diff --git a/config/OLD/config.tf.1 b/config/OLD/config.tf.1
new file mode 100755
index 0000000..61b6b9f
--- /dev/null
+++ b/config/OLD/config.tf.1
@@ -0,0 +1,347 @@
+#---
+# config 
+#---
+locals {
+  config_policies = list("arn:${data.aws_arn.current.partition}:iam::aws:policy/service-role/AWSConfigRole",
+    data.terraform_remote_state.common.outputs.policy_deny_billing_arn,
+    aws_iam_policy.config.arn
+  )
+  config_bucket_arn = aws_s3_bucket.config.arn
+}
+
+#---
+# role: config 
+#---
+resource "aws_iam_role" "config" {
+  name = "r-inf-config"
+
+  assume_role_policy    = data.aws_iam_policy_document.config_assume.json
+  description           = "EDL AWS Config Role"
+  force_detach_policies = false
+  max_session_duration  = 3600
+  path                  = "/service-role/"
+}
+
+#---
+# policy: config 
+#---
+resource "aws_iam_policy" "config" {
+  name        = "p-inf-awsconfig"
+  path        = "/service-role/"
+  description = "Policy for AWS Config"
+  policy      = data.aws_iam_policy_document.config.json
+}
+
+resource "aws_iam_role_policy_attachment" "config" {
+  count      = length(local.config_policies)
+  role       = aws_iam_role.config.name
+  policy_arn = local.config_policies[count.index]
+}
+
+data "aws_iam_policy_document" "config" {
+  statement {
+    sid    = "AWSConfigAllowBucketPutObject"
+    effect = "Allow"
+
+    resources = ["${local.config_bucket_arn}/*"]
+    actions   = ["s3:PutObject*"]
+
+    condition {
+      test     = "StringLike"
+      variable = "s3:x-amz-acl"
+      values   = ["bucket-owner-full-control"]
+    }
+  }
+
+  statement {
+    sid       = "AWSConfigAllowBucketACL"
+    effect    = "Allow"
+    resources = [local.config_bucket_arn]
+    actions   = ["s3:GetBucketAcl"]
+  }
+
+  ## this goes in a per-region policy
+  ##   statement {
+  ##     sid = "AWSConfigPublishTopic"
+  ##     effect = "Allow"
+  ##     resources = [ aws_sns_topic.arn ]
+  ##     actions = [ "sns:Publish" ]
+  ##   }
+}
+
+#---
+# STS: sts config assume
+#---
+data "aws_iam_policy_document" "config_assume" {
+  statement {
+    sid     = "AWSConfigServiceAssumeRole"
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["config.amazonaws.com"]
+    }
+  }
+}
+
+#--
+# much of this is per region, so we list through all the regions in
+# which we are doing this
+# only allows for 1 recorder
+#---
+resource "aws_config_configuration_recorder" "config" {
+#  count    = length(var.regions)
+  count    = 1
+  name     = "inf-config-${var.regions[count.index]}"
+  role_arn = aws_iam_role.config.arn
+
+  recording_group {
+    include_global_resource_types = true
+    all_supported                 = true
+  }
+}
+
+resource "aws_config_configuration_recorder_status" "config" {
+#  count      = length(var.regions)
+  count    = 1
+  name       = aws_config_configuration_recorder.config.*.name[count.index]
+  is_enabled = true
+  depends_on = [aws_config_delivery_channel.config]
+}
+
+resource "aws_config_delivery_channel" "config" {
+#  count          = length(var.regions)
+  count    = 1
+  name           = "inf-config-${var.regions[count.index]}"
+  s3_bucket_name = aws_s3_bucket.config.bucket
+  sns_topic_arn  = aws_sns_topic.config[count.index].arn
+
+  snapshot_delivery_properties {
+    delivery_frequency = "Six_Hours"
+  }
+
+  depends_on = [aws_config_configuration_recorder.config]
+}
+
+#---
+# config rules
+#---
+locals {
+  crules = {
+    "vpc-flowlogs" = "VPC_FLOW_LOGS_ENABLED"
+    "mfa-console"  = "MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS"
+# this requires a parameter
+#    "iam-group-check" = "IAM_USER_GROUP_MEMBERSHIP_CHECK"
+    "encrypted-volumes" = "ENCRYPTED_VOLUMES"
+    "rds-encrypted" = "RDS_STORAGE_ENCRYPTED"
+  }
+  crules_keys = keys(local.crules)
+  crules_values = values(local.crules)
+}
+
+resource "aws_config_config_rule" "config_rules" {
+  count = length(local.crules_keys)
+  name = "inf-config_rule-${local.crules_keys[count.index]}"
+  source {
+    owner = "AWS"
+    source_identifier = local.crules_values[count.index]
+  }
+  depends_on = [aws_config_configuration_recorder.config]
+}
+
+#---
+# sns: config 
+#---
+data "aws_iam_policy_document" "config_sns" {
+#  count = length(var.regions)
+  count = 1
+  statement {
+    sid     = "AWSConfigBucketPolicy"
+    effect  = "Allow"
+    actions = ["s3:*"]
+
+    resources = [
+      aws_s3_bucket.config.arn,
+      "${aws_s3_bucket.config.arn}/*",
+    ]
+  }
+  statement {
+    sid       = "AWSConfigSNSPublish"
+    effect    = "Allow"
+    actions   = ["sns:Publish"]
+    resources = [aws_sns_topic.config[count.index].arn]
+  }
+}
+
+resource "aws_iam_role_policy" "config_sns" {
+#  count  = length(var.regions)
+  count  = 1
+#  role   = aws_iam_role.config[count.index].name
+  role   = aws_iam_role.config.name
+  name   = "p-inf-config-${var.regions[count.index]}"
+  policy = data.aws_iam_policy_document.config_sns[count.index].json
+}
+
+resource "aws_sns_topic" "config" {
+#  count = length(var.regions)
+  count = 1
+  name  = "inf-config-${var.regions[count.index]}"
+}
+
+resource "aws_sns_topic_policy" "config" {
+  count  = length(var.regions)
+  arn    = aws_sns_topic.config[count.index].arn
+  policy = data.aws_iam_policy_document.config_sns_topic[count.index].json
+}
+
+data "aws_iam_policy_document" "config_sns_topic" {
+  count     = length(var.regions)
+  policy_id = "inf-config_policy-${var.regions[count.index]}"
+  statement {
+    sid    = "inf-config-AllowSNS"
+    effect = "Allow"
+    resources = [aws_sns_topic.config[count.index].arn]
+    actions = [
+      "sns:Subscribe",
+      "sns:SetTopicAttributes",
+      "sns:RemovePermission",
+      "sns:Receive",
+      "sns:Publish",
+      "sns:ListSubscriptionsByTopic",
+      "sns:GetTopicAttributes",
+      "sns:DeleteTopic",
+      "sns:AddPermission",
+    ]
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+    condition {
+      test     = "StringEquals"
+      variable = "AWS:SourceOwner"
+      values   = ["${var.account_id}"]
+    }
+  }
+}
+
+#---
+# sqs: config (from splunk)
+#---
+# one per region we are using
+resource "aws_sqs_queue" "config_deadletter" {
+  # delay=0 retention=4d max=256k visibility=1h
+  count = length(var.regions)
+  name  = "inf-config-${var.regions[count.index]}-deadletter"
+  delay_seconds              = 0
+  max_message_size           = 262144
+  message_retention_seconds  = 345600
+  receive_wait_time_seconds  = 15
+  visibility_timeout_seconds = 3600
+
+  # disable kms, doesn't seem to work with splunk
+  #  kms_master_key_id = "alias/${var.kms_inf_key}"
