![AWS Config の個別アカウントアグリゲータを AWS CLI で作成する](https://devio2023-media.developers.io/wp-content/uploads/2023/08/aws-config.png)
AWS Config の個別アカウントアグリゲータを AWS CLI で作成する
AWS Config アグリゲータを AWS CLI で設定してみました。Config アグリゲータには個別アカウントアグリゲータと組織アグリゲータがあり、今回は個別アカウントアグリゲータを対象としています(非 AWS Organizations 環境でも利用できるアグリゲータです)。
なお、組織アグリゲータを AWS CLI で設定する方法は別のブログで紹介されています。
AWS CLI で個別アカウントアグリゲータの設定
AWS CLI を用いて次の流れで個別アカウントアグリゲータを設定します。
- 個別アカウントアグリゲータを作成
- 招待された AWS アカウントで承認
- アグリゲータに集約対象の AWS アカウントを追加
個別アカウントアグリゲータを作成
アグリゲータの作成はput-configuration-aggregator
コマンドです。
- put-configuration-aggregator — AWS CLI 1.32.77 Command Reference
- put-configuration-aggregator — AWS CLI 2.15.35 Command Reference
今回は、東京リージョンにおいて次の設定で有効化します。
- 個別アカウントアグリゲータとする
- 対象アカウントはアグリゲータを作成するアカウント
111122223333
と招待するアカウント444455556666
とする - 対象リージョンは全てとして、将来の AWS リージョンも含める
aws configservice put-configuration-aggregator \ --configuration-aggregator-name test-aggregator \ --account-aggregation-sources '[{"AccountIds":["111122223333","444455556666"],"AllAwsRegions":true}]'
実行結果例です。
$ aws configservice put-configuration-aggregator \ > --configuration-aggregator-name test-aggregator \ > --account-aggregation-sources '[{"AccountIds":["111122223333","444455556666"],"AllAwsRegions":true}]' { "ConfigurationAggregator": { "ConfigurationAggregatorName": "test-aggregator", "ConfigurationAggregatorArn": "arn:aws:config:ap-northeast-1:111122223333:config-aggregator/config-aggregator-hdg7jddo", "AccountAggregationSources": [ { "AccountIds": [ "111122223333", "444455556666" ], "AllAwsRegions": true } ], "CreationTime": "2024-04-04T00:41:46.900000+00:00", "LastUpdatedTime": "2024-04-04T00:47:04.231000+00:00" } }
describe-configuration-aggregators
コマンドで作成済みのアグリゲータを確認できます。
$ aws configservice describe-configuration-aggregators { "ConfigurationAggregators": [ { "ConfigurationAggregatorName": "test-aggregator", "ConfigurationAggregatorArn": "arn:aws:config:ap-northeast-1:111122223333:config-aggregator/config-aggregator-hdg7jddo", "AccountAggregationSources": [ { "AccountIds": [ "111122223333", "444455556666" ], "AllAwsRegions": true } ], "CreationTime": "2024-04-04T00:41:46.900000+00:00", "LastUpdatedTime": "2024-04-04T00:47:04.233000+00:00" } ] }
招待された AWS アカウントで承認
アグリゲータ作成時に招待したアカウントにおいて、招待の承認をします。アグリゲータを作成したアカウント内では承認は不要なため、招待したアカウントのみの手順となります。
招待状況はdescribe-pending-aggregation-requests
コマンドを確認できます。下記は東京リージョンの招待を確認するコマンド例です。
$ aws configservice describe-pending-aggregation-requests --region ap-northeast-1 { "PendingAggregationRequests": [ { "RequesterAccountId": "111122223333", "RequesterAwsRegion": "ap-northeast-1" } ] }
マネジメントコンソールではアグリゲータの認証設定から招待を確認できます。
招待はリージョン単位で実施されているため、承認も全てのリージョンで実施します。承認はput-aggregation-authorization
コマンドで実行できます。authorized-aws-region
オプションではアグリゲータを作成しているリージョンを指定します。
aws --output text ec2 describe-regions --query "Regions[].[RegionName]" \ | while read region; do echo "### Put aggregation authorization in ${region}" aws configservice put-aggregation-authorization \ --authorized-account-id 111122223333 \ --authorized-aws-region ap-northeast-1 \ --region ${region} done
実行結果例です。
$ aws --output text ec2 describe-regions --query "Regions[].[RegionName]" \ > | while read region; do > echo "### Put aggregation authorization in ${region}" > aws configservice put-aggregation-authorization \ > --authorized-account-id 111122223333 \ > --authorized-aws-region ap-northeast-1 \ > --region ${region} > done ### Put aggregation authorization in ap-south-1 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:ap-south-1:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:18:50.047000+00:00" } } ### Put aggregation authorization in eu-north-1 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:eu-north-1:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:18:51.913000+00:00" } } ### Put aggregation authorization in eu-west-3 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:eu-west-3:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:18:53.839000+00:00" } } ### Put aggregation authorization in eu-west-2 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:eu-west-2:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:18:55.977000+00:00" } } ### Put aggregation authorization in eu-west-1 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:eu-west-1:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:18:57.872000+00:00" } } ### Put