Skip to main content

AWS Config Multi-Stack Deployment

Background​

AWS Config allows one configuration recorder and one delivery channel per account and region. CloudForge separates these singleton resources from the Config rules:

  • awsConfigEnabled controls Config rules, conformance packs, and remediation configurations.
  • createConfigInfrastructure controls the recorder, delivery channel, and Config bucket. It applies only when awsConfigEnabled is also true. Both default to false.

If createConfigInfrastructure is true but a recorder already exists in the region, CloudForge logs a warning and skips creating the infrastructure.

First Stack (Primary)​

Set createConfigInfrastructure=true on exactly one stack per account and region:

{
  "stackName": "stack1",
  "context": {
    "awsConfigEnabled": true,
    "createConfigInfrastructure": true
  }
}

This stack will create:

  • Configuration Recorder: cloudforge-config-recorder
  • Delivery Channel: cloudforge-config-channel
  • S3 bucket for Config delivery (name generated by CloudFormation; its ARN is stored in SSM at /cloudforge/shared/{region}/stack/{stackName}/config/bucket-arn)
  • A custom resource that starts the recorder
  • Config rules

Subsequent Stacks​

Set createConfigInfrastructure=false (or omit it):

{
  "stackName": "stack2",
  "context": {
    "awsConfigEnabled": true,
    "createConfigInfrastructure": false
  }
}

This stack:

  • Creates its own Config rules, which evaluate against the existing recorder cloudforge-config-recorder
  • Does not create a recorder, delivery channel, or Config bucket

All stacks in the region share the recorder and delivery channel created by the primary stack.

Best Practices​

  1. One infrastructure stack per region: Set createConfigInfrastructure=true on one stack only
  2. Disable for testing: Set awsConfigEnabled=false for test stacks
  3. Manual cleanup: If a recorder remains after its stack was deleted, delete it manually: 
    aws configservice delete-configuration-recorder --configuration-recorder-name cloudforge-config-recorder
    aws configservice delete-delivery-channel --delivery-channel-name cloudforge-config-channel

References​