Question

A security engineer enables AWS Config in all 15 of an organization's Regions to record configuration changes. After a week, the engineer notices that IAM user, role, and policy configuration items are being recorded and stored identically in every Region, dramatically increasing Config storage costs and duplicating compliance evaluations for the same global resources. The engineer needs to keep full visibility into IAM changes while eliminating the redundant recording. What should the engineer do?

Accepted Answer

In the Config recorder settings, disable the recording of global resource types (includeGlobalResourceTypes) in all Regions except one designated home Region.

Answer

Disable AWS Config entirely in 14 Regions and rely on a single Region to record all resource types including global resources.

Answer

Create a Config aggregator in one Region so that global resources are only counted once across the organization.

Answer

Add a Config rule that suppresses duplicate configuration items for IAM resources across Regions.