Do we need to create AWSServiceRoleForConfig service-linked role before an already existing AWS Config can use it?

Question

We are managing a lot of AWS accounts so we're using Cloudformation Stackset to provision resources on those accounts. Some accounts have AWS Config enabled and currently we're using a custom role. But we were alerted by AWS to use AWSServiceRoleForConfig role instead. Now we tried updating the stackset template to use that role and it succeeded, but when we checked the AWS Config in the console, it does not have the AWSServiceRoleForConfig role displayed in there. It's weird because the deployment succeeded and when checked using AWS CLI, the AWS Config is using the AWSServiceRoleForConfig role. I am not sure if this already worked or should we create the role first, then redeploy the stackset?

Riku_Kobayashi · Accepted Answer

Hello.

By default, it is automatically created when configuring AWS Config.  
If it has not been created automatically, please try running the following AWS CLI command.  
https://docs.aws.amazon.com/config/latest/developerguide/using-service-linked-roles.html  
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create-service-linked-role.html#create-service-linked-role
```
aws iam create-service-linked-role \
  --aws-service-name config.amazonaws.com
```

If you verify the AWS Config settings using the AWS CLI and confirm that the service-linked role is configured, there is no issue.

re:Post Agent · Answer

No, you do not need to manually create the AWSServiceRoleForConfig service-linked role before AWS Config can use it. When you create or update AWS Config to use the service-linked role, AWS Config automatically creates the role for you if it doesn't already exist.

Based on what you've described, it sounds like your update has actually worked correctly. The fact that the AWS CLI shows AWS Config is using the AWSServiceRoleForConfig role is the accurate indicator of your configuration's current state. The console display issue you're experiencing is likely just a UI lag or caching issue, which is not uncommon when switching from a custom role to a service-linked role.

When you use the AWS CLI or CloudFormation to configure AWS Config, the service automatically creates the AWSServiceRoleForConfig role if it's not already present in the account. Since your CloudFormation StackSet deployment succeeded and the CLI confirms the role is in use, your configuration change has been applied successfully.

To verify everything is working properly, you can:
- Check that the AWSServiceRoleForConfig role exists in IAM in each account
- Confirm AWS Config is functioning normally (recording resources, delivering to S3, etc.)
- Wait a bit and refresh the console to see if the display updates

There's no need to pre-create the role and redeploy. Your current deployment should be functioning correctly with the service-linked role, despite what the console may be showing.  
**Sources**  
[Permissions for the IAM Role Assigned to AWS Config - AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/iamrole-permissions.html)  
[Using Service-Linked Roles for AWS Config - AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/using-service-linked-roles-config.html)

Do we need to create AWSServiceRoleForConfig service-linked role before an already existing AWS Config can use it?

Add your answer

Relevant content