+  #  kms_data_key_reuse_period_seconds = 300
+  tags = merge(
+    local.common_tags,
+    map("Name", "inf-config-${var.regions[count.index]}-deadletter")
+  )
+}
+
+resource "aws_sqs_queue_policy" "config_deadletter" {
+  count = length(var.regions)
+  queue_url = aws_sqs_queue.config_deadletter[count.index].id
+  policy    = data.aws_iam_policy_document.config_sqs_deadletter[count.index].json
+}
+
+data "aws_iam_policy_document" "config_sqs_deadletter" {
+  count = length(var.regions)
+  policy_id = "SQSDefaultPolicy"
+
+  statement {
+    sid       = "AllowSNSSendMessage"
+    effect    = "Allow"
+    actions   = ["SQS:SendMessage"]
+    resources = [aws_sqs_queue.config_deadletter[count.index].arn]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [aws_sns_topic.config[count.index].arn]
+    }
+  }
+}
+
+resource "aws_sqs_queue" "config" {
+  # delay=0 retention=7d max=256k visibity=2h
+  count = length(var.regions)
+  name                      = "inf-config-${var.regions[count.index]}"
+  delay_seconds             = 0
+  max_message_size          = 262144
+  message_retention_seconds = 604800
+  receive_wait_time_seconds = 0
+  visibility_timeout_seconds = 600
+
+  redrive_policy = <<EOP
+{
+  "deadLetterTargetArn":"${aws_sqs_queue.config_deadletter[count.index].arn}",
+  "maxReceiveCount":100
+}
+EOP
+
+  # disable kms, doesn't seem to work with splunk
+  #  kms_master_key_id = "alias/${var.kms_inf_key}"
+  #  kms_data_key_reuse_period_seconds = 300
+
+  tags = merge(
+    local.common_tags,
+    map("Name", "inf-config-${var.regions[count.index]}")
+  )
+}
+
+resource "aws_sqs_queue_policy" "config" {
+  count = length(var.regions)
+  queue_url = aws_sqs_queue.config[count.index].id
+  policy    = data.aws_iam_policy_document.config_sqs[count.index].json
+}
+
+data "aws_iam_policy_document" "config_sqs" {
+  count = length(var.regions)
+  policy_id = "SQSDefaultPolicy"
+
+  statement {
+    sid       = "AllowSNSSendMessage"
+    effect    = "Allow"
+    actions   = ["SQS:SendMessage"]
+    resources = [aws_sqs_queue.config[count.index].arn]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [aws_sns_topic.config[count.index].arn]
+    }
+  }
+}
+
+#resource "aws_sns_topic_subscription" "splunk-cloudtrail" {
+#  protocol  = "sqs"
+#  topic_arn = "${aws_sns_topic.splunk-cloudtrail.arn}"
+#  endpoint  = "${aws_sqs_queue.splunk-cloudtrail.arn}"
+#}
+
+resource "aws_sns_topic_subscription" "config" {
+  count     = length(var.regions)
+  protocol  = "sqs"
+  topic_arn = aws_sns_topic.config[count.index].arn
+  endpoint  = aws_sqs_queue.config[count.index].arn
+}
diff --git a/config/OLD/config.tf.2 b/config/OLD/config.tf.2
new file mode 100644
index 0000000..b547b49
--- /dev/null
+++ b/config/OLD/config.tf.2
@@ -0,0 +1,370 @@
+#---
+# config: role, policies
+#---
+locals {
+  config_bucket_arn  = "arn:aws-us-gov:s3:::config-bucket-107742151971"
+  config_bucket_name = element(reverse(split(":", local.config_bucket_arn)), 0)
+  config_policies = ["arn:${data.aws_arn.current.partition}:iam::aws:policy/service-role/AWSConfigRole",
+    aws_iam_policy.config.arn,
+    #    data.terraform_remote_state.common.outputs.policy_deny_billing_arn,
+  ]
+}
+
+resource "aws_iam_role" "config" {
+  name = "r-inf-config-${local.region}"
+
+  assume_role_policy    = data.aws_iam_policy_document.config_assume.json
+  description           = "AWS Config Role for ${local.region}"
+  force_detach_policies = false
+  max_session_duration  = 3600
+  path                  = "/service-role/"
+
+  tags = merge(
+    local.common_tags,
+    map("Name", "inf-config-role")
+  )
+}
+
+#---
+# sts config assume
+#---
+data "aws_iam_policy_document" "config_assume" {
+  statement {
+    sid     = "AWSConfigServiceAssumeRole"
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["config.amazonaws.com"]
+    }
+  }
+}
+
+#---
+# config policy
+#---
+data "aws_iam_policy_document" "config" {
+  statement {
+    sid     = "AWSConfigAllowBucketPutObject"
+    effect  = "Allow"
+    actions = ["s3:PutObject*"]
+    #    resources = ["${local.config_bucket_arn}/*"]
+    resources = ["${local.config_bucket_arn}/AWSLogs/${var.account_id}/*"]
+
+    condition {
+      test     = "StringLike"
+      variable = "s3:x-amz-acl"
+      values   = ["bucket-owner-full-control"]
+    }
+  }
+
+  statement {
+    sid       = "AWSConfigAllowBucketACL"
+    effect    = "Allow"
+    actions   = ["s3:GetBucketAcl"]
+    resources = [local.config_bucket_arn]
+  }
+
+  statement {
+    sid     = "AWSConfigPublishTopic"
+    effect  = "Allow"
+    actions = ["sns:Publish"]
+    resources = [
+      aws_sns_topic.config.arn
+    ]
+  }
+}
+
+#---
+# policy: config 
+#---
+resource "aws_iam_policy" "config" {
+  name        = "p-inf-config-${local.region}"
+  path        = "/service-role/"
+  description = "Policy for AWS Config for ${local.region}"
+  policy      = data.aws_iam_policy_document.config.json
+}
+
+resource "aws_iam_role_policy_attachment" "config" {
+  count      = length(local.config_policies)
+  role       = aws_iam_role.config.name
+  policy_arn = local.config_policies[count.index]
+}
+
+## #--
+## # much of this is per region, so we list through all the regions in
+## # which we are doing this
+## # only allows for 1 recorder
+## #---
+resource "aws_config_configuration_recorder" "config" {
+  name     = "inf-config-${local.region}"
+  role_arn = aws_iam_role.config.arn
+
+  recording_group {
+    include_global_resource_types = false
+    all_supported                 = true
+  }
+}
+
+resource "aws_config_configuration_recorder_status" "config" {
+  name       = aws_config_configuration_recorder.config.name
+  is_enabled = true
+  depends_on = [aws_config_delivery_channel.config]
+}
+
+resource "aws_config_delivery_channel" "config" {
+  name           = "inf-config-${local.region}"
+  s3_bucket_name = local.config_bucket_name
+  sns_topic_arn  = aws_sns_topic.config.arn
+
+  snapshot_delivery_properties {
+    delivery_frequency = "Six_Hours"
+  }
+
+  depends_on = [aws_config_configuration_recorder.config]
+}
+
+## #---
+## # config rules
+## #---
+## locals {
+##   crules = {
+##     "vpc-flowlogs" = "VPC_FLOW_LOGS_ENABLED"
+##     "mfa-console"  = "MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS"
+## # this requires a parameter
+## #    "iam-group-check" = "IAM_USER_GROUP_MEMBERSHIP_CHECK"
+##     "encrypted-volumes" = "ENCRYPTED_VOLUMES"
+##     "rds-encrypted" = "RDS_STORAGE_ENCRYPTED"
+##   }
+##   crules_keys = keys(local.crules)
+##   crules_values = values(local.crules)
