Why can’t I create or delete config rules for AWS Organizations in AWS Config?

Short description

Various issues can cause organization config rules to not work, including the following examples:

• Permissions
• Inactive member accounts
• Missing configuration recorders

To resolve organization config rule errors, complete the following steps:

1. Find the status details of the member account rule.
2. Troubleshoot the cause of the rule failure.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Find the status details of the member account rule

To find the failure and success status details of the member account rule, run the get-organization-config-rule-detailed-status command:

aws configservice get-organization-config-rule-detailed-status --organization-config-rule-name your-rule-name

Note: Replace your-rule-name with your organization config rule name.

Review the output ErrorCode and ErrorMessage, for more information on why the rule fails.

Troubleshoot the cause of the rule failure

Verify that member accounts are active

To verify that all member accounts are active, run the list-accounts command:

aws organizations list-accounts --query 'Accounts[*].[Id, Status]' --output table

Configure AWS Config for member accounts

To configure AWS Config for each member account, use the console, AWS CLI, or AWS CloudFormation. After you configure AWS Config for all member accounts, run the put-organization-config-rule to deploy the rule again.

Review your event logs

Open the AWS CloudTrail console, and then choose Event history from the navigation pane. To filter the logs, choose Event name from the dropdown list, and then enter PutOrganizationConfigRule or DeleteOrganizationConfigRule in the search field. Review the filtered log results for OrganizationAccessDeniedException errors.

Update the delegated administrator member account

You must make calls from the AWS Organizations management account or from a delegated administrator member account. If you make calls, such as the PutOrganizationConfigRule API or DeleteOrganizationConfigRule API from outside of these accounts, then the calls fail.

To identify the delegated administrator member account, run the list-delegated administrators command:

aws organizations list-delegated-administrators --service-principal=config-multiaccountsetup.amazonaws.com

Update your permissions

If you receive OrganizationAccessDeniedException errors, then you might not have the required permissions. The AWS Identity and Access Management (IAM) role for AWS Config must include the following permissions to create and delete organization config rules:

• PutConfigRule
• PutOrganizationConfigRule
• DeleteOrganizationConfigRule

For more information, see Permissions for the IAM role assigned to AWS Config.

Review the error message

If you receive ResourceInUseException errors, then review the error message to identify the cause.

• If the error message indicates that a remediation action is associated with the rule, then resolve the remediation action.
• If the error message indicates that the rule status isn't CREATE_SUCCESSFUL, then verify that the AWS Config member account IAM role includes DeleteConfigRule permissions.

Create a custom organization config rule

If the AWS Lambda function resource policy doesn't allow the AWS Config service principal to invoke the policy, then run the add-permission command to provide permissions:

aws lambda add-permission --function-name function-name --region region --action "lambda:InvokeFunction" --principal config.amazonaws.com --source-account source-account --statement-id Allow

Note: Replace function-name with your Lambda function name, region with your AWS Region, and source-account with the management account ID.

To grant permissions for multiple member accounts in your organization, run the command for each member account. Replace source-account with each member account ID.

Related information

Why isn't my AWS Config rule working?