ConfigurationRecorder

Source: src/AWS/Config/ConfigurationRecorder.ts

The AWS Config configuration recorder that detects and records changes to your AWS resource configurations.

AWS allows only one customer managed configuration recorder per account per region — treat this resource as an account-region singleton. Starting the recorder (recording: true) requires a delivery channel (see AWS.Config.DeliveryChannel) and incurs per-configuration-item charges.

Creating the Recorder

Recorder with the Config service-linked role

import * as Config from "alchemy/AWS/Config";

const recorder = yield* Config.ConfigurationRecorder("Recorder", {
  roleArn: `arn:aws:iam::${accountId}:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig`,
  recordingGroup: { allSupported: true },
});

Record only specific resource types

const recorder = yield* Config.ConfigurationRecorder("Recorder", {
  roleArn: serviceLinkedRoleArn,
  recordingGroup: {
    resourceTypes: ["AWS::S3::Bucket", "AWS::EC2::SecurityGroup"],
  },
});

Recording State

const channel = yield* Config.DeliveryChannel("Channel", {
  s3BucketName: bucket.bucketName,
});
const recorder = yield* Config.ConfigurationRecorder("Recorder", {
  roleArn: serviceLinkedRoleArn,
  recording: true,
});