+## }
+## 
+## resource "aws_config_config_rule" "config_rules" {
+##   count = length(local.crules_keys)
+##   name = "inf-config_rule-${local.crules_keys[count.index]}"
+##   source {
+##     owner = "AWS"
+##     source_identifier = local.crules_values[count.index]
+##   }
+##   depends_on = [aws_config_configuration_recorder.config]
+## }
+
+#---
+# sns: config 
+#---
+data "aws_iam_policy_document" "config_sns" {
+  statement {
+    sid     = "AWSConfigBucketPolicy"
+    effect  = "Allow"
+    actions = ["s3:*"]
+
+    resources = [
+      local.config_bucket_arn,
+      "${local.config_bucket_arn}/*",
+    ]
+  }
+  statement {
+    sid       = "AWSConfigSNSPublish"
+    effect    = "Allow"
+    actions   = ["sns:Publish"]
+    resources = [aws_sns_topic.config.arn]
+  }
+}
+
+resource "aws_iam_role_policy" "config_sns" {
+  name   = "p-inf-config-${local.region}"
+  role   = aws_iam_role.config.name
+  policy = data.aws_iam_policy_document.config_sns.json
+}
+
+resource "aws_sns_topic" "config" {
+  name = "inf-config-${local.region}"
+}
+
+resource "aws_sns_topic_policy" "config" {
+  arn    = aws_sns_topic.config.arn
+  policy = data.aws_iam_policy_document.config_sns_topic.json
+}
+
+data "aws_iam_policy_document" "config_sns_topic" {
+  policy_id = "inf-config_policy-${local.region}"
+  statement {
+    sid       = "AllowSNS"
+    effect    = "Allow"
+    resources = [aws_sns_topic.config.arn]
+    actions = [
+      "sns:Subscribe",
+      "sns:SetTopicAttributes",
+      "sns:RemovePermission",
+      "sns:Receive",
+      "sns:Publish",
+      "sns:ListSubscriptionsByTopic",
+      "sns:GetTopicAttributes",
+      "sns:DeleteTopic",
+      "sns:AddPermission",
+    ]
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+    condition {
+      test     = "StringEquals"
+      variable = "AWS:SourceOwner"
+      values   = [var.account_id]
+    }
+  }
+}
+
+#---
+# sqs: config (from splunk)
+#---
+# one per region we are using
+resource "aws_sqs_queue" "config_deadletter" {
+  # delay=0 retention=4d max=256k visibility=1h
+  name                       = "inf-config-${local.region}-deadletter"
+  delay_seconds              = 0
+  max_message_size           = 262144
+  message_retention_seconds  = 345600
+  receive_wait_time_seconds  = 15
+  visibility_timeout_seconds = 3600
+
+  # disable kms, doesn't seem to work with splunk
+  #  kms_master_key_id = "alias/${var.kms_inf_key}"
+  #  kms_data_key_reuse_period_seconds = 300
+  tags = merge(
+    local.common_tags,
+    map("Name", "inf-config-${local.region}-deadletter")
+  )
+}
+
+resource "aws_sqs_queue_policy" "config_deadletter" {
+  queue_url = aws_sqs_queue.config_deadletter.id
+  policy    = data.aws_iam_policy_document.config_sqs_deadletter.json
+}
+
+data "aws_iam_policy_document" "config_sqs_deadletter" {
+  policy_id = "SQSDefaultPolicy"
+  statement {
+    sid    = "AllowSQSReceiveMessage"
+    effect = "Allow"
+    #    actions   = ["SQS:SendMessage"]
+    actions   = ["SQS:ReceiveMessage"]
+    resources = [aws_sqs_queue.config_deadletter.arn]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      #      values   = [aws_sns_topic.config.arn]
+      values = [aws_sqs_queue.config.arn]
+    }
+  }
+}
+
+resource "aws_sqs_queue" "config" {
+  # delay=0 retention=7d max=256k visibity=2h
+  name                       = "inf-config-${local.region}"
+  delay_seconds              = 0
+  max_message_size           = 262144
+  message_retention_seconds  = 604800
+  receive_wait_time_seconds  = 0
+  visibility_timeout_seconds = 600
+
+  redrive_policy = <<EOP
+{
+  "deadLetterTargetArn":"${aws_sqs_queue.config_deadletter.arn}",
+  "maxReceiveCount":100
+}
+EOP
+
+  # disable kms, doesn't seem to work with splunk
+  #  kms_master_key_id = "alias/${var.kms_inf_key}"
+  #  kms_data_key_reuse_period_seconds = 300
+
+  tags = merge(
+    local.common_tags,
+    map("Name", "inf-config-${local.region}")
+  )
+}
+
+resource "aws_sqs_queue_policy" "config" {
+  queue_url = aws_sqs_queue.config.id
+  policy    = data.aws_iam_policy_document.config_sqs.json
+}
+
+data "aws_iam_policy_document" "config_sqs" {
+  policy_id = "SQSDefaultPolicy"
+  statement {
+    sid       = "AllowSNSSendMessage"
+    effect    = "Allow"
+    actions   = ["SQS:SendMessage"]
+    resources = [aws_sqs_queue.config.arn]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    #     condition {
+    #       test     = "ForAnyValue:ArnEquals"
+    #       variable = "aws:SourceArn"
+    #       values   = [ aws_sns_topic.config.arn, aws_sns_topic.cf_config.arn ]
+    #     }
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [aws_sns_topic.config.arn]
+    }
+  }
+}
+
+#resource "aws_sns_topic_subscription" "splunk-cloudtrail" {
+#  protocol  = "sqs"
+#  topic_arn = "${aws_sns_topic.splunk-cloudtrail.arn}"
+#  endpoint  = "${aws_sqs_queue.splunk-cloudtrail.arn}"
+#}
+
+resource "aws_sns_topic_subscription" "config" {
+  protocol  = "sqs"
+  topic_arn = aws_sns_topic.config.arn
+  endpoint  = aws_sqs_queue.config.arn
+}
+
+#---
+# test sqs to see what is going on with config
+#---
+resource "aws_sqs_queue" "config_test" {
+  # delay=0 retention=7d max=256k visibity=2h
+  name                       = "test-inf-config-${local.region}"
+  delay_seconds              = 0
+  max_message_size           = 262144
+  message_retention_seconds  = 604800
+  receive_wait_time_seconds  = 0
+  visibility_timeout_seconds = 600
+
+  # disable kms, doesn't seem to work with splunk
+  #  kms_master_key_id = "alias/${var.kms_inf_key}"
+  #  kms_data_key_reuse_period_seconds = 300
+
+  tags = merge(
+    local.common_tags,
+    map("Name", "test-inf-config-${local.region}")
+  )
+}
+
+resource "aws_sqs_queue_policy" "config_test" {
+  queue_url = aws_sqs_queue.config_test.id
+  policy    = data.aws_iam_policy_document.config_sqs.json
+}
+
+resource "aws_sns_topic_subscription" "config_test" {
+  protocol  = "sqs"
+  topic_arn = aws_sns_topic.config.arn
+  endpoint  = aws_sqs_queue.config_test.arn
+}
diff --git a/config/config.tf b/config/config.tf
new file mode 100644
index 0000000..d2e890e
--- /dev/null
+++ b/config/config.tf
@@ -0,0 +1,32 @@
+## #--
+## # much of this is per region, so we list through all the regions in
+## # which we are doing this
+## # only allows for 1 recorder
+## #---
+resource "aws_config_configuration_recorder" "config" {
+  name     = local.name
+  role_arn = aws_iam_role.config.arn
+
+  recording_group {
+    include_global_resource_types = true
+    all_supported                 = true
+  }
+}
+
+resource "aws_config_configuration_recorder_status" "config" {
