AWS Config is not enabled in this region

Severity: Medium
Service: Config
Check ID: CONFIG_NOT_ENABLED

What this check finds

AWS Config continuously records resource configuration changes and evaluates them against compliance rules. Without it, there is no audit trail of infrastructure changes, making security investigations and compliance reporting significantly harder.

Passing looks like: AWS Config enabled.

How to fix it

Enable AWS Config in every active region.

AWS CLI

aws configservice put-configuration-recorder --configuration-recorder name=default,roleARN=ARN && aws configservice put-delivery-channel --delivery-channel name=default,s3BucketName=BUCKET && aws configservice start-configuration-recorder --configuration-recorder-name default

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

AWS Config → Get started → Set up.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to AWS Config is not enabled in this region
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	3.3 Ensure AWS Config is enabled in all regions
PCI-DSS v4.0.1	10.7 Failures of critical security control systems are detected, reported, and responded to promptly
HIPAA Security Rule	164.308(a)(1) Security Management Process — Risk Analysis 164.308(a)(8) Evaluation
SOC 2 — Trust Services Criteria	CC4.1 Ongoing Monitoring of Controls
NIST SP 800-53 Rev5 (Moderate)	CA-7 Continuous Monitoring CM-2 Baseline Configuration CM-3 Configuration Change Control
NIST Cybersecurity Framework 2.0	PR.PS-01 Configuration management practices are applied DE.CM-09 Computing resources are monitored
ISO/IEC 27001:2022 Annex A	A.5.36 Compliance with policies, rules and standards for information security A.8.9 Configuration management A.8.16 Monitoring activities A.8.32 Change management

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs