config Is Recording in Every Region

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadConfigCoverage",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "config:DescribeConfigurationRecorders",
        "config:DescribeConfigurationRecorderStatus",
        "config:DescribeDeliveryChannels",
        "config:DescribeDeliveryChannelStatus",
        "config:ListConfigurationRecorders"
      ],
      "Resource": "*"
    }
  ]
}

// check-aws-config-enabled-in-all-regions.ts
// Reports, for every enabled Region, whether the customer managed AWS Config recorder exists, is
// recording, what it records (all types, exclusions or a list; IAM global types; frequency) and
// whether a delivery channel is delivering. Also counts service-linked recorders. Read-only.
// Usage: npx tsx check-aws-config-enabled-in-all-regions.ts [--regions=us-east-1,eu-west-1]
import { EC2Client, DescribeRegionsCommand } from "@aws-sdk/client-ec2";
import {
  ConfigServiceClient,
  DescribeConfigurationRecordersCommand,
  DescribeConfigurationRecorderStatusCommand,
  DescribeDeliveryChannelsCommand,
  DescribeDeliveryChannelStatusCommand,
  paginateListConfigurationRecorders,
  type RecordingGroup,
} from "@aws-sdk/client-config-service";

const regionArg = process.argv.slice(2).find((a) => a.startsWith("--regions="))?.split("=")[1];
const IAM_TYPES: string[] = ["AWS::IAM::User", "AWS::IAM::Group", "AWS::IAM::Role", "AWS::IAM::Policy"];

interface Row {
  Region: string;
  Recorder: string;
  Recording: string;
  Scope: string;
  IamGlobal: boolean;
  Frequency: string;
  Channel: string;
  LastDelivery: string;
  ServiceLinked: number;
  Verdict: string;
}

async function listRegions(): Promise<string[]> {
  if (regionArg) return regionArg.split(",").map((r) => r.trim()).filter(Boolean);
  const out = await new EC2Client({}).send(new DescribeRegionsCommand({})); // enabled Regions only
  return (out.Regions ?? []).map((r) => r.RegionName ?? "").filter(Boolean).sort();
}

// Works out the effective recording strategy, including the older allSupported-only form.
function describeScope(g: RecordingGroup | undefined): { scope: string; full: boolean; iam: boolean } {
  const strategy = g?.recordingStrategy?.useOnly ?? (g?.allSupported ? "ALL_SUPPORTED_RESOURCE_TYPES" : "INCLUSION_BY_RESOURCE_TYPES");
  if (strategy === "ALL_SUPPORTED_RESOURCE_TYPES") {
    return { scope: "all types", full: true, iam: g?.includeGlobalResourceTypes === true };
  }
  if (strategy === "EXCLUSION_BY_RESOURCE_TYPES") {
    const excluded: string[] = g?.exclusionByResourceTypes?.resourceTypes ?? [];
    return { scope: `all except ${excluded.length}`, full: false, iam: IAM_TYPES.some((t) => !excluded.includes(t)) };
  }
  const included: string[] = g?.resourceTypes ?? [];
  return { scope: `only ${included.length} types`, full: false, iam: IAM_TYPES.some((t) => included.includes(t)) };
}

async function checkRegion(region: string): Promise<Row> {
  const cfg = new ConfigServiceClient({ region });
  // Without a name, these calls return the customer managed recorder (at most one per Region).
  const recorder = (await cfg.send(new DescribeConfigurationRecordersCommand({}))).ConfigurationRecorders?.[0];
  const status = (await cfg.send(new DescribeConfigurationRecorderStatusCommand({}))).ConfigurationRecordersStatus?.[0];
  const channel = (await cfg.send(new DescribeDeliveryChannelsCommand({}))).DeliveryChannels?.[0];
  const channelStatus = (await cfg.send(new DescribeDeliveryChannelStatusCommand({}))).DeliveryChannelsStatus?.[0];

  let serviceLinked = 0;
  for await (const page of paginateListConfigurationRecorders({ client: cfg }, {})) {
    serviceLinked += (page.ConfigurationRecorderSummaries ?? []).filter((r) => r.servicePrincipal).length;
  }

