01
Run create-bucket command (OSX/Linux/UNIX) to create a new S3 bucket in the selected region. This bucket will be used by AWS Config for saving configuration history and configuration snapshot files:
aws s3api create-bucket
--region us-east-1
--bucket cc-config-bucket-123456789012
02
The command output should return the new S3 bucket location (URL):
{
"Location": "/cc-config-bucket-123456789012"
}
03
Now create an access policy that grants AWS Config the permission to write to the newly created S3 bucket. Create a new policy document called s3-bucket-access-policy.json and paste the following (replace the highlighted details – the bucket name and the AWS account ID – with your details or use AWS Policy Generator, to create your own policy):
{
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSConfigS3BucketPermissions",
"Effect": "Allow",
"Principal": {
"Service": [
"config.amazonaws.com"
]
},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::cc-config-bucket-123456789012"
},
{
"Sid": " AWSConfigBucketDelivery",
"Effect": "Allow",
"Principal": {
"Service": [
"config.amazonaws.com"
]
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::cc-config-bucket-123456789012/AWSLogs/123456789012/Config/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}
04
Run put-bucket-policy command (OSX/Linux/UNIX) to attach the access policy defined at the previous step (s3-bucket-access-policy.json) to the newly created S3 bucket (cc-config-bucket-123456789012):
aws s3api put-bucket-policy
--bucket cc-config-bucket-123456789012
--policy file://s3-bucket-access-policy.json
05
Run describe-delivery-channels command (OSX/Linux/UNIX) to return the delivery channel configuration details for the AWS Config service enabled within the selected region:
aws configservice describe-delivery-channels
--region us-east-1
06
The command output should return the delivery channel information requested:
{
"DeliveryChannels": [
{
"snsTopicARN": "arn:aws:sns:us-east-1:123456789012:ConfigSNSTopic",
"name": "default",
"s3BucketName": "config-bucket-123456789012"
}
]
}
07
Before you update the AWS Config delivery channel, you must create a JSON document where you need to define the required configuration attributes. Based on the delivery channel attributes returned at the previous step, create a JSON file named new-config-delivery-channel.json and paste the following JSON data (replace the attributes values with your own values):
{
"name": "default",
"s3BucketName": "cc-config-bucket-123456789012",
"snsTopicARN": "arn:aws:sns:us-east-1:123456789012:ConfigSNSTopic",
"configSnapshotDeliveryProperties": {
"deliveryFrequency": "Six_Hours"
}
}
08
Run put-delivery-channel command (OSX/Linux/UNIX) using the attributes defined at the previous step (new-config-delivery-channel.json) to update the delivery channel of the Amazon Config service with the missing S3 bucket, available in the selected region (the command does not produce an output):
aws configservice put-delivery-channel
--region us-east-1
--delivery-channel file://new-config-delivery-channel.json
09
Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 8 to perform the entire process for other regions.
Operational
and 
|