# Using Amazon Config for resource discovery
<a name="omni-using-aws-config-for-resource-discovery"></a>

CloudWatch Omni uses Amazon Config to find the Amazon resources in your account. Omni then adds those resources to the context graph. This page lists the resource types that Amazon Config records for Omni, and describes how the recorder works.

To learn how discovered resources appear in the graph, see [Using Context Graph](omni-using-context-graph.md).

## How the recorder works
<a name="omni-using-aws-config-for-resource-discovery-how-the-recorder-works"></a>

Omni creates a *service-linked configuration recorder* when you create a space. The recorder is named `AWSConfigurationRecorderForCloudWatch`. You do not create it. You do not configure it.

A service-linked recorder belongs to the service that it is linked to. That service sets the resource types to record. To learn more, see [Working with the configuration recorder](https://docs.amazonaws.cn/config/latest/developerguide/stop-start-recorder.html) in the *Amazon Config Developer Guide*.

The recorder works as follows:
+ **You pay no Amazon Config fee.** Omni uses an internal recording scope. Amazon Config does not send these records to your delivery channel, and you cannot read them in Amazon Config. You can still see the recorder itself in the Amazon Config console.
+ **The recorder's settings are fixed.** You cannot change them in Amazon Config. You cannot rename the recorder, and you cannot start it or stop it. Omni sets which resource types the recorder records, and it records the same types in every account.
+ **You can delete the recorder, but not while a space uses it.** When you call `DeleteServiceLinkedConfigurationRecorder`, Amazon Config asks Omni whether it still uses the recorder. While your space has an active Amazon Config integration, Omni answers yes and your call fails. To remove the recorder, delete the space first.
+ **Deleting the recorder stops resource discovery.** Omni keeps the resources that it already found, and it adds no new ones. Amazon Config keeps the records that it already made.
+ **Your own recorder is separate.** Omni does not change or use your customer managed recorder.

**Note**  
Other CloudWatch features also create service-linked recorders. Your account can hold more than one recorder that is linked to CloudWatch.

## Which resources become graph nodes
<a name="omni-using-aws-config-for-resource-discovery-which-resources-become-graph-nodes"></a>

Amazon Config records every type in the resource-type table on this page. Omni adds a graph node for only some of those types. Omni uses the other records to add detail to nodes that exist. For example, Omni reads subnet and security group records. It uses them to find the network address of a service.

A resource can appear in the graph before Omni gets telemetry from it. To learn more, see [Using Context Graph](omni-using-context-graph.md).

## Which Regions are recorded
<a name="omni-using-aws-config-for-resource-discovery-regions"></a>

Omni creates the recorder in the same Region as your space. The recorder records the resources in that Region.

To add the resources from another Region, centralize that Region's telemetry into the space's account. For more information, see [Set up Omni for your organization](omni-set-up-omni-for-your-organization.md).

Amazon Config makes a record only for a type that Amazon Config supports in the Region. If Amazon Config does not support a type in a Region, no resource of that type appears in the graph for that Region.

## Describe calls in CloudTrail
<a name="omni-using-aws-config-for-resource-discovery-describe-calls-in-cloudtrail"></a>

Amazon Config takes an inventory of the resources in your account at regular times. It does this for all resources, not only for the types that this page lists. You can therefore see `ConfigResourceCompositionSession` and `AWSConfig-Describe` calls in CloudTrail, including calls for types that Omni does not record. This behavior keeps the Amazon Config inventory consistent.

## Recorded resource types
<a name="omni-using-aws-config-for-resource-discovery-recorded-resource-types"></a>

Amazon Config records the following resource types for Omni.


