AWS Configアグリゲータで全アカウント・全リージョンのConfigレコーダー設定が一律か確認してみた

cat << 'EOF' | bash
#!/bin/bash

# 設定
ACCOUNTS=("111111111111" "222222222222") 
CONFIG_AGGREGATOR="test"
GLOBAL_REGION="ap-northeast-1"
GLOBAL_RESOURCES=("AWS::IAM::Policy" "AWS::IAM::User" "AWS::IAM::Role" "AWS::IAM::Group")

# 色とスタイル
RED="\e[41m\e[97m"; GREEN="\e[42m\e[97m"; RESET="\e[0m"
DIVIDER="============================================================"

# リージョン一覧を取得
REGIONS=$(aws configservice describe-configuration-aggregators \
  --query "ConfigurationAggregators[?ConfigurationAggregatorName=='$CONFIG_AGGREGATOR'].OrganizationAggregationSource.AwsRegions[][]" \
  --output json | jq -r '.[]')
# 各アカウントをチェック
for ACCOUNT in "${ACCOUNTS[@]}"; do
  echo -e "\n$DIVIDER\nChecking AWS Config for Account: $ACCOUNT\n$DIVIDER"

  for REGION in $REGIONS; do
    # Config Recorderの設定を取得
    CONFIG=$(aws configservice get-aggregate-resource-config \
      --configuration-aggregator-name "$CONFIG_AGGREGATOR" \
      --resource-identifier "SourceAccountId=$ACCOUNT,SourceRegion=$REGION,ResourceId=default,ResourceType=AWS::Config::ConfigurationRecorder" \
      --region "$GLOBAL_REGION" --query "ConfigurationItem.configuration" --output text 2>/dev/null)

    # 設定が存在しない場合
    if [[ -z "$CONFIG" || "$CONFIG" == "null" ]] || ! echo "$CONFIG" | jq empty &>/dev/null; then
      echo -e "${RED}[ERROR]${RESET} $REGION: No Config Recorder found"
      continue
    fi

    # 設定値を取得
    ID=$(echo "$CONFIG" | jq -r ".Id // empty")
    ROLE=$(echo "$CONFIG" | jq -r ".RoleARN // empty")
    ALL_SUPPORTED=$(echo "$CONFIG" | jq -r ".RecordingGroup.AllSupported // false")
    INCLUDE_GLOBAL=$(echo "$CONFIG" | jq -r ".RecordingGroup.IncludeGlobalResourceTypes // false")
    EXCLUDED=$(echo "$CONFIG" | jq -r ".RecordingGroup.ExclusionByResourceTypes.ResourceTypes // [] | length")
    OVERRIDES=$(echo "$CONFIG" | jq -r ".RecordingMode.RecordingModeOverrides // []")

    # チェック
    ERRORS=()
    [[ "$ID" != "default" ]] && ERRORS+=("Config Recorder ID is not 'default'")
    [[ "$ROLE" != "arn:aws:iam::$ACCOUNT:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig" ]] && \
      ERRORS+=("IAM Role ARN is incorrect")
    [[ "$ALL_SUPPORTED" != "true" ]] && ERRORS+=("AllSupported is not true")
    [[ "$EXCLUDED" -ne 0 ]] && ERRORS+=("Has excluded resource types")

    # グローバルリソース設定
    if [[ "$REGION" == "$GLOBAL_REGION" && "$INCLUDE_GLOBAL" != "true" ]]; then
      ERRORS+=("IncludeGlobalResourceTypes should be true in $GLOBAL_REGION")
    elif [[ "$REGION" != "$GLOBAL_REGION" && "$INCLUDE_GLOBAL" != "false" ]]; then
      ERRORS+=("IncludeGlobalResourceTypes should be false outside $GLOBAL_REGION")
    fi

    # グローバルリソースのオーバーライド（ap-northeast-1のみ）
    if [[ "$REGION" == "$GLOBAL_REGION" ]]; then
      OVERRIDDEN=()
      for RES in "${GLOBAL_RESOURCES[@]}"; do
        if echo "$OVERRIDES" | jq -e --arg r "$RES" '.[] | select(.ResourceTypes | contains([$r]))' &>/dev/null; then
          OVERRIDDEN+=("$RES")
        fi
      done
      [[ ${#OVERRIDDEN[@]} -gt 0 ]] && ERRORS+=("Global resources have recording overrides: ${OVERRIDDEN[*]}")
    fi

    # 結果表示
    if [[ ${#ERRORS[@]} -eq 0 ]]; then
      echo -e "${GREEN}[OK]${RESET} $REGION"
    else
      echo -e "${RED}[ERROR]${RESET} $REGION"
      for ERR in "${ERRORS[@]}"; do echo "  - $ERR"; done
    fi
  done

  echo -e "\n$DIVIDER\nCheck completed for Account: $ACCOUNT\n"
done
EOF

============================================================
Checking AWS Config for Account: 111111111111
============================================================
[OK] ap-south-1
[OK] ca-central-1
[OK] eu-central-1
[OK] us-west-1
[OK] us-west-2
[OK] eu-north-1
[OK] eu-west-3
[OK] eu-west-2
[OK] eu-west-1
[OK] ap-northeast-3
[OK] ap-northeast-2
[OK] ap-northeast-1
[OK] sa-east-1
[OK] ap-southeast-1
[OK] ap-southeast-2
[OK] us-east-1
[OK] us-east-2

============================================================
Check completed for Account: 111111111111

============================================================
Checking AWS Config for Account: 222222222222
============================================================
[OK] ap-south-1
[OK] ca-central-1
[OK] eu-central-1
[OK] us-west-1
[OK] us-west-2
[OK] eu-north-1
[OK] eu-west-3
[OK] eu-west-2
[OK] eu-west-1
[OK] ap-northeast-3
[OK] ap-northeast-2
[OK] ap-northeast-1
[OK] sa-east-1
[OK] ap-southeast-1
[OK] ap-southeast-2
[OK] us-east-1
[OK] us-east-2

============================================================
Check completed for Account: 222222222222