AWS Organizationsを使用できない場合にAWS Configを全リージョンで有効化する方法 [AWS CloudFormationテンプレート付き]

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::${ソースアカウントのAWSID}:root"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::${S3バケット名}/*"
        }
    ]
}

AWSTemplateFormatVersion: 2010-09-09
Description: Configure the AWSCloudFormationStackSetAdministrationRole to enable use of AWS CloudFormation StackSets.

Parameters:
  AdministrationRoleName:
    Type: String
    Default: AWSCloudFormationStackSetAdministrationRole
    Description: "The name of the administration role. Defaults to 'AWSCloudFormationStackSetAdministrationRole'."
  ExecutionRoleName:
    Type: String
    Default: AWSCloudFormationStackSetExecutionRole
    Description: "The name of the execution role that can assume this role. Defaults to 'AWSCloudFormationStackSetExecutionRole'."

Resources:
  AdministrationRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref AdministrationRoleName
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: AssumeRole-AWSCloudFormationStackSetExecutionRole
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - !Sub 'arn:*:iam::*:role/${ExecutionRoleName}'

AWSTemplateFormatVersion: 2010-09-09
Description: Configure the AWSCloudFormationStackSetExecutionRole to enable use of your account as a target account in AWS CloudFormation StackSets.

Parameters:
  AdministratorAccountId:
    Type: String
    Description: AWS Account Id of the administrator account (the account in which StackSets will be created).
    MaxLength: 12
    MinLength: 12
  ExecutionRoleName:
    Type: String
    Default: AWSCloudFormationStackSetExecutionRole
    Description: "The name of the execution role. Defaults to 'AWSCloudFormationStackSetExecutionRole'."

Resources:
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref ExecutionRoleName
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - !Ref AdministratorAccountId
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess

Cfnテンプレート: PreAWSConfigAggregator

アグリゲータアカウントで集約するアグリゲータアカウント自身およびソースアカウントのAWS Configデータを集約するためのAmazon S3バケットを作成します。また、アグリゲータアカウント自身のAWS Config用のAWS IAMロールを作成します。

AWSTemplateFormatVersion: "2010-09-09"

Parameters:
  AdministratorAccountS3Bucket:
    Description: AWS account S3Bucket of the administrator account (security monitoring administrator account)
    Type: String

Resources:
  ConfigRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: AWSConfigCustomRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: config.amazonaws.com
            Action: "sts:AssumeRole"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWS_ConfigRole
      Policies:
        - PolicyName: ConfigS3BucketAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:PutObject"
                  - "s3:PutObjectAcl"
                Resource:
                  - !Sub "arn:aws:s3:::${AdministratorAccountS3Bucket}/AWSLogs/*"
                Condition:
                  StringLike:
                    "s3:x-amz-acl": "bucket-owner-full-control"
              - Effect: Allow
                Action:
                  - "s3:GetBucketAcl"
                Resource: "arn:aws:s3:::${AdministratorAccountS3Bucket}"

Outputs:
  ConfigRoleArn:
    Description: ARN of the IAM role for AWS Config
    Value: !GetAtt ConfigRole.Arn

AWSTemplateFormatVersion: "2010-09-09"
Conditions:
  IncludeGlobalResourceRegion: !Equals [!Ref AWS::Region, us-east-1]

Parameters:
  AdministratorAccountS3Bucket:
    Description: AWS account S3Bucket of the administrator account (security monitoring administrator account)
    Type: String

Resources:
  ConfigRecorder:
    Type: AWS::Config::ConfigurationRecorder
    Properties:
      Name: !Sub "config-${AWS::AccountId}"
      RecordingGroup:
        AllSupported: true
        IncludeGlobalResourceTypes:
          !If [IncludeGlobalResourceRegion, true, false]
      RoleARN: !Sub arn:aws:iam::${AWS::AccountId}:role/AWSConfigCustomRole
  ConfigDeliveryChannel:
    Type: AWS::Config::DeliveryChannel
    Properties:
      Name: !Sub "config-${AWS::AccountId}"
      S3BucketName: !Ref AdministratorAccountS3Bucket
      ConfigSnapshotDeliveryProperties:
        DeliveryFrequency: TwentyFour_Hours

Outputs:
  ConfigRecorderName:
    Description: Name of the AWS Config Recorder
    Value: !Ref ConfigRecorder
  DeliveryChannelName:
    Description: Name of the AWS Config Delivery Channel
    Value: !Ref ConfigDeliveryChannel