Amazon Config Aggregator Monitoring in ObserveOps
Overview
The Amazon Config Aggregator integration with ObserveOps (formerly known as AIOps) collects cross-account and cross-region compliance telemetry from AWS Config aggregators. It monitors aggregator state, source account connectivity, aggregated compliance scores for rules and conformance packs, and per-source compliance breakdowns.
These metrics help cloud governance teams get a unified compliance view across multiple AWS accounts and regions, identify non-compliant sources, and track aggregated rule and pack scores from a single monitoring plane.
Prerequisites
- AWS Config aggregators are configured in the target AWS account.
- The IAM role or user used for integration has read access to Config aggregator resources (
config:DescribeConfigurationAggregators,config:DescribeConfigurationAggregatorSourcesStatus,config:GetAggregateComplianceDetailsByConfigRule). - Required Config API endpoints are reachable from ObserveOps.
- The AWS account is added in discovery with correct credentials and region configuration.
List of Supported KPIs
Aggregator
| Metric | Description | Type |
|---|---|---|
| aws.configaggregator.state | Current state of the Config aggregator. | String |
| aws.configaggregator.scope.sources | Number of source accounts or organizations included in the aggregator. | Count |
| aws.configaggregator.scope.sources.failed | Number of source accounts that failed to connect to the aggregator. | Count |
| aws.configaggregator.discovery.resources | Total number of resources discovered across all aggregated sources. | Count |
| aws.configaggregator.rules.compliant | Number of aggregated Config rules currently in compliant state. | Count |
| aws.configaggregator.rules.noncompliant | Number of aggregated Config rules currently in non-compliant state. | Count |
| aws.configaggregator.rules.score.percent | Aggregated compliance score across all rules as a percentage. | Percent |
| aws.configaggregator.packs.compliant | Number of aggregated conformance packs currently compliant. | Count |
| aws.configaggregator.packs.noncompliant | Number of aggregated conformance packs currently non-compliant. | Count |
| aws.configaggregator.packs.score.percent | Aggregated compliance score across all conformance packs as a percentage. | Percent |
Sources
| Metric | Description | Type |
|---|---|---|
| aws.configaggregator.source | Identifier of an individual aggregation source. | String |
| aws.configaggregator.source.region | AWS region of the aggregation source. | String |
| aws.configaggregator.source.state | Connection state of the aggregation source. | String |
| aws.configaggregator.source.error.code | Error code reported by the aggregation source. | String |
| aws.configaggregator.source.age.seconds | Time since the last successful data pull from the source in seconds. | Seconds |
| aws.configaggregator.source.rules.compliant | Number of compliant rules in this aggregation source. | Count |
| aws.configaggregator.source.rules.noncompliant | Number of non-compliant rules in this aggregation source. | Count |
| aws.configaggregator.source.packs.compliant | Number of compliant conformance packs in this aggregation source. | Count |
| aws.configaggregator.source.packs.noncompliant | Number of non-compliant conformance packs in this aggregation source. | Count |
| aws.configaggregator.rule | Identifier of an aggregated Config rule. | String |
Rules and Packs
| Metric | Description | Type |
|---|---|---|
| aws.configaggregator.rule.compliance.state | Aggregated compliance state of the Config rule. | String |
| aws.configaggregator.rule.noncompliant.resources | Number of non-compliant resources for the rule across all sources. | Count |
| aws.configaggregator.rule.noncompliant.cap.exceeded | Indicates whether the non-compliant resource cap was exceeded. | Boolean |
| aws.configaggregator.pack | Identifier of an aggregated conformance pack. | String |
| aws.configaggregator.pack.compliance.state | Aggregated compliance state of the conformance pack. | String |
| aws.configaggregator.pack.compliant.rules | Number of compliant rules within the aggregated conformance pack. | Count |
| aws.configaggregator.pack.noncompliant.rules | Number of non-compliant rules within the aggregated conformance pack. | Count |
| aws.configaggregator.pack.rules | Total number of rules in the aggregated conformance pack. | Count |