View a markdown version of this page

Step 1: Create an Amazon Config connector (optional) - Amazon Systems Manager
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Step 1: Create an Amazon Config connector (optional)

Complete this step only if you want Amazon Config to record the connector's GCP resources. If you don't, skip to Step 2. The Amazon Config connector uses workload identity federation to let Amazon Config record GCP resource state. Create it before you create the Systems Manager Cloud Connector. Amazon Config allows one Config connector per host project. If your host project already has one, skip this step and use that connector's ARN in Step 2. When you use the Amazon Web Services Management Console, it detects and reuses an existing Config connector for the host project.

Note

The Amazon Config connector automatically creates a service-linked role for federation. You do not need to create a separate IAM role for this step.

To create an Amazon Config connector for GCP

  1. Create the Amazon Config connector. Replace WORKLOAD_IDENTITY_POOL_PROVIDER with the full resource name (projects/HOST_PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID), CONFIG_SERVICE_ACCOUNT_EMAIL with the Amazon Config service account email (aws-config-ACCOUNT_ID@HOST_PROJECT_ID.iam.gserviceaccount.com), and ORGANIZATION_ID with the numeric organization ID.

    aws configservice put-connector \
    --connector-configuration '{
        "gcp": {
            "workloadIdentityPoolProvider": "WORKLOAD_IDENTITY_POOL_PROVIDER",
            "serviceAccountEmail": "CONFIG_SERVICE_ACCOUNT_EMAIL",
            "gcpOrganizationId": "ORGANIZATION_ID"
        }
    }'

    Include gcpOrganizationId only if the host project belongs to a GCP organization. The value must match that organization. Otherwise, omit it. To check whether the host project belongs to an organization, run the following command:

    gcloud projects get-ancestors HOST_PROJECT_ID

    Note the Arn from the response – you need it in a later step.

  2. Confirm the connector was created:

    aws configservice list-connectors
    Note

    Amazon Config allows one Config connector per host project. If one already exists, put-connector returns a ConflictException. In that case, use the existing connector's ARN from list-connectors.