Search code examples
amazon-web-servicesaws-organizationsaws-config

Is it possible to remediate AWS config rules from Centralized account?

If I do AWS config Multi account configuration and aggregate all the data to the centralized account.

Could I configure rules and create remediate actions from the centralized account ?

Does cross account remediation work for AWS config?

Solution

  • Does cross account remediation work for AWS config?

    Its possible, but this is something that needs to be setup and is not provided out-of-the box. Such setup could involve:

    • a remediation lambda function in the master account.
    • IAM roles in member accounts that the lambda can assume.
    • SSM document created in the master account and shared with the member accounts.

    An example of such architecture with CloudFormation templates and explanation is given in Manage custom AWS Config rules with remediation using conformance packs