Recording Resources with the Amazon CLI

You can use the Amazon CLI to select the types of resources that you want Amazon Config to record. You do this by creating a configuration recorder, which records the types of resources that you specify in a recording group. In the recording group, you specify whether you want to record all supported resource types, or to include or exclude specific types of resources.

Record all current and future supported resource types

Set up Amazon Config to record configuration changes for all current and future supported resource types in this Region. For more information, see Supported Resource Types.

Use the following put-configuration-recorder command:
```
$ aws configservice put-configuration-recorder \
--configuration-recorder file://configurationRecorder.json \
--recording-group file://recordingGroup.json
```
This command uses the --configuration-recorder and ---recording-group fields.

Note
Recording group and configuration recorder
The --recording-group field specifies which resource types are recorded.
The --configuration-recorder field specifies name and roleArn as well as the default recording frequency for the configuration recorder (recordingMode). You can also use this field override the recording frequency for specific resource types.
1. put-configuration-recorder uses the following fields for the --recording-group parameter:
  - allSupported=true – Amazon Config records configuration changes for all supported resource types, excluding the global IAM resource types. When Amazon Config adds support for a new resource type, Amazon Config starts recording resources of that type automatically.
  - includeGlobalResourceTypes=true – This option is a bundle which only applies to the global IAM resource types: IAM users, groups, roles, and customer managed policies. These global IAM resource types can only be recorded by Amazon Config in Regions where Amazon Config was available before February 2022. You cannot be record the global IAM resouce types in Regions supported by Amazon Config after February 2022. For a list of those Regions, see Recording Amazon Resources | Global Resources.
    
    Important
    Aurora global clusters are recorded in all enabled Regions
    The AWS::RDS::GlobalCluster resource type will be recorded in all supported Amazon Config Regions where the configuration recorder is enabled, even if includeGlobalResourceTypes is not set to true. The includeGlobalResourceTypes option is a bundle which only applies to IAM users, groups, roles, and customer managed policies.
    If you do not want to record AWS::RDS::GlobalCluster in all enabled Regions, use one of the following recording strategies:
    
    Record all current and future resource types excluding the types you specify (EXCLUSION_BY_RESOURCE_TYPES), or
    Record specific resource types (INCLUSION_BY_RESOURCE_TYPES).
    For more information, see Selecting Which Resources are Recorded | Regional and Global Resources.
    
    Important
    includeGlobalResourceTypes and the exclusion recording strategy
    The includeGlobalResourceTypes field has no impact on the EXCLUSION_BY_RESOURCE_TYPES recording strategy. This means that the global IAM resource types (IAM users, groups, roles, and customer managed policies) will not be automatically added as exclusions for exclusionByResourceTypes when includeGlobalResourceTypes is set to false.
    The includeGlobalResourceTypes field should only be used to modify the AllSupported field, as the default for the AllSupported field is to record configuration changes for all supported resource types excluding the global IAM resource types. To include the global IAM resource types when AllSupported is set to true, make sure to set includeGlobalResourceTypes to true.
    To exclude the global IAM resource types for the EXCLUSION_BY_RESOURCE_TYPES recording strategy, you need to manually add them to the resourceTypes field of exclusionByResourceTypes.
    
    Note
    Required and optional fields
    Before you can set includeGlobalResourceTypes to true, set the allSupported field to true.
    Optionally, you can set the useOnly field of RecordingStrategy to ALL_SUPPORTED_RESOURCE_TYPES.
    
