Setting Up an Aggregator Using the AWS Command Line Interface - AWS Config
Add an Aggregator Using Individual AccountsAdd an Aggregator Using AWS OrganizationsRegister a Delegated AdministratorView an AggregatorEdit an AggregatorDelete an AggregatorLearn More

Setting Up an Aggregator Using the AWS Command Line Interface

You can create, view, update, and delete AWS Config aggregator data using the AWS Command Line Interface (AWS CLI). To use the AWS Management Console, see Setting Up an Aggregator Using the Console.

The AWS CLI is a unified tool to manage your AWS services. With just one tool to download and configure, you can control multiple AWS services from the command line and use scripts to automate them.

To install the AWS CLI on your local machine, see Installing the AWS CLI in the AWS CLI User Guide.

If necessary, type AWS Configure to configure the AWS CLI to use an AWS Region where AWS Config aggregators are available.

Add an Aggregator Using Individual Accounts

  1. Open a command prompt or a terminal window.

  2. Type the following command to create an aggregator named MyAggregator.

    aws configservice put-configuration-aggregator --configuration-aggregator-name MyAggregator --account-aggregation-sources "[{\"AccountIds\": [\"AccountID1\",\"AccountID2\",\"AccountID3\"],\"AllAwsRegions\": true}]"

    For account-aggregation-sources, type one of the following.

    • A comma-separated list of AWS account IDs for which you want to aggregate data. Wrap the account IDs in square brackets, and be sure to escape quotation marks (for example, "[{\"AccountIds\": [\"AccountID1\",\"AccountID2\",\"AccountID3\"],\"AllAwsRegions\": true}]").

    • You can also upload a JSON file of comma-separated AWS account IDs. Upload the file using the following syntax: --account-aggregation-sources MyFilePath/MyFile.json

      The JSON file must be in the following format:

    [
    {
        "AccountIds": [
            "AccountID1",
            "AccountID2",
            "AccountID3"
        ],
        "AllAwsRegions": true
    }
]

  3. Press Enter to execute the command.

    You should see output similar to the following:

    {
    "ConfigurationAggregator": {
        "ConfigurationAggregatorArn": "arn:aws:config:Region:AccountID:config-aggregator/config-aggregator-floqpus3",
        "CreationTime": 1517942461.442,
        "ConfigurationAggregatorName": "MyAggregator",
        "AccountAggregationSources": [
            {
                "AllAwsRegions": true,
                "AccountIds": [
                    "AccountID1",
                    "AccountID2",
                    "AccountID3"
                ]
            }
        ],
        "LastUpdatedTime": 1517942461.442
    }
}

Add an Aggregator Using AWS Organizations

Before you begin this procedure, you must be signed in to the management account or a registered delegated administrator and all the features must be enabled in your organization.

Note

Ensure that the management account registers delegated administrator for AWS Config service principal name (config.amazonaws.com) before the delegated administrator creates an aggregator. To register a delegated administrator, see Register a Delegated Administrator.

  1. Open a command prompt or a terminal window.

  2. Type the following command to create an aggregator named MyAggregator.

    aws configservice put-configuration-aggregator --configuration-aggregator-name MyAggregator --organization-aggregation-source "{\"RoleArn\": \"Complete-Arn\",\"AllAwsRegions\": true}"

  3. Press Enter to execute the command.

    You should see output similar to the following:

    {
    "ConfigurationAggregator": {
        "ConfigurationAggregatorArn": "arn:aws:config:Region:AccountID:config-aggregator/config-aggregator-floqpus3",
        "CreationTime": 1517942461.442,
        "ConfigurationAggregatorName": "MyAggregator",
        "OrganizationAggregationSource": {
                "AllAwsRegions": true,
                "RoleArn": "arn:aws:iam::account-of-role-to-assume:role/name-of-role"
         },
        "LastUpdatedTime": 1517942461.442
    }
}

Register a Delegated Administrator

Delegated administrators are accounts within a given AWS Organization that are granted additional administrative privileges for a specified AWS service.

