Control Towerを有効化する際に作成されるConfigアグリゲータをTerraformで管理してみた

## 管理アカウントのAggregator(組織タイプ)インポート
import {
  to = aws_config_configuration_aggregator.organization
  id = "aws-controltower-ConfigAggregatorForOrganizations"
}

## AuditアカウントのAggregator(個々のアカウントタイプ)インポート
import {
  provider = aws.audit
  to       = aws_config_configuration_aggregator.audit
  id       = "aws-controltower-GuardrailsComplianceAggregator"
}

$ terraform plan -generate-config-out=config.tf

│ Error: Not enough list items
│
│   with aws_config_configuration_aggregator.organization,
│   on import_config.tf line 10:
│   (source code not available)
│
│ Attribute organization_aggregation_source.0.regions requires 1 item minimum,
│ but config has only 0 declared.
╵
╷
│ Error: Not enough list items
│
│   with aws_config_configuration_aggregator.audit,
│   on import_config.tf line 12:
│   (source code not available)
│
│ Attribute account_aggregation_source.0.regions requires 1 item minimum, but
│ config has only 0 declared.

resource "aws_config_configuration_aggregator" "organization" {
  name = "aws-controltower-ConfigAggregatorForOrganizations"
  tags = {
    aws-control-tower = "managed-by-control-tower"
  }
  tags_all = {
    aws-control-tower = "managed-by-control-tower"
  }
  organization_aggregation_source {
    all_regions = true
    regions     = [] ←削除する
    role_arn    = "arn:aws:iam::11111111111:role/service-role/AWSControl TowerConfigAggregatorRoleForOrganizations"
  }
}

resource "aws_config_configuration_aggregator" "audit" {
  provider = aws.audit
  name     = "aws-controltower-GuardrailsComplianceAggregator"
  tags = {
    aws-control-tower = "managed-by-control-tower"
  }
  tags_all = {
    aws-control-tower = "managed-by-control-tower"
  }
  account_aggregation_source {
    account_ids = ["11111111111", "222222222222", "33333333333", "44444444444"]
    all_regions = true
    regions     = [] ←削除する
  }
}

resource "aws_organizations_delegated_administrator" "config_admin" {
  account_id       = aws_organizations_account.audit.id
  service_principal = "config.amazonaws.com"
}

# AuditアカウントのAggregator(組織タイプ)
resource "aws_config_configuration_aggregator" "audit_org" {
  provider   = aws.audit
  name       = "aws-ConfigOrganizationAggregatorForAudit"
  depends_on = [aws_iam_role_policy_attachment.organization]
  organization_aggregation_source {
    all_regions = true
    role_arn    = aws_iam_role.config.arn
  }
}

data "aws_iam_policy_document" "assume_role" {
  provider = aws.audit
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["config.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "config" {
  provider           = aws.audit
  name               = "demo-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

resource "aws_iam_role_policy_attachment" "config" {
  provider   = aws.audit
  role       = aws_iam_role.config.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRoleForOrganizations"
}