+  name       = aws_config_configuration_recorder.config.name
+  is_enabled = true
+  depends_on = [aws_config_delivery_channel.config]
+}
+
+resource "aws_config_delivery_channel" "config" {
+  name           = local.name
+  s3_bucket_name = local.bucket_id
+  sns_topic_arn  = aws_sns_topic.config.arn
+
+  snapshot_delivery_properties {
+    delivery_frequency = "One_Hour"
+  }
+
+  depends_on = [aws_config_configuration_recorder.config]
+}
diff --git a/config/config_rules.tf b/config/config_rules.tf
new file mode 100644
index 0000000..b3503e6
--- /dev/null
+++ b/config/config_rules.tf
@@ -0,0 +1,84 @@
+#---
+# config rules
+#---
+locals {
+  crules = [
+    "VPC_FLOW_LOGS_ENABLED",
+    "MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS",
+    "ENCRYPTED_VOLUMES",
+    "RDS_STORAGE_ENCRYPTED",
+  ]
+}
+
+resource "aws_config_config_rule" "config_rules" {
+  for_each = toset(local.crules)
+  name     = format("inf-config-rule_%v", each.key)
+  source {
+    owner             = "AWS"
+    source_identifier = each.key
+  }
+  depends_on = [aws_config_configuration_recorder.config]
+}
+
+#---
+# config rules for stopped instances 24h or 30d
+#---
+locals {
+  crules_stopped = [
+    {
+      rule      = "EC2_STOPPED_INSTANCE"
+      parameter = jsonencode({ AllowedDays = "1" })
+    },
+    {
+      rule      = "EC2_STOPPED_INSTANCE"
+      parameter = jsonencode({ AllowedDays = "30" })
+    }
+  ]
+
+  crule_list         = var.enable_config_rules_standard ? local.crules : []
+  crule_stopped_list = var.enable_config_rules_stopped ? [for cr in local.crules_stopped : cr.rule] : []
+
+  all_crules       = concat(local.crule_list, local.crule_stopped_list)
+  all_crules_names = { for c in local.all_crules : c => format("inf-config-rule_%v", c) }
+}
+
+resource "aws_config_config_rule" "config_rules_stopped" {
+  for_each = { for cr in local.crules_stopped : cr.rule => cr }
+  name     = format("inf-config-rule_%v", each.key)
+  source {
+    owner             = "AWS"
+    source_identifier = each.value.rule
+  }
+  maximum_execution_frequency = "TwentyFour_Hours"
+  input_parameters            = each.value.parameter
+  depends_on                  = [aws_config_configuration_recorder.config]
+}
+
+#---
+# generate splunk inputs file
+#---
+data "template_file" "splunk" {
+  template = file("${path.module}/templates/aws_config_rules_tasks.conf.tpl")
+  vars = {
+    account_id    = local.account_id
+    account_alias = local.account_alias
+    entry_uuid    = random_uuid.splunk.result
+    region        = local.config_region
+  }
+}
+
+resource "random_uuid" "splunk" {
+  keepers = {
+    config_rule = length(local.all_crules) > 0 ? 1 : 0
+  }
+}
+
+resource "null_resource" "splunk" {
+  provisioner "local-exec" {
+    command = "test -d setup || mkdir setup"
+  }
+  provisioner "local-exec" {
+    working_dir = "setup"
+    command     = "echo '${data.template_file.splunk.rendered}' > aws_config_rules_tasks.${local.config_region}.conf"
+  }
+}
diff --git a/config/data.tf b/config/data.tf
new file mode 120000
index 0000000..995624d
--- /dev/null
+++ b/config/data.tf
@@ -0,0 +1 @@
+../common/data.tf
\ No newline at end of file
diff --git a/config/defaults.tf b/config/defaults.tf
new file mode 120000
index 0000000..a5556ac
--- /dev/null
+++ b/config/defaults.tf
@@ -0,0 +1 @@
+../common/defaults.tf
\ No newline at end of file
diff --git a/config/east_config.tf.off b/config/east_config.tf.off
new file mode 100755
index 0000000..f831859
--- /dev/null
+++ b/config/east_config.tf.off
@@ -0,0 +1,344 @@
+#---
+# config 
+#---
+locals {
+  config_policies = list("arn:${data.aws_arn.current.partition}:iam::aws:policy/service-role/AWSConfigRole",
+    data.terraform_remote_state.common.outputs.policy_deny_billing_arn,
+    aws_iam_policy.config.arn
+  )
+  config_bucket_arn = aws_s3_bucket.config.arn
+}
+
+#---
+# role: config 
+#---
+resource "aws_iam_role" "config" {
+  name = "r-inf-config"
+
+  assume_role_policy    = data.aws_iam_policy_document.config_assume.json
+  description           = "EDL AWS Config Role"
+  force_detach_policies = false
+  max_session_duration  = 3600
+  path                  = "/service-role/"
+}
+
+#---
+# policy: config 
+#---
+resource "aws_iam_policy" "config" {
+  name        = "p-inf-awsconfig"
+  path        = "/service-role/"
+  description = "Policy for AWS Config"
+  policy      = data.aws_iam_policy_document.config.json
+}
+
+resource "aws_iam_role_policy_attachment" "config" {
+  count      = length(local.config_policies)
+  role       = aws_iam_role.config.name
+  policy_arn = local.config_policies[count.index]
+}
+
+data "aws_iam_policy_document" "config" {
+  statement {
+    sid    = "AWSConfigAllowBucketPutObject"
+    effect = "Allow"
+
+    resources = ["${local.config_bucket_arn}/*"]
+    actions   = ["s3:PutObject*"]
+
+    condition {
+      test     = "StringLike"
+      variable = "s3:x-amz-acl"
+      values   = ["bucket-owner-full-control"]
+    }
+  }
+
+  statement {
+    sid       = "AWSConfigAllowBucketACL"
+    effect    = "Allow"
+    resources = [local.config_bucket_arn]
+    actions   = ["s3:GetBucketAcl"]
+  }
+
+  ## this goes in a per-region policy
+  ##   statement {
+  ##     sid = "AWSConfigPublishTopic"
+  ##     effect = "Allow"
+  ##     resources = [ aws_sns_topic.arn ]
+  ##     actions = [ "sns:Publish" ]
+  ##   }
+}
+
+#---
+# STS: sts config assume
+#---
+data "aws_iam_policy_document" "config_assume" {
+  statement {
+    sid     = "AWSConfigServiceAssumeRole"
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["config.amazonaws.com"]
+    }
+  }
+}
+
+#--
+# much of this is per region, so we list through all the regions in
+# which we are doing this
+# only allows for 1 recorder
+#---
+resource "aws_config_configuration_recorder" "config" {
+  #  count    = length(var.regions)
+  count    = 1
+  name     = "inf-config-${var.regions[count.index]}"
+  role_arn = aws_iam_role.config.arn
+
+  recording_group {
+    include_global_resource_types = true
+    all_supported                 = true
+  }
+}
+
+resource "aws_config_configuration_recorder_status" "config" {
+  #  count      = length(var.regions)
+  count      = 1
+  name       = aws_config_configuration_recorder.config.*.name[count.index]
+  is_enabled = true
+  depends_on = [aws_config_delivery_channel.config]
+}
+
+resource "aws_config_delivery_channel" "config" {
+  #  count          = length(var.regions)
+  count          = 1
+  name           = "inf-config-${var.regions[count.index]}"
+  s3_bucket_name = aws_s3_bucket.config.bucket
