Instructor: So a question that has come up in the exam
is around AWS Config aggregators, so what is it?
Well, say you are managing multiple accounts
and multiple regions within these accounts.
So we have Account A, Account B,
and they're called "source accounts", why?
Because they all have a deployment of AWS Config.
But you want to aggregate all this information
into a central AWS account.
And this account is called an aggregator account,
and this is only in the aggregator account
that you're going to create an aggregator, okay?
From the aggregator, you're going to get an aggregated view,
which is allowing you to see all the compliant
and non-compliant resources across all your accounts
and all your regions.
So that makes a lot of sense,
to have this kind of aggregation.
So remember,
the aggregator is created in only one central account,
they're not created in each individual source accounts.
Then this aggregator will aggregate
everything that is available in the target accounts,
for example, rules, resources, et cetera,
across multiple accounts and multiple regions.
And if you are using AWS Organization,
then there is no need to do authorization
at the individual accounts, okay?
You just create your aggregator
in your management account in Organization,
and the authorizations will happen automatically.
But if you're not using AWS Organizations
then you would need to create an authorization
in an account A to say
"Hey, I authorize the AWS accounts aggregator
"to collect data,"
and then you would create a second authorization,
obviously in Account B, to do the exact same thing.
Once these authorizations are in place,
and this is only, again,
if you're not using AWS Organizations,
then the aggregator will be able to collect data,
to pull data from these targeted accounts
and aggregate them.
Now the rules management
is done at the individual account level, okay?
So the aggregator is just here to aggregate data,
it's not here to centralize rules, and so on.
So if you want to deploy rules across multiple accounts,
the best way to do it, in multiple regions, obviously,
the best way to do it would be
to use CloudFormation StackSets,
which allows you to deploy a CloudFormation Stack
across multiple accounts and multiple regions.
So I hope this makes sense, I hope you liked it,
and I will see you in the next lecture.