AWS Config stuck at "Currently in progress" when deploying with AWS CDK

Question

I want to use AWS CDK to deploy AWS Config. The deploy gets stuck at:

Currently in progress: AWSConfig, MyCfnConfigurationRecorder, MyCfnDeliveryChannel

from aws_cdk import (
    Stack,
    aws_config as config,
    aws_iam as role,
    aws_s3 as s3,
    RemovalPolicy
)
from constructs import Construct
import os,sys, json

class AWSConfig(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        # create role arn for AWS Config
        config_role = role.Role(self,"Role",
            assumed_by= role.ServicePrincipal("config.amazonaws.com"),
            managed_policies=[
                role.ManagedPolicy.from_aws_managed_policy_name('service-role/AWS_ConfigRole')
                ],
            role_name="AWS_Role"
        )
        # Create S3 bucket store AWS Config Snapshot and GuardDuty Finding
        s3bucket = s3.Bucket(self,"MyBucket",
            encryption= s3.BucketEncryption.S3_MANAGED,
            block_public_access=s3.BlockPublicAccess.BLOCK_ALL,
            bucket_name="guardduty-config-finding",
            removal_policy=RemovalPolicy.DESTROY
        )
        # Create AWS Config
        cfn_configuration_recorder = config.CfnConfigurationRecorder(self, "MyCfnConfigurationRecorder",
            role_arn="arn:aws:iam::09xxxxxxxx:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig",
        # the properties below are optional
            recording_group=config.CfnConfigurationRecorder.RecordingGroupProperty(
                all_supported=True,
                include_global_resource_types=False
    )
        )
        cfn_delivery_channel = config.CfnDeliveryChannel(self, "MyCfnDeliveryChannel",
            s3_bucket_name=s3bucket.bucket_name,
        # the properties below are optional
            config_snapshot_delivery_properties=config.CfnDeliveryChannel.ConfigSnapshotDeliveryPropertiesProperty(
                delivery_frequency="TwentyFour_Hours"
            ),
            name="delivery-channel"
        )

Whats the problem? Wait until stack update fail - it will eventually, then add error message to post — Lasek, Jul 29 '22 at 07:34

score 0 · Answer 1 · answered Oct 21 '22 at 16:46

The deploy is failing because your role is missing some required IAM permissions.

Here are the IAM policies the Configuration Recorder requires. The S3 policies are required. The SNS and KMS policies are required only if you are using SNS as a delivery method or SSE-KMS to encrypt the bucket.

Add them to your role as inline_policies: aws_iam:PolicyDocument.

AWS Config stuck at "Currently in progress" when deploying with AWS CDK

1 Answers1