+  sns_topic_arn  = aws_sns_topic.config[count.index].arn
+
+  snapshot_delivery_properties {
+    delivery_frequency = "Six_Hours"
+  }
+
+  depends_on = [aws_config_configuration_recorder.config]
+}
+
+#---
+# config rules
+#---
+locals {
+  crules = {
+    "vpc-flowlogs" = "VPC_FLOW_LOGS_ENABLED"
+    "mfa-console"  = "MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS"
+    # this requires a parameter
+    #    "iam-group-check" = "IAM_USER_GROUP_MEMBERSHIP_CHECK"
+    "encrypted-volumes" = "ENCRYPTED_VOLUMES"
+    "rds-encrypted"     = "RDS_STORAGE_ENCRYPTED"
+  }
+  crules_keys   = keys(local.crules)
+  crules_values = values(local.crules)
+}
+
+resource "aws_config_config_rule" "config_rules" {
+  count = length(local.crules_keys)
+  name  = "inf-config_rule-${local.crules_keys[count.index]}"
+  source {
+    owner             = "AWS"
+    source_identifier = local.crules_values[count.index]
+  }
+  depends_on = [aws_config_configuration_recorder.config]
+}
+
+#---
+# sns: config 
+#---
+data "aws_iam_policy_document" "config_sns" {
+  count = length(var.regions)
+  statement {
+    sid     = "AWSConfigBucketPolicy"
+    effect  = "Allow"
+    actions = ["s3:*"]
+
+    resources = [
+      aws_s3_bucket.config.arn,
+      "${aws_s3_bucket.config.arn}/*",
+    ]
+  }
+  statement {
+    sid       = "AWSConfigSNSPublish"
+    effect    = "Allow"
+    actions   = ["sns:Publish"]
+    resources = [aws_sns_topic.config[count.index].arn]
+  }
+}
+
+resource "aws_iam_role_policy" "config_sns" {
+  count = length(var.regions)
+  #  role   = aws_iam_role.config[count.index].name
+  role   = aws_iam_role.config.name
+  name   = "p-inf-config-${var.regions[count.index]}"
+  policy = data.aws_iam_policy_document.config_sns[count.index].json
+}
+
+resource "aws_sns_topic" "config" {
+  count = length(var.regions)
+  name  = "inf-config-${var.regions[count.index]}"
+}
+
+resource "aws_sns_topic_policy" "config" {
+  count  = length(var.regions)
+  arn    = aws_sns_topic.config[count.index].arn
+  policy = data.aws_iam_policy_document.config_sns_topic[count.index].json
+}
+
+data "aws_iam_policy_document" "config_sns_topic" {
+  count     = length(var.regions)
+  policy_id = "inf-config_policy-${var.regions[count.index]}"
+  statement {
+    sid       = "inf-config-AllowSNS"
+    effect    = "Allow"
+    resources = [aws_sns_topic.config[count.index].arn]
+    actions = [
+      "sns:Subscribe",
+      "sns:SetTopicAttributes",
+      "sns:RemovePermission",
+      "sns:Receive",
+      "sns:Publish",
+      "sns:ListSubscriptionsByTopic",
+      "sns:GetTopicAttributes",
+      "sns:DeleteTopic",
+      "sns:AddPermission",
+    ]
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+    condition {
+      test     = "StringEquals"
+      variable = "AWS:SourceOwner"
+      values   = ["${var.account_id}"]
+    }
+  }
+}
+
+#---
+# sqs: config (from splunk)
+#---
+# one per region we are using
+resource "aws_sqs_queue" "config_deadletter" {
+  # delay=0 retention=4d max=256k visibility=1h
+  count                      = length(var.regions)
+  name                       = "inf-config-${var.regions[count.index]}-deadletter"
+  delay_seconds              = 0
+  max_message_size           = 262144
+  message_retention_seconds  = 345600
+  receive_wait_time_seconds  = 15
+  visibility_timeout_seconds = 3600
+
+  # disable kms, doesn't seem to work with splunk
+  #  kms_master_key_id = "alias/${var.kms_inf_key}"
+  #  kms_data_key_reuse_period_seconds = 300
+  tags = merge(
+    local.common_tags,
+    map("Name", "inf-config-${var.regions[count.index]}-deadletter")
+  )
+}
+
+resource "aws_sqs_queue_policy" "config_deadletter" {
+  count     = length(var.regions)
+  queue_url = aws_sqs_queue.config_deadletter[count.index].id
+  policy    = data.aws_iam_policy_document.config_sqs_deadletter[count.index].json
+}
+
+data "aws_iam_policy_document" "config_sqs_deadletter" {
+  count     = length(var.regions)
+  policy_id = "SQSDefaultPolicy"
+
+  statement {
+    sid       = "AllowSNSSendMessage"
+    effect    = "Allow"
+    actions   = ["SQS:SendMessage"]
+    resources = [aws_sqs_queue.config_deadletter[count.index].arn]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [aws_sns_topic.config[count.index].arn]
+    }
+  }
+}
+
+resource "aws_sqs_queue" "config" {
+  # delay=0 retention=7d max=256k visibity=2h
+  count                      = length(var.regions)
+  name                       = "inf-config-${var.regions[count.index]}"
+  delay_seconds              = 0
+  max_message_size           = 262144
+  message_retention_seconds  = 604800
+  receive_wait_time_seconds  = 0
+  visibility_timeout_seconds = 600
+
+  redrive_policy = <<EOP
+{
+  "deadLetterTargetArn":"${aws_sqs_queue.config_deadletter[count.index].arn}",
+  "maxReceiveCount":100
+}
+EOP
+
+  # disable kms, doesn't seem to work with splunk
+  #  kms_master_key_id = "alias/${var.kms_inf_key}"
+  #  kms_data_key_reuse_period_seconds = 300
+
+  tags = merge(
+    local.common_tags,
+    map("Name", "inf-config-${var.regions[count.index]}")
+  )
+}
+
+resource "aws_sqs_queue_policy" "config" {
+  count     = length(var.regions)
+  queue_url = aws_sqs_queue.config[count.index].id
+  policy    = data.aws_iam_policy_document.config_sqs[count.index].json
+}
+
+data "aws_iam_policy_document" "config_sqs" {
+  count     = length(var.regions)
+  policy_id = "SQSDefaultPolicy"
+
+  statement {
+    sid       = "AllowSNSSendMessage"
+    effect    = "Allow"
+    actions   = ["SQS:SendMessage"]
+    resources = [aws_sqs_queue.config[count.index].arn]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [aws_sns_topic.config[count.index].arn]
+    }
+  }
+}
+
+#resource "aws_sns_topic_subscription" "splunk-cloudtrail" {
+#  protocol  = "sqs"
+#  topic_arn = "${aws_sns_topic.splunk-cloudtrail.arn}"
+#  endpoint  = "${aws_sqs_queue.splunk-cloudtrail.arn}"
+#}
+
+resource "aws_sns_topic_subscription" "config" {
+  count     = length(var.regions)
+  protocol  = "sqs"
+  topic_arn = aws_sns_topic.config[count.index].arn
+  endpoint  = aws_sqs_queue.config[count.index].arn
+}
diff --git a/config/main.tf b/config/main.tf
new file mode 100644
index 0000000..8ff4fa5
--- /dev/null
+++ b/config/main.tf
@@ -0,0 +1,426 @@
+/*
+* # aws-inf-setup :: config
+* 
+* This set up the needed components for config per region including:
+* 
+* * Role
+* * Policy
+* * SNS Topic
+* * SQS Queue and dead letter queue (for Splunk)
+* * Config
+* * Config Rules
+* 
+* # Usage
+* Here is a simple example, the one most commonly expected to be used.