    Note
    Overriding fields
    If you set includeGlobalResourceTypesto false but list global IAM resource types in the resourceTypes field of RecordingGroup, Amazon Config will still record configuration changes for those specified resource types regardless of if you set the includeGlobalResourceTypes field to false.
    If you do not want to record configuration changes to the global IAM resource types (IAM users, groups, roles, and customer managed policies), make sure to not list them in the resourceTypes field in addition to setting the includeGlobalResourceTypes field to false.
  The recordingGroup.json file specifies which types of resources Amazon Config will record.
```
{
    "allSupported": true,
    "recordingStrategy": {
        "useOnly": "ALL_SUPPORTED_RESOURCE_TYPES" 
    },
    "includeGlobalResourceTypes": true
}
```
2. put-configuration-recorder uses the following fields for the --configuration-recorder parameter:
  - name – The name of the configuration recorder. Amazon Config automatically assigns the name of "default" when creating the configuration recorder.
  - roleARN – Amazon Resource Name (ARN) of the IAM role assumed by Amazon Config and used by the configuration recorder.
  - recordingMode – Specifies the default recording frequency that Amazon Config uses to record configuration changes. Amazon Config supports Continuous recording and Daily recording. Continuous recording allows you to record configuration changes continuously whenever a change occurs. Daily recording allows you to receive a configuration item (CI) representing the most recent state of your resources over the last 24-hour period, only if it’s different from the previous CI recorded.
    
    recordingFrequency – The default recording frequency that Amazon Config uses to record configuration changes.
    
    Note
    Amazon Firewall Manager depends on continuous recording to monitor your resources. If you are using Firewall Manager, it is recommended that you set the recording frequency to Continuous.
    
    recordingModeOverrides – This field allows you to specify your overrides for the recording mode. It is an array of recordingModeOverride objects. Each recordingModeOverride object in the recordingModeOverrides array consists of three fields:
    
    description – A description that you provide for the override.
    recordingFrequency – The recording frequency that will be applied to all the resource types specified in the override.
    resourceTypes – A comma-separated list that specifies which resource types Amazon Config includes in the override.
  Note
  Required and optional fields
  The recordingMode field for put-configuration-recorder is optional. By default, the recording frequency for the configuration recorder is set to Continuous recording.
  Note
  Limits
  Daily recording is not supported for the following resource types:
  
  AWS::Config::ResourceCompliance
  AWS::Config::ConformancePackCompliance
  AWS::Config::ConfigurationRecorder
  For the Record all current and future supported resource types (ALL_SUPPORTED_RESOURCE_TYPES) recording strategy, these resource types will be set to Continuous recording.
  The configurationRecorder.json file specifies name and roleArn as well as the default recording frequency for the configuration recorder (recordingMode). You can also use this field override the recording frequency for specific resource types.
```
{
  "name": "default",
  "roleARN": "arn:aws:iam::123456789012:role/config-role",
  "recordingMode": {
    "recordingFrequency": CONTINUOUS or DAILY,
    "recordingModeOverrides": [ 
        { 
            "description": "Description you provide for the override",
            "recordingFrequency": CONTINUOUS or DAILY,
            "resourceTypes": [ Comma-separated list of resource types to include in the override ]
        }
    ]
  }
}
```

(Optional) To verify that your configuration recorder has the settings that you want, use the following describe-configuration-recorders command.


$ aws configservice describe-configuration-recorders

The following is an example response.


{
    "ConfigurationRecorders": [
        {
            "name": "default"
            "recordingGroup": {
                "allSupported": true,
                "exclusionByResourceTypes": { 
                     "resourceTypes": []
                },
                "includeGlobalResourceTypes": true,
                "recordingStrategy": {
                    "useOnly": "ALL_SUPPORTED_RESOURCE_TYPES" 
                },
                "resourceTypes": [],
            },
            "recordingMode": { 
                "recordingFrequency": CONTINUOUS or DAILY,
                "recordingModeOverrides": [ 
                 { 
                     "description": "Description you provide for the override,
                     "recordingFrequency": CONTINUOUS or DAILY,
                     "resourceTypes": [ Comma-separated list of resource types to include in the override]
                }
              ]
            },
            "roleARN": "arn:aws:iam::123456789012:role/config-role"
        }
    ]
}

Record all current and future supported resources types excluding the types you specify

Set up Amazon Config to record configuration changes for all current and future supported resource types, including global resource types, except the resource types that you specify to exclude from recording. If you choose to stop recording for a resource type, the configuration items that were already recorded will remain unchanged. For more information, see Supported Resource Types.

This command uses the --configuration-recorder and ---recording-group fields.


