Aggregate is created in one central aggregator account Just collects config in different accounts, to centralise use IAC or cfn If using aws organisation, it will be done automatically, else authroization is required between accounts