+*
+* ```hcl
+* module "config" {
+*   source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//config"
+*
+*   bucket_id = module.config_s3.config_bucket_id
+*   account_alias = "ma5-gov"
+*
+*   ## optional
+*   # name = "myconfigbucket"
+*
+* }
+* ```
+*/
+
+locals {
+  account_id          = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id
+  config_region       = data.aws_region.current.name
+  account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew"
+  # remap do2 to do1 for govcloud (undo this later when accounts are renamed in splunk)
+  account_alias = replace(var.account_alias, "do2", "do1")
+
+  # inf-config-{region}
+  name        = var.name != "" ? var.name : format("%v-%v", lookup(local._defaults["config"], "name"), local.config_region)
+  role_name   = format("%v%v", local._prefixes["role"], local.name)
+  policy_name = format("%v%v", local._prefixes["policy"], local.name)
+
+  bucket_id  = var.bucket_id
+  bucket_arn = data.aws_s3_bucket.config_s3.arn
+
+  base_tags = {
+    "Organization"          = "census:aditcio:csvd"
+    "boc:tf_module_version" = local._module_version
+    "boc:created_by"        = "terraform"
+  }
+}
+
+data "aws_s3_bucket" "config_s3" {
+  bucket = local.bucket_id
+}
+
+## #---
+## # config: role, policies
+## #---
+## locals {
+##   config_bucket_arn  = "arn:aws-us-gov:s3:::config-bucket-107742151971"
+##   config_bucket_name = element(reverse(split(":", local.config_bucket_arn)), 0)
+##   config_policies = [
+##     "arn:${data.aws_arn.current.partition}:iam::aws:policy/service-role/AWSConfigRole",
+##     aws_iam_policy.config.arn,
+##   ]
+## }
+## 
+## resource "aws_iam_role" "config" {
+##   name = local.role_name
+## 
+##   assume_role_policy    = data.aws_iam_policy_document.config_assume.json
+##   description           = "AWS Config Role for ${local.config_region}"
+##   force_detach_policies = false
+##   max_session_duration  = 3600
+##   path                  = "/service-role/"
+## 
+##   tags = merge(
+##     local.base_tags,
+##     var.tags,
+##     tomap({"Name" = local.role_name}),
+##   )
+## }
+## 
+## #---
+## # sts config assume
+## #---
+## data "aws_iam_policy_document" "config_assume" {
+##   statement {
+##     sid     = "AWSConfigServiceAssumeRole"
+##     effect  = "Allow"
+##     actions = ["sts:AssumeRole"]
+## 
+##     principals {
+##       type        = "Service"
+##       identifiers = ["config.amazonaws.com"]
+##     }
+##   }
+## }
+## 
+## #---
+## # config policy
+## #---
+## data "aws_iam_policy_document" "config" {
+##   statement {
+##     sid     = "AWSConfigAllowBucketPutObject"
+##     effect  = "Allow"
+##     actions = ["s3:PutObject*"]
+##     #    resources = ["${local.config_bucket_arn}/*"]
+##     resources = ["${local.config_bucket_arn}/AWSLogs/${var.account_id}/*"]
+## 
+##     condition {
+##       test     = "StringLike"
+##       variable = "s3:x-amz-acl"
+##       values   = ["bucket-owner-full-control"]
+##     }
+##   }
+## 
+##   statement {
+##     sid       = "AWSConfigAllowBucketACL"
+##     effect    = "Allow"
+##     actions   = ["s3:GetBucketAcl"]
+##     resources = [local.config_bucket_arn]
+##   }
+## 
+##   statement {
+##     sid     = "AWSConfigPublishTopic"
+##     effect  = "Allow"
+##     actions = ["sns:Publish"]
+##     resources = [
+##       aws_sns_topic.config.arn
+##     ]
+##   }
+## }
+## 
+## #---
+## # policy: config 
+## #---
+## resource "aws_iam_policy" "config" {
+##   name        = "p-inf-config-${local.region}"
+##   path        = "/service-role/"
+##   description = "Policy for AWS Config for ${local.region}"
+##   policy      = data.aws_iam_policy_document.config.json
+## }
+## 
+## resource "aws_iam_role_policy_attachment" "config" {
+##   count      = length(local.config_policies)
+##   role       = aws_iam_role.config.name
+##   policy_arn = local.config_policies[count.index]
+## }
+## 
+## ## #--
+## ## # much of this is per region, so we list through all the regions in
+## ## # which we are doing this
+## ## # only allows for 1 recorder
+## ## #---
+## resource "aws_config_configuration_recorder" "config" {
+##   name     = "inf-config-${local.region}"
+##   role_arn = aws_iam_role.config.arn
+## 
+##   recording_group {
+##     include_global_resource_types = false
+##     all_supported                 = true
+##   }
+## }
+## 
+## resource "aws_config_configuration_recorder_status" "config" {
+##   name       = aws_config_configuration_recorder.config.name
+##   is_enabled = true
+##   depends_on = [aws_config_delivery_channel.config]
+## }
+## 
+## resource "aws_config_delivery_channel" "config" {
+##   name           = "inf-config-${local.region}"
+##   s3_bucket_name = local.config_bucket_name
+##   sns_topic_arn  = aws_sns_topic.config.arn
+## 
+##   snapshot_delivery_properties {
+##     delivery_frequency = "Six_Hours"
+##   }
+## 
+##   depends_on = [aws_config_configuration_recorder.config]
+## }
+## 
+## ## #---
+## ## # config rules
+## ## #---
+## ## locals {
+## ##   crules = {
+## ##     "vpc-flowlogs" = "VPC_FLOW_LOGS_ENABLED"
+## ##     "mfa-console"  = "MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS"
+## ## # this requires a parameter
+## ## #    "iam-group-check" = "IAM_USER_GROUP_MEMBERSHIP_CHECK"
+## ##     "encrypted-volumes" = "ENCRYPTED_VOLUMES"
+## ##     "rds-encrypted" = "RDS_STORAGE_ENCRYPTED"
+## ##   }
+## ##   crules_keys = keys(local.crules)
+## ##   crules_values = values(local.crules)
+## ## }
+## ## 
+## ## resource "aws_config_config_rule" "config_rules" {
+## ##   count = length(local.crules_keys)
+## ##   name = "inf-config_rule-${local.crules_keys[count.index]}"
+## ##   source {
+## ##     owner = "AWS"
+## ##     source_identifier = local.crules_values[count.index]
+## ##   }
+## ##   depends_on = [aws_config_configuration_recorder.config]
+## ## }
+## 
+## #---
+## # sns: config 
+## #---
+## data "aws_iam_policy_document" "config_sns" {
+##   statement {
+##     sid     = "AWSConfigBucketPolicy"
+##     effect  = "Allow"
+##     actions = ["s3:*"]
+## 
+##     resources = [
+##       local.config_bucket_arn,
+##       "${local.config_bucket_arn}/*",
+##     ]
+##   }
+##   statement {
+##     sid       = "AWSConfigSNSPublish"
+##     effect    = "Allow"
+##     actions   = ["sns:Publish"]
+##     resources = [aws_sns_topic.config.arn]
+##   }
+## }
+## 
+## resource "aws_iam_role_policy" "config_sns" {
+##   name   = "p-inf-config-${local.region}"
+##   role   = aws_iam_role.config.name
+##   policy = data.aws_iam_policy_document.config_sns.json
+## }
+## 
+## resource "aws_sns_topic" "config" {
+##   name = "inf-config-${local.region}"
+## }
+## 
+## resource "aws_sns_topic_policy" "config" {
+##   arn    = aws_sns_topic.config.arn
+##   policy = data.aws_iam_policy_document.config_sns_topic.json
+## }
+## 
+## data "aws_iam_policy_document" "config_sns_topic" {
+##   policy_id = "inf-config_policy-${local.region}"
+##   statement {
+##     sid       = "AllowSNS"
+##     effect    = "Allow"
+##     resources = [aws_sns_topic.config.arn]
+##     actions = [
+##       "sns:Subscribe",
+##       "sns:SetTopicAttributes",
+##       "sns:RemovePermission",
+##       "sns:Receive",
+##       "sns:Publish",
+##       "sns:ListSubscriptionsByTopic",
+##       "sns:GetTopicAttributes",
+##       "sns:DeleteTopic",
+##       "sns:AddPermission",
+##     ]
+##     principals {
+##       type        = "AWS"
+##       identifiers = ["*"]
+##     }
+##     condition {
+##       test     = "StringEquals"