aggregation authorization in ap-northeast-3 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:ap-northeast-3:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:18:59.085000+00:00" } } ### Put aggregation authorization in ap-northeast-2 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:ap-northeast-2:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:19:00.147000+00:00" } } ### Put aggregation authorization in ap-northeast-1 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:ap-northeast-1:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:19:01.293000+00:00" } } ### Put aggregation authorization in ca-central-1 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:ca-central-1:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:19:03.150000+00:00" } } ### Put aggregation authorization in sa-east-1 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:sa-east-1:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:19:05.398000+00:00" } } ### Put aggregation authorization in ap-southeast-1 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:ap-southeast-1:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:19:06.820000+00:00" } } ### Put aggregation authorization in ap-southeast-2 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:ap-southeast-2:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:19:08.358000+00:00" } } ### Put aggregation authorization in eu-central-1 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:eu-central-1:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:19:10.295000+00:00" } } ### Put aggregation authorization in us-east-1 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:us-east-1:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:19:11.984000+00:00" } } ### Put aggregation authorization in us-east-2 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:us-east-2:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:19:13.566000+00:00" } } ### Put aggregation authorization in us-west-1 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:us-west-1:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:19:15.175000+00:00" } } ### Put aggregation authorization in us-west-2 { "AggregationAuthorization": { "AggregationAuthorizationArn": "arn:aws:config:us-west-2:444455556666:aggregation-authorization/111122223333/ap-northeast-1", "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1", "CreationTime": "2024-04-04T01:19:16.745000+00:00" } }
実行後は保留中の招待はなくなっています。東京リージョンの招待を確認してみます。
$ aws configservice describe-pending-aggregation-requests --region ap-northeast-1 { "PendingAggregationRequests": [] }
マネジメントコンソールにおいてもステータスは承認済
になっています。
招待の設定を確認する場合はdescribe-aggregation-authorizations
コマンドで確認できます。
aws --output text ec2 describe-regions --query "Regions[].[RegionName]" \ | while read region; do echo "### Describe aggregation authorizations in ${region}" aws configservice describe-aggregation-authorizations \ --query 'AggregationAuthorizations[*].{AuthorizedAccountId:AuthorizedAccountId,AuthorizedAwsRegion:AuthorizedAwsRegion}' \ --region ${region} done
実行結果例です。
$ aws --output text ec2 describe-regions --query "Regions[].[RegionName]" \ > | while read region; do > echo "### Describe aggregation authorizations in ${region}" > aws configservice describe-aggregation-authorizations \ > --query 'AggregationAuthorizations[*].{AuthorizedAccountId:AuthorizedAccountId,AuthorizedAwsRegion:AuthorizedAwsRegion}' \ > --region ${region} > done ### Describe aggregation authorizations in ap-south-1 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in eu-north-1 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in eu-west-3 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in eu-west-2 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in eu-west-1 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in ap-northeast-3 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in ap-northeast-2 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in ap-northeast-1 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in ca-central-1 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in sa-east-1 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in ap-southeast-1 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in ap-southeast-2 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in eu-central-1 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in us-east-1 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in us-east-2 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in us-west-1 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ] ### Describe aggregation authorizations in us-west-2 [ { "AuthorizedAccountId": "111122223333", "AuthorizedAwsRegion": "ap-northeast-1" } ]
