AWS Config Rules Just Apply in One Region

[HarleyB123]

When creating Config rules in this Terraform solution - they only deploy and monitor resources for compliance in the region of the AWS Provider you've specified. (Can test this by creating a non-compliant resource in another Region and checking the aggregator rules).

Indeed, this is stipulated in the docs here.

The API call to deploy rules and conformance packs across accounts is region specific. At the organization level, you need to change the context of your API call to a different region if you want to deploy rules in other regions. For example, to deploy a rule in US East (N. Virginia), change the region to US East (N. Virginia) and then call PutOrganizationConfigRule.

My suggestion is a null_resource and local-exec provisioner, like this:

resource "null_resource" "test" {
  triggers = {
    REGIONS = join(" ", [for s in var.aws_config_regions : format("%q", s)])
    RULES = join(" ", [for s in local.aws_config_rules : format("%q", s)])
  }
  provisioner "local-exec" {
    command = "for rule in $RULES; do for region in $REGIONS; do aws configservice put-organization-config-rule --organization-config-rule-name $(echo $rule | xargs) --organization-managed-rule-metadata  RuleIdentifier=$rule --region $(echo $region | xargs); done; done"
    environment = {
      REGIONS = join(" ", [for s in var.aws_config_regions : format("%q", s)])
      RULES = join(" ", [for s in local.aws_config_rules : format("%q", s)])
    }
}

but this was a quick hack, rather than a well-thought out design - so open to opinions