+##       variable = "AWS:SourceOwner"
+##       values   = [var.account_id]
+##     }
+##   }
+## }
+## 
+## #---
+## # sqs: config (from splunk)
+## #---
+## # one per region we are using
+## resource "aws_sqs_queue" "config_deadletter" {
+##   # delay=0 retention=4d max=256k visibility=1h
+##   name                       = "inf-config-${local.region}-deadletter"
+##   delay_seconds              = 0
+##   max_message_size           = 262144
+##   message_retention_seconds  = 345600
+##   receive_wait_time_seconds  = 15
+##   visibility_timeout_seconds = 3600
+## 
+##   # disable kms, doesn't seem to work with splunk
+##   #  kms_master_key_id = "alias/${var.kms_inf_key}"
+##   #  kms_data_key_reuse_period_seconds = 300
+##   tags = merge(
+##     local.common_tags,
+##     map("Name", "inf-config-${local.region}-deadletter")
+##   )
+## }
+## 
+## resource "aws_sqs_queue_policy" "config_deadletter" {
+##   queue_url = aws_sqs_queue.config_deadletter.id
+##   policy    = data.aws_iam_policy_document.config_sqs_deadletter.json
+## }
+## 
+## data "aws_iam_policy_document" "config_sqs_deadletter" {
+##   policy_id = "SQSDefaultPolicy"
+##   statement {
+##     sid    = "AllowSQSReceiveMessage"
+##     effect = "Allow"
+##     #    actions   = ["SQS:SendMessage"]
+##     actions   = ["SQS:ReceiveMessage"]
+##     resources = [aws_sqs_queue.config_deadletter.arn]
+## 
+##     principals {
+##       type        = "AWS"
+##       identifiers = ["*"]
+##     }
+## 
+##     condition {
+##       test     = "ArnEquals"
+##       variable = "aws:SourceArn"
+##       #      values   = [aws_sns_topic.config.arn]
+##       values = [aws_sqs_queue.config.arn]
+##     }
+##   }
+## }
+## 
+## resource "aws_sqs_queue" "config" {
+##   # delay=0 retention=7d max=256k visibity=2h
+##   name                       = "inf-config-${local.region}"
+##   delay_seconds              = 0
+##   max_message_size           = 262144
+##   message_retention_seconds  = 604800
+##   receive_wait_time_seconds  = 0
+##   visibility_timeout_seconds = 600
+## 
+##   redrive_policy = <<EOP
+## {
+##   "deadLetterTargetArn":"${aws_sqs_queue.config_deadletter.arn}",
+##   "maxReceiveCount":100
+## }
+## EOP
+## 
+##   # disable kms, doesn't seem to work with splunk
+##   #  kms_master_key_id = "alias/${var.kms_inf_key}"
+##   #  kms_data_key_reuse_period_seconds = 300
+## 
+##   tags = merge(
+##     local.common_tags,
+##     map("Name", "inf-config-${local.region}")
+##   )
+## }
+## 
+## resource "aws_sqs_queue_policy" "config" {
+##   queue_url = aws_sqs_queue.config.id
+##   policy    = data.aws_iam_policy_document.config_sqs.json
+## }
+## 
+## data "aws_iam_policy_document" "config_sqs" {
+##   policy_id = "SQSDefaultPolicy"
+##   statement {
+##     sid       = "AllowSNSSendMessage"
+##     effect    = "Allow"
+##     actions   = ["SQS:SendMessage"]
+##     resources = [aws_sqs_queue.config.arn]
+## 
+##     principals {
+##       type        = "AWS"
+##       identifiers = ["*"]
+##     }
+## 
+##     #     condition {
+##     #       test     = "ForAnyValue:ArnEquals"
+##     #       variable = "aws:SourceArn"
+##     #       values   = [ aws_sns_topic.config.arn, aws_sns_topic.cf_config.arn ]
+##     #     }
+##     condition {
+##       test     = "ArnEquals"
+##       variable = "aws:SourceArn"
+##       values   = [aws_sns_topic.config.arn]
+##     }
+##   }
+## }
+## 
+## #resource "aws_sns_topic_subscription" "splunk-cloudtrail" {
+## #  protocol  = "sqs"
+## #  topic_arn = "${aws_sns_topic.splunk-cloudtrail.arn}"
+## #  endpoint  = "${aws_sqs_queue.splunk-cloudtrail.arn}"
+## #}
+## 
+## resource "aws_sns_topic_subscription" "config" {
+##   protocol  = "sqs"
+##   topic_arn = aws_sns_topic.config.arn
+##   endpoint  = aws_sqs_queue.config.arn
+## }
+## 
+## #---
+## # test sqs to see what is going on with config
+## #---
+## resource "aws_sqs_queue" "config_test" {
+##   # delay=0 retention=7d max=256k visibity=2h
+##   name                       = "test-inf-config-${local.region}"
+##   delay_seconds              = 0
+##   max_message_size           = 262144
+##   message_retention_seconds  = 604800
+##   receive_wait_time_seconds  = 0
+##   visibility_timeout_seconds = 600
+## 
+##   # disable kms, doesn't seem to work with splunk
+##   #  kms_master_key_id = "alias/${var.kms_inf_key}"
+##   #  kms_data_key_reuse_period_seconds = 300
+## 
+##   tags = merge(
+##     local.common_tags,
+##     map("Name", "test-inf-config-${local.region}")
+##   )
+## }
+## 
+## resource "aws_sqs_queue_policy" "config_test" {
+##   queue_url = aws_sqs_queue.config_test.id
+##   policy    = data.aws_iam_policy_document.config_sqs.json
+## }
+## 
+## resource "aws_sns_topic_subscription" "config_test" {
+##   protocol  = "sqs"
+##   topic_arn = aws_sns_topic.config.arn
+##   endpoint  = aws_sqs_queue.config_test.arn
+## }
diff --git a/config/policies.tf.off b/config/policies.tf.off
new file mode 100644
index 0000000..6833391
--- /dev/null
+++ b/config/policies.tf.off
@@ -0,0 +1,62 @@
+#---
+# aws config topic policy
+#---
+data "aws_iam_policy_document" "cf_config" {
+  statement {
+    sid       = "CloudformsSNSPolicy"
+    effect    = "Allow"
+    resources = [aws_sns_topic.cf_config.arn]
+    actions = [
+      "SNS:GetTopicAttributes",
+      "SNS:SetTopicAttributes",
+      "SNS:AddPermission",
+      "SNS:RemovePermission",
+      "SNS:DeleteTopic",
+      "SNS:Subscribe",
+      "SNS:ListSubscriptionsByTopic",
+      "SNS:Publish",
+      "SNS:Receive",
+    ]
+    condition {
+      test     = "StringEquals"
+      variable = "AWS:SourceOwner"
+      values   = [data.aws_caller_identity.current.account_id]
+    }
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+  }
+}
+
+data "aws_iam_policy_document" "cloudtrail_s3" {
+  statement {
+    sid       = "AWSCloudTrailWrite"
+    effect    = "Allow"
+    resources = ["${aws_s3_bucket.cloudtrail.arn}/*"]
+    actions   = ["s3:PutObject"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["cloudtrail.amazonaws.com"]
+    }
+
+    condition {
+      test     = "StringLike"
+      variable = "s3:x-amz-acl"
+      values   = ["bucket-owner-full-control"]
+    }
+  }
+
+  statement {
+    sid       = "AWSCloudTrailAclCheck"
+    effect    = "Allow"
+    resources = [aws_s3_bucket.cloudtrail.arn]
+    actions   = ["s3:GetBucketAcl"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["cloudtrail.amazonaws.com"]
+    }
+  }
+}
diff --git a/config/prefixes.tf b/config/prefixes.tf
new file mode 120000
index 0000000..7e265d5
--- /dev/null
+++ b/config/prefixes.tf
@@ -0,0 +1 @@
+../common/prefixes.tf
\ No newline at end of file
diff --git a/config/role.tf b/config/role.tf
new file mode 100644
index 0000000..25a57fe
--- /dev/null
+++ b/config/role.tf
@@ -0,0 +1,90 @@
+locals {
+  config_policies = [
+    data.aws_iam_policy.aws_config_role.arn,
+    aws_iam_policy.config.arn,
+  ]
+}
+
+data "aws_iam_policy" "aws_config_role" {
+  name = "AWSConfigRole"
+}
+
+#---
+# role
+#---
+resource "aws_iam_role" "config" {
+  name = local.role_name
+
+  assume_role_policy    = data.aws_iam_policy_document.config_assume.json
+  description           = "AWS Config Role for ${local.config_region}"
+  force_detach_policies = false
+  max_session_duration  = 3600
+  path                  = "/service-role/"
+
+  tags = merge(
+    local.base_tags,
+    var.tags,
+    tomap({ "Name" = local.role_name }),
+  )
+}
+
+#---
+# sts config assume
+#---
+data "aws_iam_policy_document" "config_assume" {
+  statement {