以上で、招待の承認は終わりです。
アグリゲータに集約対象の AWS アカウントを追加
次に、作成済みのアグリゲータにアカウントを追加してみます。設定変更の場合も、アグリゲータ作成時と同様にput-configuration-aggregator
コマンドを利用します。
アグリゲータの対象アカウントを指定するaccount-aggregation-sources
オプションにおいて、追加のアカウント777788889999
を指定します。このとき、既存のアカウントも含める必要があります。
aws configservice put-configuration-aggregator \ --configuration-aggregator-name test-aggregator \ --account-aggregation-sources '[{"AccountIds":["111122223333","444455556666","777788889999"],"AllAwsRegions":true}]'
実行結果例です。
$ aws configservice put-configuration-aggregator \ > --configuration-aggregator-name test-aggregator \ > --account-aggregation-sources '[{"AccountIds":["111122223333","444455556666","777788889999"],"AllAwsRegions":true}]' { "ConfigurationAggregator": { "ConfigurationAggregatorName": "test-aggregator", "ConfigurationAggregatorArn": "arn:aws:config:ap-northeast-1:111122223333:config-aggregator/config-aggregator-hdg7jddo", "AccountAggregationSources": [ { "AccountIds": [ "111122223333", "444455556666", "777788889999" ], "AllAwsRegions": true } ], "CreationTime": "2024-04-04T00:41:46.900000+00:00", "LastUpdatedTime": "2024-04-04T02:25:13.045000+00:00" } }
後は、新しく追加したアカウントにおいて「招待された AWS アカウントで承認」の手順を実施します。
(参考)アグリゲータの承認を削除する
アグリゲータの設定を検証する際に、承認した招待や保留中の招待を削除したい場合もあると思います。そのコマンド例を紹介します。
始めに、全てのリージョンにおいて承認済みの状態を削除するコマンドです。
aws --output text ec2 describe-regions --query "Regions[].[RegionName]" \ | while read region; do echo "### Delete aggregation authorization in ${region}" aws configservice delete-aggregation-authorization \ --authorized-account-id 111122223333 \ --authorized-aws-region ap-northeast-1 \ --region ${region} done
実行結果例です。
$ aws --output text ec2 describe-regions --query "Regions[].[RegionName]" \ > | while read region; do > echo "### Delete aggregation authorization in ${region}" > aws configservice delete-aggregation-authorization \ > --authorized-account-id 111122223333 \ > --authorized-aws-region ap-northeast-1 \ > --region ${region} > done ### Delete aggregation authorization in ap-south-1 ### Delete aggregation authorization in eu-north-1 ### Delete aggregation authorization in eu-west-3 ### Delete aggregation authorization in eu-west-2 ### Delete aggregation authorization in eu-west-1 ### Delete aggregation authorization in ap-northeast-3 ### Delete aggregation authorization in ap-northeast-2 ### Delete aggregation authorization in ap-northeast-1 ### Delete aggregation authorization in ca-central-1 ### Delete aggregation authorization in sa-east-1 ### Delete aggregation authorization in ap-southeast-1 ### Delete aggregation authorization in ap-southeast-2 ### Delete aggregation authorization in eu-central-1 ### Delete aggregation authorization in us-east-1 ### Delete aggregation authorization in us-east-2 ### Delete aggregation authorization in us-west-1 ### Delete aggregation authorization in us-west-2
承認一覧の確認コマンドです(再掲)。承認が削除されたことを確認する場合に利用できます。
aws --output text ec2 describe-regions --query "Regions[].[RegionName]" \ | while read region; do echo "### Describe aggregation authorizations in ${region}" aws configservice describe-aggregation-authorizations \ --query 'AggregationAuthorizations[*].{AuthorizedAccountId:AuthorizedAccountId,AuthorizedAwsRegion:AuthorizedAwsRegion}' \ --region ${region} done
承認削除後の実行結果例です。承認がないことを確認できます。