$ aws configservice put-configuration-recorder \
--configuration-recorder file://configurationRecorder.json \
--recording-group file://recordingGroup.json

Note

Recording group and configuration recorder

The --recording-group field specifies which resource types are recorded.

The --configuration-recorder field specifies name and roleArn as well as the default recording frequency for the configuration recorder (recordingMode). You can also use this field override the recording frequency for specific resource types.

Use the put-configuration-recorder command, and pass one or more resource types to exclude in the resourceTypes field of exclusionByResourceTypes, as shown in the following example.
1. The recordingGroup.json file specifies which types of resources Amazon Config will record.
```
{
    "allSupported": false,
    "exclusionByResourceTypes": { 
        "resourceTypes": [
            "AWS::Redshift::ClusterSnapshot",
            "AWS::RDS::DBClusterSnapshot",
            "AWS::CloudFront::StreamingDistribution"
        ]
    },
   "includeGlobalResourceTypes": false,
   "recordingStrategy": {
       "useOnly": "EXCLUSION_BY_RESOURCE_TYPES" 
    },
  
}
```
  Before you can specify resource types to exclude in the recording:
  - You must set the allSupported and includeGlobalResourceTypes fields of the --recording-group parameter to false or omit them.
  - You must set the useOnly field of RecordingStrategy to EXCLUSION_BY_RESOURCE_TYPES.
  Note
  Overriding fields
  If you choose EXCLUSION_BY_RESOURCE_TYPES for the recording strategy, the exclusionByResourceTypes field will override other properties in the request.
  For example, even if you set includeGlobalResourceTypes to false, the global IAM resource types will still be automatically recorded in this option, unless those resource types are specifically listed as exclusions in the resourceTypes field of exclusionByResourceTypes.
  
  Note
  Global resource types and the resource exclusion recording strategy
  By default, if you choose the EXCLUSION_BY_RESOURCE_TYPES recording strategy, when Amazon Config adds support for a new resource type in the Region where you set up the configuration recorder, including global resource types, Amazon Config starts recording resources of that type automatically.
  Unless specifically listed as exclusions, AWS::RDS::GlobalCluster will be recorded automatically in all supported Amazon Config Regions were the configuration recorder is enabled.
  IAM users, groups, roles, and customer managed policies will be recorded in the Region where you set up the configuration recorder if that is a Region where Amazon Config was available before February 2022. You cannot be record the global IAM resouce types in Regions supported by Amazon Config after February 2022. For a list of those Regions, see Recording Amazon Resources | Global Resources.
2. put-configuration-recorder uses the following fields for the --configuration-recorder parameter:
  - name – The name of the configuration recorder. Amazon Config automatically assigns the name of "default" when creating the configuration recorder.
  - roleARN – Amazon Resource Name (ARN) of the IAM role assumed by Amazon Config and used by the configuration recorder.
  - recordingMode – Specifies the default recording frequency that Amazon Config uses to record configuration changes. Amazon Config supports Continuous recording and Daily recording. Continuous recording allows you to record configuration changes continuously whenever a change occurs. Daily recording allows you to receive a configuration item (CI) representing the most recent state of your resources over the last 24-hour period, only if it’s different from the previous CI recorded.
    
    recordingFrequency – The default recording frequency that Amazon Config uses to record configuration changes.
    
    Note
    Amazon Firewall Manager depends on continuous recording to monitor your resources. If you are using Firewall Manager, it is recommended that you set the recording frequency to Continuous.
    
    recordingModeOverrides – This field allows you to specify your overrides for the recording mode. It is an array of recordingModeOverride objects. Each recordingModeOverride object in the recordingModeOverrides array consists of three fields:
    
    description – A description that you provide for the override.
    recordingFrequency – The recording frequency that will be applied to all the resource types specified in the override.
    resourceTypes – A comma-separated list that specifies which resource types Amazon Config includes in the override.
  Note
  Required and optional fields
  The recordingMode field for put-configuration-recorder is optional. By default, the recording frequency for the configuration recorder is set to Continuous recording.
  Note
  Limits
  Daily recording is not supported for the following resource types:
  
