From 19748a27d36657ed5a1fe866c1ff2ddb20bc17c0 Mon Sep 17 00:00:00 2001 From: Cris Daniluk Date: Tue, 7 Jul 2026 14:42:37 -0400 Subject: [PATCH] fix: allow NO_REGIONS finding aggregator linking mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Central configuration requires the finding aggregator to exist (DeleteFindingAggregator: 'You must ... disable central configuration in order to remove or change your aggregation Region'). NO_REGIONS is AWS's supported way to run central config without cross-region aggregation — needed when linked regions lack AWS Config coverage and policy associations would otherwise fail enabling standards there. --- variables.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/variables.tf b/variables.tf index e9ab53a..6fe5a49 100644 --- a/variables.tf +++ b/variables.tf @@ -202,8 +202,8 @@ variable "finding_aggregator_linking_mode" { type = string validation { - condition = contains(["ALL_REGIONS", "SPECIFIED_REGIONS", "ALL_REGIONS_EXCEPT_SPECIFIED"], var.finding_aggregator_linking_mode) - error_message = "Allowed values for finding_aggregator_linking_mode are \"ALL_REGIONS\" or \"ALL_REGIONS_EXCEPT_SPECIFIED\" or \"SPECIFIED_REGIONS\"." + condition = contains(["ALL_REGIONS", "SPECIFIED_REGIONS", "ALL_REGIONS_EXCEPT_SPECIFIED", "NO_REGIONS"], var.finding_aggregator_linking_mode) + error_message = "Allowed values for finding_aggregator_linking_mode are \"ALL_REGIONS\", \"ALL_REGIONS_EXCEPT_SPECIFIED\", \"SPECIFIED_REGIONS\" or \"NO_REGIONS\"." } }