$ aws --output text ec2 describe-regions --query "Regions[].[RegionName]" \ > | while read region; do > echo "### Describe aggregation authorizations in ${region}" > aws configservice describe-aggregation-authorizations \ > --query 'AggregationAuthorizations[*].{AuthorizedAccountId:AuthorizedAccountId,AuthorizedAwsRegion:AuthorizedAwsRegion}' \ > --region ${region} > done ### Describe aggregation authorizations in ap-south-1 [] ### Describe aggregation authorizations in eu-north-1 [] ### Describe aggregation authorizations in eu-west-3 [] ### Describe aggregation authorizations in eu-west-2 [] ### Describe aggregation authorizations in eu-west-1 [] ### Describe aggregation authorizations in ap-northeast-3 [] ### Describe aggregation authorizations in ap-northeast-2 [] ### Describe aggregation authorizations in ap-northeast-1 [] ### Describe aggregation authorizations in ca-central-1 [] ### Describe aggregation authorizations in sa-east-1 [] ### Describe aggregation authorizations in ap-southeast-1 [] ### Describe aggregation authorizations in ap-southeast-2 [] ### Describe aggregation authorizations in eu-central-1 [] ### Describe aggregation authorizations in us-east-1 [] ### Describe aggregation authorizations in us-east-2 [] ### Describe aggregation authorizations in us-west-1 [] ### Describe aggregation authorizations in us-west-2 []
次に、全てのリージョンにおいて保留中の招待を削除するコマンドです。requester-account-id
とrequester-aws-region
オプションはアグリゲータ設定があるアカウントとリージョンを指定します。
aws --output text ec2 describe-regions --query "Regions[].[RegionName]" \ | while read region; do echo "### Delete pending aggregation request in ${region}" aws configservice delete-pending-aggregation-request \ --requester-account-id 111122223333 \ --requester-aws-region ap-northeast-1 \ --region ${region} done
実行結果例です。
$ aws --output text ec2 describe-regions --query "Regions[].[RegionName]" \ > | while read region; do > echo "### Delete pending aggregation request in ${region}" > aws configservice delete-pending-aggregation-request \ > --requester-account-id 111122223333 \ > --requester-aws-region ap-northeast-1 \ > --region ${region} > done ### Delete pending aggregation request in ap-south-1 ### Delete pending aggregation request in eu-north-1 ### Delete pending aggregation request in eu-west-3 ### Delete pending aggregation request in eu-west-2 ### Delete pending aggregation request in eu-west-1 ### Delete pending aggregation request in ap-northeast-3 ### Delete pending aggregation request in ap-northeast-2 ### Delete pending aggregation request in ap-northeast-1 ### Delete pending aggregation request in ca-central-1 ### Delete pending aggregation request in sa-east-1 ### Delete pending aggregation request in ap-southeast-1 ### Delete pending aggregation request in ap-southeast-2 ### Delete pending aggregation request in eu-central-1 ### Delete pending aggregation request in us-east-1 ### Delete pending aggregation request in us-east-2 ### Delete pending aggregation request in us-west-1 ### Delete pending aggregation request in us-west-2
保留中の招待一覧の確認するコマンドです。削除後の確認に利用できます。
aws --output text ec2 describe-regions --query "Regions[].[RegionName]" \ | while read region; do echo "### Describe pending aggregation requests in ${region}" aws configservice describe-pending-aggregation-requests --region ${region} done
実行結果例です。招待されている承認がないことを確認できます。
$ aws --output text ec2 describe-regions --query "Regions[].[RegionName]" \ > | while read region; do > echo "### Describe pending aggregation requests in ${region}" > aws configservice describe-pending-aggregation-requests --region ${region} > done ### Describe pending aggregation requests in ap-south-1 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in eu-north-1 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in eu-west-3 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in eu-west-2 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in eu-west-1 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in ap-northeast-3 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in ap-northeast-2 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in ap-northeast-1 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in ca-central-1 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in sa-east-1 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in ap-southeast-1 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in ap-southeast-2 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in eu-central-1 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in us-east-1 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in us-east-2 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in us-west-1 { "PendingAggregationRequests": [] } ### Describe pending aggregation requests in us-west-2 { "PendingAggregationRequests": [] }
さいごに
AWS Config の個別アカウントアグリゲータを AWS CLI で作成・設定変更する手順を調べる機会がありましたので、備忘録ついでにブログ化しました。アグリゲータの作成から招待の承認まで AWS CLI で一通りできることを確認できました。
以上、このブログがどなたかのご参考になれば幸いです。