  const { scope, full, iam } = describeScope(recorder?.recordingGroup);
  const history = channelStatus?.configHistoryDeliveryInfo;
  const lastDelivery = history?.lastStatus ?? "-";
  const verdict = !recorder ? "NOT ENABLED"
    : !status?.recording ? "RECORDER STOPPED"
    : status.lastStatus === "Failure" ? `FAILING: ${status.lastErrorCode ?? "unknown error"}`
    : !channel ? "NO DELIVERY CHANNEL"
    : lastDelivery === "Failure" ? `DELIVERY FAILING: ${history?.lastErrorCode ?? "unknown"}`
    : !full ? "recording, partial scope"
    : "ok";

  return {
    Region: region,
    Recorder: recorder?.name ?? "-",
    Recording: recorder ? (status?.recording ? "yes" : "NO") : "-",
    Scope: recorder ? scope : "-",
    IamGlobal: recorder !== undefined && iam,
    Frequency: recorder?.recordingMode?.recordingFrequency ?? (recorder ? "not set" : "-"),
    Channel: channel?.s3BucketName ?? "-",
    LastDelivery: lastDelivery,
    ServiceLinked: serviceLinked,
    Verdict: verdict,
  };
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for (const region of await listRegions()) {
    try {
      rows.push(await checkRegion(region));
    } catch (err) {
      rows.push({ Region: region, Recorder: "?", Recording: "?", Scope: "?", IamGlobal: false, Frequency: "?", Channel: "?", LastDelivery: "?", ServiceLinked: 0, Verdict: `error: ${err instanceof Error ? err.name : String(err)}` });
    }
  }
  console.table(rows);

  const gaps = rows.filter((r) => r.Verdict !== "ok");
  const iamRegions = rows.filter((r) => r.IamGlobal && r.Recording === "yes").map((r) => r.Region);
  console.log(`${rows.length} Regions checked; ${gaps.length} not recording everything.`);
  if (iamRegions.length === 0) console.log("IAM global resource types are not recorded in any Region.");
  if (iamRegions.length > 1) console.log(`IAM global resource types are recorded in ${iamRegions.length} Regions (${iamRegions.join(", ")}): one is enough.`);
  console.log("Read-only: nothing was changed.");
  if (gaps.length) process.exitCode = 2;
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-config-service @aws-sdk/client-ec2
npm install --save-dev tsx typescript

AWS_PROFILE=readonly npx tsx check-aws-config-enabled-in-all-regions.ts

# Fail a scheduled job if any of these Regions has a gap
AWS_PROFILE=readonly npx tsx check-aws-config-enabled-in-all-regions.ts --regions=us-east-1,eu-west-1 || echo "AWS Config gap found"

┌─────────┬──────────────────┬───────────┬───────────┬─────────────────┬───────────┬──────────────┬────────────────────────────┬──────────────┬───────────────┬───────────────────────┐
│ (index) │ Region           │ Recorder  │ Recording │ Scope           │ IamGlobal │ Frequency    │ Channel                    │ LastDelivery │ ServiceLinked │ Verdict               │
├─────────┼──────────────────┼───────────┼───────────┼─────────────────┼───────────┼──────────────┼────────────────────────────┼──────────────┼───────────────┼───────────────────────┤
│ 0       │ 'ap-southeast-2' │ '-'       │ '-'       │ '-'             │ false     │ '-'          │ '-'                        │ '-'          │ 0             │ 'NOT ENABLED'         │
│ 1       │ 'eu-west-1'      │ 'default' │ 'yes'     │ 'all types'     │ true      │ 'CONTINUOUS' │ 'config-logs-123456789012' │ 'Success'    │ 1             │ 'ok'                  │
│ 2       │ 'us-east-1'      │ 'default' │ 'yes'     │ 'all types'     │ true      │ 'CONTINUOUS' │ 'config-logs-123456789012' │ 'Success'    │ 1             │ 'ok'                  │
│ 3       │ 'us-east-2'      │ 'default' │ 'NO'      │ 'all types'     │ false     │ 'DAILY'      │ 'config-logs-123456789012' │ 'Success'    │ 0             │ 'RECORDER STOPPED'    │
│ 4       │ 'us-west-2'      │ 'default' │ 'yes'     │ 'only 12 types' │ false     │ 'CONTINUOUS' │ '-'                        │ '-'          │ 0             │ 'NO DELIVERY CHANNEL' │
└─────────┴──────────────────┴───────────┴───────────┴─────────────────┴───────────┴──────────────┴────────────────────────────┴──────────────┴───────────────┴───────────────────────┘
5 Regions checked; 3 not recording everything.
IAM global resource types are recorded in 2 Regions (eu-west-1, us-east-1): one is enough.
Read-only: nothing was changed.