  AWS::Config::ResourceCompliance
  AWS::Config::ConformancePackCompliance
  AWS::Config::ConfigurationRecorder
  For the Record all current and future supported resource types (ALL_SUPPORTED_RESOURCE_TYPES) recording strategy, these resource types will be set to Continuous recording.
  The configurationRecorder.json file specifies name and roleArn as well as the default recording frequency for the configuration recorder (recordingMode). You can also use this field override the recording frequency for specific resource types.
```
{
  "name": "default",
  "roleARN": "arn:aws:iam::123456789012:role/config-role",
  "recordingMode": {
    "recordingFrequency": CONTINUOUS or DAILY,
    "recordingModeOverrides": [ 
        { 
            "description": "Description you provide for the override",
            "recordingFrequency": CONTINUOUS or DAILY,
            "resourceTypes": [ Comma-separated list of resource types to include in the override ]
        }
    ]
  }
}
```

(Optional) To verify that your configuration recorder has the settings that you want, use the following describe-configuration-recorders command.


$ aws configservice describe-configuration-recorders

The following is an example response.


{
    "ConfigurationRecorders": [
        {
            "name": "default",
            "recordingGroup": {
                "allSupported": false,
                "exclusionByResourceTypes": { 
                    "resourceTypes": [
                        "AWS::Redshift::ClusterSnapshot",
                        "AWS::RDS::DBClusterSnapshot",
                        "AWS::CloudFront::StreamingDistribution"
                    ]
                },
                "includeGlobalResourceTypes": false,
                "recordingStrategy": {
                    "useOnly": "EXCLUSION_BY_RESOURCE_TYPES" 
                },
                "resourceTypes": [],
            },
            "recordingMode": { 
                "recordingFrequency": CONTINUOUS or DAILY,
                "recordingModeOverrides": [ 
                 { 
                     "description": "Description you provide for the override,
                     "recordingFrequency": CONTINUOUS or DAILY,
                     "resourceTypes": [ Comma-separated list of resource types to include in the override]
                }
              ]
            },
            "roleARN": "arn:aws:iam::123456789012:role/config-role"
        }
    ]
}

Record specific resource types

Set up Amazon Config to record configuration changes for only the resource types that you specify. If you choose to stop recording for a resource type, the configuration items that were already recorded will remain unchanged.

This command uses the --configuration-recorder and ---recording-group fields.


$ aws configservice put-configuration-recorder \
--configuration-recorder file://configurationRecorder.json \
--recording-group file://recordingGroup.json

Note

Recording group and configuration recorder

The --recording-group field specifies which resource types are recorded.

Use the put-configuration-recorder command, and pass one or more resource types in the resourceTypes field of recordingGroup, as shown in the following example.
1. The recordingGroup.json file specifies which types of resources Amazon Config will record.
```
{
    "allSupported": false,
    "recordingStrategy": {
        "useOnly": "INCLUSION_BY_RESOURCE_TYPES" 
    },
    "includeGlobalResourceTypes": false,
    "resourceTypes": [
        "AWS::EC2::EIP",
        "AWS::EC2::Instance",
        "AWS::EC2::NetworkAcl",
        "AWS::EC2::SecurityGroup",
        "AWS::CloudTrail::Trail",
        "AWS::EC2::Volume",
        "AWS::EC2::VPC",
        "AWS::IAM::User",
        "AWS::IAM::Policy"
  ]
}
```
  Note
  Required and optional fields
  Before you can specify resource types to include in recording, you must set the allSupported and includeGlobalResourceTypes fields to false, or omit them.
  The recordingStrategy field is optional when you list resource types in the resourceTypes field of --recording-group.
  
