Enable trusted access between AWS Organizations and AWS Config

Overview

This setup allows AWS Config to perform cross-account operations without requiring administrators to manually configure permission policies in each account.

The following steps include:

  • enable the core AWS Config service integration
  • enable multi-account deployment and aggregation features

Steps to follow

  1. Sign in to the AWS Management Console as the management account and open AWS Config.

  2. Open AWS CloudShell. Activate trusted access banner

  3. Execute the following two commands:

    aws organizations enable-aws-service-access --service-principal=config-multiaccountsetup.amazonaws.com

    aws organizations enable-aws-service-access --service-principal=config.amazonaws.com