  1. Login with management account credentials.

  2. Open a command prompt or a terminal window.

  3. Type the following command to enable service access:

    aws organizations enable-aws-service-access --service-principal config.amazonaws.com

  4. To verify if the enable service access is complete, type the following command and press Enter to execute the command.

    aws organizations list-aws-service-access-for-organization

    You should see output similar to the following:

    {
    "EnabledServicePrincipals": [
        {
            "ServicePrincipal": "config.amazonaws.com",
            "DateEnabled": 1607020860.881
        }
    ]
}

  5. Next, type the following command to register a member account as a delegated administrator for AWS Config.

    aws organizations register-delegated-administrator --service-principal config.amazonaws.com --account-id MemberAccountID

  6. To verify if the registration of delegated administrator is complete, type the following command and press Enter to execute the command.

    aws organizations list-delegated-administrators --service-principal config.amazonaws.com

    You should see output similar to the following:

    {
    "DelegatedAdministrators": [
        {
            "Id": "MemberAccountID",
            "Arn": "arn:aws:organizations::MemeberAccountID:account/o-c7esubdi38/MemeberAccountID",
            "Email": "name@amazon.com",
            "Name": "name",
            "Status": "ACTIVE",
            "JoinedMethod": "INVITED",
            "JoinedTimestamp": 1604867734.48,
            "DelegationEnabledDate": 1607020986.801
        }
    ]
}

View an Aggregator

  1. Type the following command:

    aws configservice describe-configuration-aggregators

  2. Depending on your source account you should see output similar to the following:

    For individuals accounts

    {
    "ConfigurationAggregators": [
        {
            "ConfigurationAggregatorArn": "arn:aws:config:Region:AccountID:config-aggregator/config-aggregator-floqpus3",
            "CreationTime": 1517942461.442,
            "ConfigurationAggregatorName": "MyAggregator",
            "AccountAggregationSources": [
                {
                    "AllAwsRegions": true,
                    "AccountIds": [
                        "AccountID1",
                        "AccountID2",
                        "AccountID3"
                    ]
                }
            ],
            "LastUpdatedTime": 1517942461.455
        }
    ]
}

    OR

    For an organization

    {
    "ConfigurationAggregator": {
        "ConfigurationAggregatorArn": "arn:aws:config:Region:AccountID:config-aggregator/config-aggregator-floqpus3",
        "CreationTime": 1517942461.442,
        "ConfigurationAggregatorName": "MyAggregator",
        "OrganizationAggregationSource": {
                "AllAwsRegions": true,
                "RoleArn": "arn:aws:iam::account-of-role-to-assume:role/name-of-role"
         },
        "LastUpdatedTime": 1517942461.442
    }
}

Edit an Aggregator

  1. You can use the put-configuration-aggregator command to update or edit a configuration aggregator.

    Type the following command to add a new account ID to MyAggregator:

    aws configservice put-configuration-aggregator --configuration-aggregator-name MyAggregator --account-aggregation-sources "[{\"AccountIds\": [\"AccountID1\",\"AccountID2\",\"AccountID3\"],\"AllAwsRegions\": true}]"

  2. Depending on your source account you should see output similar to the following:

    For individuals accounts

    {
    "ConfigurationAggregator": {
        "ConfigurationAggregatorArn": "arn:aws:config:Region:AccountID:config-aggregator/config-aggregator-xz2upuu6",
        "CreationTime": 1517952090.769,
        "ConfigurationAggregatorName": "MyAggregator",
        "AccountAggregationSources": [
            {
                "AllAwsRegions": true,
                "AccountIds": [
                    "AccountID1",
                    "AccountID2",
                    "AccountID3",
                    "AccountID4"
                ]
            }
        ],
        "LastUpdatedTime": 1517952566.445
    }
}

    OR

    For an organization

    {
    "ConfigurationAggregator": {
        "ConfigurationAggregatorArn": "arn:aws:config:Region:AccountID:config-aggregator/config-aggregator-floqpus3",
        "CreationTime": 1517942461.442,
        "ConfigurationAggregatorName": "MyAggregator",
        "OrganizationAggregationSource": {
                "AllAwsRegions": true,
                "RoleArn": "arn:aws:iam::account-of-role-to-assume:role/name-of-role"
         },
        "LastUpdatedTime": 1517942461.442
    }
}

Delete an Aggregator

To delete a configuration aggregator using the AWS CLI

  • Type the following command:

    aws configservice delete-configuration-aggregator --configuration-aggregator-name MyAggregator

    If successful, the command executes with no additional output.

Learn More