+    sid     = "AWSConfigServiceAssumeRole"
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["config.amazonaws.com"]
+    }
+  }
+}
+
+#---
+# config policy and attachment
+#---
+resource "aws_iam_policy" "config" {
+  name        = local.policy_name
+  path        = "/service-role/"
+  description = "Policy for AWS Config for ${local.config_region}"
+  policy      = data.aws_iam_policy_document.config.json
+}
+
+resource "aws_iam_role_policy_attachment" "config" {
+  for_each   = toset(local.config_policies)
+  role       = aws_iam_role.config.name
+  policy_arn = each.key
+}
+
+#---
+# config policy data
+#---
+data "aws_iam_policy_document" "config" {
+  statement {
+    sid       = "AWSConfigAllowBucketPutObject"
+    effect    = "Allow"
+    actions   = ["s3:PutObject*"]
+    resources = [format("%v/AWSLogs/%v/*", local.bucket_arn, local.account_id)]
+    condition {
+      test     = "StringLike"
+      variable = "s3:x-amz-acl"
+      values   = ["bucket-owner-full-control"]
+    }
+  }
+  statement {
+    sid       = "AWSConfigAllowBucketACL"
+    effect    = "Allow"
+    actions   = ["s3:GetBucketAcl"]
+    resources = [local.bucket_arn]
+  }
+  statement {
+    sid       = "AWSConfigPublishTopic"
+    effect    = "Allow"
+    actions   = ["sns:Publish"]
+    resources = [aws_sns_topic.config.arn]
+  }
+}
diff --git a/config/sns.tf b/config/sns.tf
new file mode 100644
index 0000000..720275d
--- /dev/null
+++ b/config/sns.tf
@@ -0,0 +1,65 @@
+## #---
+## # sns: config 
+## #---
+## data "aws_iam_policy_document" "config_sns" {
+##   statement {
+##     sid     = "AWSConfigBucketPolicy"
+##     effect  = "Allow"
+##     actions = ["s3:*"]
+## 
+##     resources = [
+##       local.bucket_arn,
+##       "${local.bucket_arn}/*",
+##     ]
+##   }
+##   statement {
+##     sid       = "AWSConfigSNSPublish"
+##     effect    = "Allow"
+##     actions   = ["sns:Publish"]
+##     resources = [aws_sns_topic.config.arn]
+##   }
+## }
+## 
+## resource "aws_iam_role_policy" "config_sns" {
+##   name   = "p-inf-config-${local.region}"
+##   role   = aws_iam_role.config.name
+##   policy = data.aws_iam_policy_document.config_sns.json
+## }
+
+resource "aws_sns_topic" "config" {
+  name = local.name
+}
+
+resource "aws_sns_topic_policy" "config" {
+  arn    = aws_sns_topic.config.arn
+  policy = data.aws_iam_policy_document.config_sns_topic.json
+}
+
+data "aws_iam_policy_document" "config_sns_topic" {
+  #  policy_id = "inf-config_policy-${local.region}"
+  statement {
+    sid       = "AllowSNS"
+    effect    = "Allow"
+    resources = [aws_sns_topic.config.arn]
+    actions = [
+      "sns:Subscribe",
+      "sns:SetTopicAttributes",
+      "sns:RemovePermission",
+      "sns:Receive",
+      "sns:Publish",
+      "sns:ListSubscriptionsByTopic",
+      "sns:GetTopicAttributes",
+      "sns:DeleteTopic",
+      "sns:AddPermission",
+    ]
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+    condition {
+      test     = "StringEquals"
+      variable = "AWS:SourceOwner"
+      values   = [local.account_id]
+    }
+  }
+}
diff --git a/config/sqs.tf b/config/sqs.tf
new file mode 100644
index 0000000..e2b6429
--- /dev/null
+++ b/config/sqs.tf
@@ -0,0 +1,118 @@
+#---
+# sqs: config (for splunk)
+#---
+# one per region we are using
+resource "aws_sqs_queue" "config_deadletter" {
+  # delay=0 retention=4d max=256k visibility=1h
+  name                       = format("%v-deadletter", local.name)
+  delay_seconds              = 0
+  max_message_size           = 262144
+  message_retention_seconds  = 345600
+  receive_wait_time_seconds  = 15
+  visibility_timeout_seconds = 3600
+
+  # disable kms, doesn't seem to work with splunk
+  #  kms_master_key_id = "alias/${var.kms_inf_key}"
+  #  kms_data_key_reuse_period_seconds = 300
+  # going to try it now 20210521
+
+  kms_master_key_id                 = "alias/aws/sqs"
+  kms_data_key_reuse_period_seconds = 300
+
+  tags = merge(
+    local.base_tags,
+    var.tags,
+    tomap({ "Name" = format("%v-deadletter", local.name) }),
+  )
+}
+
+resource "aws_sqs_queue_policy" "config_deadletter" {
+  queue_url = aws_sqs_queue.config_deadletter.id
+  policy    = data.aws_iam_policy_document.config_sqs_deadletter.json
+}
+
+data "aws_iam_policy_document" "config_sqs_deadletter" {
+  policy_id = "SQSDefaultPolicy"
+  statement {
+    sid    = "AllowSQSReceiveMessage"
+    effect = "Allow"
+    #    actions   = ["SQS:SendMessage"]
+    actions   = ["SQS:ReceiveMessage"]
+    resources = [aws_sqs_queue.config_deadletter.arn]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      #      values   = [aws_sns_topic.config.arn]
+      values = [aws_sqs_queue.config.arn]
+    }
+  }
+}
+
+resource "aws_sqs_queue" "config" {
+  # delay=0 retention=7d max=256k visibity=2h
+  name                       = local.name
+  delay_seconds              = 0
+  max_message_size           = 262144
+  message_retention_seconds  = 604800
+  receive_wait_time_seconds  = 0
+  visibility_timeout_seconds = 600
+
+  redrive_policy = <<EOP
+{
+  "deadLetterTargetArn":"${aws_sqs_queue.config_deadletter.arn}",
+  "maxReceiveCount":100
+}
+EOP
+
+  # disable kms, doesn't seem to work with splunk
+  #  kms_master_key_id = "alias/${var.kms_inf_key}"
+  #  kms_data_key_reuse_period_seconds = 300
+  # going to try it now 20210521
+
+  kms_master_key_id                 = "alias/aws/sqs"
+  kms_data_key_reuse_period_seconds = 300
+
+  tags = merge(
+    local.base_tags,
+    var.tags,
+    tomap({ "Name" = local.name }),
+  )
+}
+
+resource "aws_sqs_queue_policy" "config" {
+  queue_url = aws_sqs_queue.config.id
+  policy    = data.aws_iam_policy_document.config_sqs.json
+}
+
+data "aws_iam_policy_document" "config_sqs" {
+  policy_id = "SQSDefaultPolicy"
+  statement {
+    sid       = "AllowSNSSendMessage"
+    effect    = "Allow"
+    actions   = ["SQS:SendMessage"]
+    resources = [aws_sqs_queue.config.arn]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [aws_sns_topic.config.arn]
+    }
+  }
+}
+
+resource "aws_sns_topic_subscription" "config" {
+  protocol  = "sqs"
+  topic_arn = aws_sns_topic.config.arn
+  endpoint  = aws_sqs_queue.config.arn
+}
diff --git a/config/templates/aws_config_rules_tasks.conf.tpl b/config/templates/aws_config_rules_tasks.conf.tpl
new file mode 100644
index 0000000..768a440
--- /dev/null
+++ b/config/templates/aws_config_rules_tasks.conf.tpl
@@ -0,0 +1,6 @@
+[${account_alias}-configrules-${region}_${entry_uuid}]
+account = ${account_alias}
+index = aws
+polling_interval = 3600
+region = ${region}
+sourcetype = aws:config:rule
diff --git a/config/variables.common.tf b/config/variables.common.tf
new file mode 120000
index 0000000..7439ed8
--- /dev/null
+++ b/config/variables.common.tf
@@ -0,0 +1 @@
+../common/variables.common.tf
\ No newline at end of file
diff --git a/config/variables.tf b/config/variables.tf
new file mode 100644
index 0000000..5bff04e
--- /dev/null
+++ b/config/variables.tf
@@ -0,0 +1,22 @@
+variable "name" {
+  description = "Config resource name prefix used for all resources"
+  type        = string
+  default     = ""
+}
+
+variable "bucket_id" {
+  description = "Config S3 Bucket ID/Name"
+  type        = string
+}
+
+variable "enable_config_rules_standard" {
+  description = "Flag to enable|disable the standard set of config rules"
+  type        = bool
+  default     = true
+}
+
+variable "enable_config_rules_stopped" {
+  description = "Flag to enable|disable EC2 stopped config rules"
+  type        = bool
+  default     = false
+}