| Category | Amazon service | Resource types | 
| --- | --- | --- | 
| Compute | Amazon App Runner | Amazon::AppRunner::Service | 
| Compute | Amazon Elastic Beanstalk | Amazon::ElasticBeanstalk::Environment | 
| Compute | Amazon Lambda | Amazon::Lambda::Function | 
| Compute | Amazon EC2 | Amazon::EC2::Instance Amazon::EC2::LaunchTemplate | 
| Compute | Amazon EC2 Auto Scaling | Amazon::AutoScaling::AutoScalingGroup Amazon::AutoScaling::LaunchConfiguration | 
| Compute | Amazon ECS | Amazon::ECS::CapacityProvider Amazon::ECS::Cluster Amazon::ECS::Service Amazon::ECS::TaskDefinition Amazon::ECS::TaskSet | 
| Compute | Amazon EKS | Amazon::EKS::Cluster Amazon::EKS::FargateProfile Amazon::EKS::Nodegroup | 
| Compute | Amazon WorkSpaces | Amazon::WorkSpaces::Workspace | 
| Networking and content delivery | Amazon Global Accelerator | Amazon::GlobalAccelerator::Accelerator | 
| Networking and content delivery | Amazon CloudFront | Amazon::CloudFront::Distribution | 
| Networking and content delivery | Amazon Route 53 | Amazon::Route53::HostedZone | 
| Networking and content delivery | Amazon VPC | Amazon::EC2::ClientVpnEndpoint Amazon::EC2::EIP Amazon::EC2::FlowLog Amazon::EC2::InternetGateway Amazon::EC2::NatGateway Amazon::EC2::NetworkInterface Amazon::EC2::RouteTable Amazon::EC2::SecurityGroup Amazon::EC2::Subnet Amazon::EC2::TransitGateway Amazon::EC2::TransitGatewayAttachment Amazon::EC2::VPC Amazon::EC2::VPCEndpoint Amazon::EC2::VPCPeeringConnection Amazon::EC2::VPNConnection Amazon::EC2::VPNGateway | 
| Networking and content delivery | Elastic Load Balancing | Amazon::ElasticLoadBalancing::LoadBalancer Amazon::ElasticLoadBalancingV2::Listener Amazon::ElasticLoadBalancingV2::LoadBalancer Amazon::ElasticLoadBalancingV2::TargetGroup | 
| APIs | Amazon AppSync | Amazon::AppSync::GraphQLApi | 
| APIs | Amazon API Gateway | Amazon::ApiGateway::Method Amazon::ApiGateway::RestApi Amazon::ApiGateway::Stage Amazon::ApiGatewayV2::Api Amazon::ApiGatewayV2::Integration Amazon::ApiGatewayV2::Stage | 
| Databases and storage | Amazon DynamoDB | Amazon::DynamoDB::Table | 
| Databases and storage | Amazon EFS | Amazon::EFS::FileSystem | 
| Databases and storage | Amazon Keyspaces | Amazon::Cassandra::Keyspace | 
| Databases and storage | Amazon OpenSearch Service | Amazon::Elasticsearch::Domain Amazon::OpenSearch::Domain | 
| Databases and storage | Amazon QLDB | Amazon::QLDB::Ledger | 
| Databases and storage | Amazon RDS | Amazon::RDS::DBCluster Amazon::RDS::DBInstance | 
| Databases and storage | Amazon Redshift | Amazon::Redshift::Cluster | 
| Databases and storage | Amazon S3 | Amazon::S3::AccessPoint Amazon::S3::Bucket | 
| Application integration | Amazon IoT Core | Amazon::IoT::TopicRule | 
| Application integration | Amazon Step Functions | Amazon::StepFunctions::Activity Amazon::StepFunctions::StateMachine | 
| Application integration | Amazon Data Firehose | Amazon::KinesisFirehose::DeliveryStream | 
| Application integration | Amazon EventBridge | Amazon::Events::ApiDestination Amazon::Events::Connection Amazon::Events::EventBus Amazon::Events::Rule | 
| Application integration | Amazon EventBridge Scheduler | Amazon::Scheduler::ScheduleGroup | 
| Application integration | Amazon Kinesis Data Streams | Amazon::Kinesis::Stream | 
| Application integration | Amazon MQ | Amazon::AmazonMQ::Broker | 
| Application integration | Amazon MSK | Amazon::MSK::Cluster Amazon::MSK::ServerlessCluster | 
| Application integration | Amazon SNS | Amazon::SNS::Topic | 
| Application integration | Amazon SQS | Amazon::SQS::Queue | 
| Containers and service discovery | Amazon Cloud Map | Amazon::ServiceDiscovery::HttpNamespace Amazon::ServiceDiscovery::PublicDnsNamespace Amazon::ServiceDiscovery::Service | 
| Containers and service discovery | Amazon ECR | Amazon::ECR::PublicRepository Amazon::ECR::Repository | 
| Security and identity | Amazon Certificate Manager | Amazon::ACM::Certificate | 
| Security and identity | Amazon IAM | Amazon::IAM::Policy Amazon::IAM::Role | 
| Security and identity | Amazon KMS | Amazon::KMS::Key | 
| Security and identity | Amazon Network Firewall | Amazon::NetworkFirewall::Firewall | 
| Security and identity | Amazon Secrets Manager | Amazon::SecretsManager::Secret | 
| Security and identity | Amazon WAF | Amazon::WAFv2::WebACL | 
| Security and identity | Amazon Cognito | Amazon::Cognito::IdentityPool Amazon::Cognito::UserPool | 
| Management and governance | Amazon CloudFormation | Amazon::CloudFormation::Stack | 
| Management and governance | Amazon CloudTrail | Amazon::CloudTrail::Trail | 
| Management and governance | Amazon CloudWatch | Amazon::CloudWatch::Alarm Amazon::CloudWatch::MetricStream | 
| Management and governance | Amazon CloudWatch Logs | Amazon::Logs::Destination | 
| Machine learning | Amazon Bedrock | Amazon::Bedrock::DataSource Amazon::Bedrock::Guardrail Amazon::Bedrock::KnowledgeBase Amazon::Bedrock::Prompt | 
| Machine learning | Amazon Kendra | Amazon::Kendra::Index | 
| Machine learning | Amazon Lex | Amazon::Lex::Bot Amazon::Lex::BotAlias | 
| Machine learning | Amazon SageMaker AI | Amazon::SageMaker::Domain Amazon::SageMaker::EndpointConfig Amazon::SageMaker::Model Amazon::SageMaker::NotebookInstance | 
| Analytics | Amazon Glue | Amazon::Glue::Crawler Amazon::Glue::Database Amazon::Glue::Job | 
| Analytics | Amazon Athena | Amazon::Athena::WorkGroup | 
| Analytics | Amazon QuickSight | Amazon::QuickSight::DataSource | 
| Developer tools and migration | Amazon CodeBuild | Amazon::CodeBuild::Project | 
| Developer tools and migration | Amazon CodeDeploy | Amazon::CodeDeploy::Application Amazon::CodeDeploy::DeploymentGroup | 
| Developer tools and migration | Amazon CodePipeline | Amazon::CodePipeline::Pipeline | 
| Developer tools and migration | Amazon DMS | Amazon::DMS::ReplicationInstance | 
| Developer tools and migration | Amazon Transfer Family | Amazon::Transfer::Server | 
| Developer tools and migration | Amazon AppFlow | Amazon::AppFlow::Flow | 

## Related information
<a name="omni-using-aws-config-for-resource-discovery-related-information"></a>
+ [Using Context Graph](omni-using-context-graph.md)
+ [Monitor applications with the application map](omni-monitor-applications-with-the-application-map.md)
+ [Working with the configuration recorder](https://docs.amazonaws.cn/config/latest/developerguide/stop-start-recorder.html) in the *Amazon Config Developer Guide*