  Note
  Region availability
  Before specifying a resource type for Amazon Config to track, check Resource Coverage by Region availability to see if the resource type is supported in the Amazon Region where you set up Amazon Config. If a resource type is supported by Amazon Config in at least one Region, you can enable the recording of that resource type in all Regions supported by Amazon Config, even if the specified resource type is not supported in the Amazon Region where you set up Amazon Config.
2. put-configuration-recorder uses the following fields for the --configuration-recorder parameter:
  - name – The name of the configuration recorder. Amazon Config automatically assigns the name of "default" when creating the configuration recorder.
  - roleARN – Amazon Resource Name (ARN) of the IAM role assumed by Amazon Config and used by the configuration recorder.
  - recordingMode – Specifies the default recording frequency that Amazon Config uses to record configuration changes. Amazon Config supports Continuous recording and Daily recording. Continuous recording allows you to record configuration changes continuously whenever a change occurs. Daily recording allows you to receive a configuration item (CI) representing the most recent state of your resources over the last 24-hour period, only if it’s different from the previous CI recorded.
    
    recordingFrequency – The default recording frequency that Amazon Config uses to record configuration changes.
    
    Note
    Amazon Firewall Manager depends on continuous recording to monitor your resources. If you are using Firewall Manager, it is recommended that you set the recording frequency to Continuous.
    
    recordingModeOverrides – This field allows you to specify your overrides for the recording mode. It is an array of recordingModeOverride objects. Each recordingModeOverride object in the recordingModeOverrides array consists of three fields:
    
    description – A description that you provide for the override.
    recordingFrequency – The recording frequency that will be applied to all the resource types specified in the override.
    resourceTypes – A comma-separated list that specifies which resource types Amazon Config includes in the override.
  Note
  Required and optional fields
  The recordingMode field for put-configuration-recorder is optional. By default, the recording frequency for the configuration recorder is set to Continuous recording.
  Note
  Limits
  Daily recording is not supported for the following resource types:
  
  AWS::Config::ResourceCompliance
  AWS::Config::ConformancePackCompliance
  AWS::Config::ConfigurationRecorder
  For the Record all current and future supported resource types (ALL_SUPPORTED_RESOURCE_TYPES) recording strategy, these resource types will be set to Continuous recording.
  The configurationRecorder.json file specifies name and roleArn as well as the default recording frequency for the configuration recorder (recordingMode). You can also use this field override the recording frequency for specific resource types.
```
{
  "name": "default",
  "roleARN": "arn:aws:iam::123456789012:role/config-role",
  "recordingMode": {
    "recordingFrequency": CONTINUOUS or DAILY,
    "recordingModeOverrides": [ 
        { 
            "description": "Description you provide for the override",
            "recordingFrequency": CONTINUOUS or DAILY,
            "resourceTypes": [ Comma-separated list of resource types to include in the override ]
        }
    ]
  }
}
```

(Optional) To verify that your configuration recorder has the settings that you want, use the following describe-configuration-recorders command.


$ aws configservice describe-configuration-recorders

The following is an example response.


{
    "ConfigurationRecorders": [
        {
            "name": "default",
            "recordingGroup": {
                "allSupported": false,
                "exclusionByResourceTypes": { 
                    "resourceTypes": []
                },
                "includeGlobalResourceTypes": false
                "recordingStrategy": {
                    "useOnly": "INCLUSION_BY_RESOURCE_TYPES" 
                },
                "resourceTypes": [
                    "AWS::EC2::EIP",
                    "AWS::EC2::Instance",
                    "AWS::EC2::NetworkAcl",
                    "AWS::EC2::SecurityGroup",
                    "AWS::CloudTrail::Trail",
                    "AWS::EC2::Volume",
                    "AWS::EC2::VPC",
                    "AWS::IAM::User",
                    "AWS::IAM::Policy"
                ]
            },
            "recordingMode": { 
                "recordingFrequency": CONTINUOUS or DAILY,
                "recordingModeOverrides": [ 
                 { 
                     "description": "Description you provide for the override,
                     "recordingFrequency": CONTINUOUS or DAILY,
                     "resourceTypes": [ Comma-separated list of resource types to include in the override]
                }
              ]
            },
            "roleARN": "arn:aws:iam::123456789012:role/config-role"
        }
    ]
}

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Recording Resources (Console)

Recording Frequency

Recording Resources with the Amazon CLI

Note

Important

Important

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note