I am trying to figure out the why is AWS Config allowed to record some ResourceType(s) in one of our AWS account but not in other.
CloudWatch Metrics show ConfigurationRecorderInsufficientPermissionFailure in one account but both ConfigurationItemsRecorded and ConfigurationRecorderInsufficientPermissionFailure in another account for SAME ResourceTypes and also records the changes. Config was setup with the same stack in both accounts and have same policies.
Here are the screenshots of the same:
Notice AWS::EC2::Subnet has both the metrics and config records the respective changes as well.
Ignore the regions, we use 4 different regions and it is the same in all regions in respective accounts.
How can I figure out why is this the case? Both the setups (and rules) are handled centrally by an account I don't have access to, so I can't manage individual ResourceTypes. Just need to figure out where to look to replicate the conditions in both accounts.