Managing the Delivery Channel - Amazon Config
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Managing the Delivery Channel

As Amazon Config continually records the changes that occur to your Amazon resources, it sends notifications and updated configuration states through the delivery channel. You can manage the delivery channel to control where Amazon Config sends configuration updates.

You can have only one delivery channel per Amazon Region region per Amazon Web Services account, and the delivery channel is required to use Amazon Config.

When Amazon Config detects a configuration change for a resource and the notification exceeds the maximum size allowed by Amazon SNS, the notification includes a brief summary of the configuration item. You can view the complete notification in the Amazon S3 bucket location specified in the s3BucketLocation field. For more information, see Example Oversized Configuration Item Change Notification.

Note

Amazon Config supports Amazon KMS encryption for Amazon S3 buckets used by Amazon Config

You can provide an Amazon Key Management Service (Amazon KMS) key or alias Amazon Resource Name (ARN) to encrypt the data delivered to your Amazon Simple Storage Service (Amazon S3) bucket. By default, Amazon Config delivers configuration history and snapshot files to your Amazon S3 bucket and encrypts the data at rest using S3 AES-256 server-side encryption, SSE-S3. However, if you provide Amazon Config with your KMS key or alias ARN, Amazon Config uses that KMS key instead of AES-256 encryption.

Amazon Config does not support the delivery channel to an Amazon S3 bucket where object lock is enabled with default retention enabled. For more information, see How S3 Object Lock works.

Terminology

A configuration item represents a point-in-time view of the various attributes of a supported Amazon resource that exists in your account. The components of a configuration item include metadata, attributes, relationships, current configuration, and related events. Amazon Config creates a configuration item whenever it detects a change to a resource type that it is recording. For example, if Amazon Config is recording Amazon S3 buckets, Amazon Config creates a configuration item whenever a bucket is created, updated, or deleted. You can also select for Amazon Config to create a configuration item at the recording frequency that you set.

A configuration history is a collection of the configuration items for a given resource over any time period. A configuration history can help you answer questions about, for example, when the resource was first created, how the resource has been configured over the last month, and what configuration changes were introduced yesterday at 9 AM. The configuration history is available to you in multiple formats. Amazon Config automatically delivers a configuration history file for each resource type that is being recorded to an Amazon S3 bucket that you specify. You can select a given resource in the Amazon Config console and navigate to all previous configuration items for that resource using the timeline. Additionally, you can access the historical configuration items for a resource from the API.

A configuration snapshot is a collection of the configuration items for the supported resources that exist in your account. This configuration snapshot is a complete picture of the resources that are being recorded and their configurations. The configuration snapshot can be a useful tool for validating your configuration. For example, you may want to examine the configuration snapshot regularly for resources that are configured incorrectly or that potentially should not exist. The configuration snapshot is available in multiple formats. You can have the configuration snapshot delivered to an Amazon Simple Storage Service (Amazon S3) bucket that you specify. Additionally, you can select a point in time in the Amazon Config console and navigate through the snapshot of configuration items using the relationships between the resources.

A configuration stream is an automatically updated list of all configuration items for the resources that Amazon Config is recording. Every time a resource is created, modified, or deleted, Amazon Config creates a configuration item and adds to the configuration stream. The configuration stream works by using an Amazon Simple Notification Service (Amazon SNS) topic of your choice. The configuration stream is helpful for observing configuration changes as they occur so that you can spot potential problems, generating notifications if certain resources are changed, or updating external systems that need to reflect the configuration of your Amazon resources.

Updating the Delivery Channel

When you update the delivery channel, you can set the following options:

  • The Amazon S3 bucket to which Amazon Config sends configuration snapshots and configuration history files.

  • How often Amazon Config delivers configuration snapshots to your Amazon S3 bucket.

  • The Amazon SNS topic to which Amazon Config sends notifications about configuration changes.

You can use the Amazon Config console to set the Amazon S3 bucket and the Amazon SNS topic for your delivery channel. For steps to manage these settings, see Setting Up Amazon Config with the Console.

The console does not provide options to rename the delivery channel, set the frequency for configuration snapshots, or delete the delivery channel. To do these tasks, you must use the Amazon CLI, the Amazon Config API, or one of the Amazon SDKs.

The following code examples show how to use PutDeliveryChannel.

