AWS Config insufficient delivery policy error

Question

I am currently trying to enable AWS Config notifications on multiple accounts. I have enabled monitoring on each individual account with its own S3 bucket and SNS topic, but it would make more sense to have one centralized bucket and topic. I am trying to implement this with little success. I have created an s3 bucket and target ARN but when I try and apply the changes I get an error of insufficient delivery policy

Note I am doing this through the AWS console and not with code.

Answer 1

To do this, you need two pieces:

1. The Identity and Access Management (IAM) Role being used must have permissions to deliver data to the common S3 bucket and SNS Topic. You'll need to go to the IAM Management Console, and edit the role being used by Config in each account and update the S3 bucket/SNS names in "PutObject", "GetBucketACL" and "sns:Publish"

2. You also need to allow the S3 bucket and SNS Topic to receive data from this new role. See a. http://docs.aws.amazon.com/awscloudtrail/latest/userguide/aggregating_logs_accounts_bucket_policy.html b. http://docs.aws.amazon.com/sns/latest/dg/AccessPolicyLanguage_UseCases_Sns.html