Config.1: AWS Config is off, so most other controls cannot evaluate

What does AWS Security Hub Config.1 check?

Config.1 ("AWS Config should be enabled and use the service-linked role for resource recording") fails when AWS Config is not enabled in the current Region, isn't recording all the resource types your enabled controls require, or isn't using the service-linked role AWSServiceRoleForConfig. (You can opt out of just the role check by setting the includeConfigServiceLinkedRoleCheck parameter to false.)

Why does Config.1 matter?

AWS Config is the engine many Security Hub controls rely on to evaluate resource state over time. If Config is off, a large share of your other controls simply cannot run, so a green dashboard may just mean nothing is being measured. It is also your record of configuration drift and change history.

How do I fix Config.1?

1. Enable AWS Config with the service-linked role AWSServiceRoleForConfig, and record every resource type that your enabled Security Hub controls require (including IAM global resources in your home Region).
2. Keep recording running continuously; either daily or continuous recording mode is fine, as long as the required resource types are covered.
3. Deploy Config across all active Regions and accounts, ideally via the organization aggregator. Note: when Security Hub CSPM is enabled, this control is satisfied by the service-linked configuration recorder and always returns PASSED.

# 1. AWS Config: bind to the service-linked role, record all resources, then start.
ACCOUNT=$(aws sts get-caller-identity --query Account --output text)
aws iam create-service-linked-role --aws-service-name config.amazonaws.com 2>/dev/null || true
aws configservice put-configuration-recorder \
  --configuration-recorder "name=default,roleARN=arn:aws:iam::${ACCOUNT}:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig,recordingGroup={allSupported=true,includeGlobalResourceTypes=true}"
aws configservice start-configuration-recorder --configuration-recorder-name default

# 2. IAM Access Analyzer: create an external access analyzer in this Region.
aws accessanalyzer create-analyzer --analyzer-name external-access --type ACCOUNT

# 3. Systems Manager: enroll an instance role, then confirm it is managed.
aws iam attach-role-policy --role-name app-instance-role \
  --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
aws ssm describe-instance-information \
  --query 'InstanceInformationList[].{Id:InstanceId,Ping:PingStatus}' --output table