CLI
Amazon CLI

To create a delivery channel

The following command provides the settings for the delivery channel as JSON code:

aws configservice put-delivery-channel --delivery-channel file://deliveryChannel.json

The deliveryChannel.json file specifies the delivery channel attributes:

{ "name": "default", "s3BucketName": "config-bucket-123456789012", "snsTopicARN": "arn:aws:sns:us-east-1:123456789012:config-topic", "configSnapshotDeliveryProperties": { "deliveryFrequency": "Twelve_Hours" } }

This example sets the following attributes:

name - The name of the delivery channel. By default, Amazon Config assigns the name default to a new delivery channel.You cannot update the delivery channel name with the put-delivery-channel command. For the steps to change the name, see Renaming the Delivery Channel.s3BucketName - The name of the Amazon S3 bucket to which Amazon Config delivers configuration snapshots and configuration history files.If you specify a bucket that belongs to another Amazon account, that bucket must have policies that grant access permissions to Amazon Config. For more information, see Permissions for the Amazon S3 Bucket.

snsTopicARN - The Amazon Resource Name (ARN) of the Amazon SNS topic to which Amazon Config sends notifications about configuration changes.If you choose a topic from another account, the topic must have policies that grant access permissions to Amazon Config. For more information, see Permissions for the Amazon SNS Topic.

configSnapshotDeliveryProperties - Contains the deliveryFrequency attribute, which sets how often Amazon Config delivers configuration snapshots and how often it invokes evaluations for periodic Config rules.

If the command succeeds, Amazon Config returns no output. To verify the settings of your delivery channel, run the describe-delivery-channels command.

PowerShell
Tools for PowerShell

Example 1: This example changes the deliveryFrequency property of an existing delivery channel.

Write-CFGDeliveryChannel -ConfigSnapshotDeliveryProperties_DeliveryFrequency TwentyFour_Hours -DeliveryChannelName default -DeliveryChannel_S3BucketName config-bucket-NA -DeliveryChannel_S3KeyPrefix my
  • For API details, see PutDeliveryChannel in Amazon Tools for PowerShell Cmdlet Reference.

(Optional) You can use the describe-delivery-channels command to verify that the delivery channel settings are updated:

$ aws configservice describe-delivery-channels { "DeliveryChannels": [ { "configSnapshotDeliveryProperties": { "deliveryFrequency": "Twelve_Hours" }, "snsTopicARN": "arn:aws:sns:us-east-2:123456789012:config-topic", "name": "default", "s3BucketName": "config-bucket-123456789012" } ] }

The following code examples show how to use DescribeDeliveryChannels.

CLI
Amazon CLI

To get details about the delivery channel

The following command returns details about the delivery channel:

aws configservice describe-delivery-channels

Output:

{ "DeliveryChannels": [ { "snsTopicARN": "arn:aws:sns:us-east-1:123456789012:config-topic", "name": "default", "s3BucketName": "config-bucket-123456789012" } ] }
PowerShell
Tools for PowerShell

Example 1: This example retrieves the delivery channel for the region and displays details.

Get-CFGDeliveryChannel -Region eu-west-1 | Select-Object Name, S3BucketName, S3KeyPrefix, @{N="DeliveryFrequency";E={$_.ConfigSnapshotDeliveryProperties.DeliveryFrequency}}

Output:

Name S3BucketName S3KeyPrefix DeliveryFrequency ---- ------------ ----------- ----------------- default config-bucket-NA my TwentyFour_Hours

Renaming the Delivery Channel

To change the delivery channel name, you must delete it and create a new delivery channel with the desired name. Before you can delete the delivery channel, you must temporarily stop the configuration recorder.

The Amazon Config console does not provide the option to delete the delivery channel, so you must use the Amazon CLI, the Amazon Config API, or one of the Amazon SDKs.

Renaming the delivery channel using the Amazon CLI
  1. Use the stop-configuration-recorder command to stop the configuration recorder:

    $ aws configservice stop-configuration-recorder --configuration-recorder-name configRecorderName
  2. Use the describe-delivery-channels command, and take note of your delivery channel's attributes:

    $ aws configservice describe-delivery-channels { "DeliveryChannels": [ { "configSnapshotDeliveryProperties": { "deliveryFrequency": "Twelve_Hours" }, "snsTopicARN": "arn:aws:sns:us-east-2:123456789012:config-topic", "name": "default", "s3BucketName": "config-bucket-123456789012" } ] }
  3. Use the delete-delivery-channel command to delete the delivery channel:

    $ aws configservice delete-delivery-channel --delivery-channel-name default
  4. Use the put-delivery-channel command to create a delivery channel with the desired name:

    $ aws configservice put-delivery-channel --delivery-channel file://deliveryChannel.json

    The deliveryChannel.json file specifies the delivery channel attributes:

    { "name": "myCustomDeliveryChannelName", "s3BucketName": "config-bucket-123456789012", "snsTopicARN": "arn:aws:sns:us-east-2:123456789012:config-topic", "configSnapshotDeliveryProperties": { "deliveryFrequency": "Twelve_Hours" } }
  5. Use the start-configuration-recorder command to resume recording:

    $ aws configservice start-configuration-recorder --configuration-recorder-name configRecorderName