When you activate Cloud Config, you must assign a RAM role to Cloud Config so that Cloud Config can assume the role to access resources under your account by calling API operations provided by different services. After the authorization is complete, Cloud Config can obtain configuration details of the resources under your account and evaluate these resources.