Skip to main content

Config Recorders

The Config Recorders page shows the status of every AWS Config recorder that Prism knows about, organized as a grid of accounts (rows) by regions (columns). From this page you can enable recording in new cells, disable or delete existing recorders, and refresh Prism's view of what is deployed in AWS.

Accessing Config Recorders​

Open the Security Hub from the application selection screen, then click AWS Config in the sidebar. The Config Recorders page is the default view.

The page header shows the time of the last refresh, the last time Prism reconciled its recorder state against the live AWS environment.

The Recorder Grid​

Each cell in the grid represents a single account/region pair. The row label is the AWS account ID and each column label is an AWS region. A cell shows a status chip, an optional in-progress spinner, and an optional warning badge.

Status Reference​

StatusColorMeaning
noneGreyNo recorder exists in this cell. No AWS Config recording is happening.
enablingBluePrism is provisioning the recorder, S3 bucket, and delivery channel in this cell.
enabledGreenThe recorder is running and delivering configuration snapshots. Standards can evaluate resources in this cell.
disablingAmberPrism is stopping the recorder. The recorder resource itself is kept; only recording stops.
disabledGreyThe recorder exists but is stopped. No new configuration items are being recorded.
removingAmberPrism is deleting the recorder and, if it is the last recorder in the account, the Prism-managed S3 bucket.
failedRedThe last provisioning or state-change operation failed. Hover over the chip to see the error message.
externalPurpleAn AWS Config recorder exists in this cell but was not created by Prism. It is already recording and feeds Security Hub standards, but Prism cannot manage it.

Cells in the enabling, disabling, and removing states show a spinner next to the chip. The grid auto-polls while any cell is mid-operation, refreshing every few seconds until all active operations settle.

info

external cells are non-selectable; you cannot enable, disable, or delete a recorder that Prism does not manage. The cell already feeds Security Hub standards, so no action is required.

The Unmapped Warning Badge​

A cell in the enabled state may additionally show a ! warning badge. This means one or more of your enabled standards have controls that require resource types not included in the minimal recording scope for this cell. Switch the affected cell to Record all scope to ensure those controls can produce results.

Choosing Recording Scope​

Before enabling recorders, select a recording scope from the toolbar:

  • Minimal scope: records only the resource types your currently enabled standards need. This is the recommended starting point and is sufficient for full evaluation in most configurations.
  • Record all: records every supported resource type in the region. Choose this if you see an unmapped warning badge on an enabled cell or if you have compliance requirements that go beyond your currently enabled standards.

The scope selector applies to the next Enable action you perform. Changing the scope does not retroactively alter existing enabled recorders; use Disable then Enable with the new scope to change the scope of an existing recorder.

Enabling Recorders​

  1. Identify the account/region cells where you want to start recording. Cells with status none, disabled, or failed are available to enable.
  2. Select a recording scope from the toolbar: Minimal scope or Record all.
  3. Check the checkbox inside each target cell. The toolbar shows the count of selected cells.
  4. Click Enable.

Prism immediately begins provisioning the recorder, S3 bucket, and delivery channel in each selected cell. Each cell transitions to enabling while the operation runs. The grid auto-polls and updates the chip when the cell reaches enabled or failed.

info

Enabling a recorder in a fresh account/region pair takes a few minutes. AWS IAM propagation is the main source of delay; Prism retries automatically if it encounters an IAM race condition during provisioning.

Disabling Recorders​

Disabling a recorder stops the recording of configuration items but keeps the recorder resource and its S3 delivery channel in place. Use Disable when you want to pause recording without losing the recorder configuration, for example, if you are temporarily removing a region from CSPM standards.

  1. Check the checkbox inside each enabled cell you want to stop.
  2. Click Disable in the toolbar.

Each selected cell transitions to disabling and then to disabled once the operation completes. The grid auto-polls until all selected cells settle.

Deleting Recorders​

Deleting a recorder permanently removes it from AWS. If the deleted recorder was the last recorder in the account, Prism also removes the Prism-managed S3 bucket (ckprism-awsconfig-{accountId}) and its recorded configuration history.

warning

Deleting a recorder and its associated S3 bucket is irreversible. All configuration history stored in that bucket is permanently lost. Ensure you do not need that history before confirming the deletion.

  1. Check the checkbox inside each enabled, disabled, or failed cell you want to delete.
  2. Click Delete (shown in red) in the toolbar.
  3. A confirmation dialog appears listing how many cells will be affected and warning that the last-recorder S3 history is removed. Read the warning carefully.
  4. Click Delete in the dialog to confirm, or Cancel to abort.

Each selected cell transitions to removing and then disappears from the grid (or shows none if the column still exists for other accounts) once the deletion completes.

Refreshing the Grid​

The Refresh operation reconciles Prism's recorder state against the live AWS environment and also captures a fresh snapshot of the Config Rules for all active recorders.

Click Refresh in the page header to start a refresh. A progress bar appears below the header while the job runs. The bar shows the operation label and a completion percentage.

info

Refresh is idempotent: running it multiple times does not harm any recorder. The Last refreshed timestamp in the page header updates when the job completes.

The Refresh button is disabled while a refresh job is already running. Wait for the current job to finish before starting another.

Adding a Region Column​

The grid initially shows the AWS regions that your Security Hub CSPM linking configuration includes, plus any regions where recorders already exist. To add a column for a region not yet in the grid:

  1. Click Add region (the + button above the top-right corner of the grid).
  2. A menu lists all standard AWS commercial regions not already shown. Select the region you want.

The new column appears in the grid immediately with none status for all accounts. You can then select cells in that column and enable recorders.

info

Opt-in regions (such as ap-east-1), AWS GovCloud regions, and AWS China regions are not offered in the Add region picker. If you need recording in those regions, contact CloudKeeper.