AWS Config

Configuration compliance — continuously record, assess, and audit AWS resource configurations against desired rules and conformance packs.

Overview

AWS Config is a service that continuously records AWS resource configurations and evaluates them against desired rules — it provides a configuration history, compliance auditing, and automated remediation for resources that drift from policy.

Core Concepts

Concept	Description
Configuration Item	A point-in-time record of a resource's configuration attributes
Configuration Recorder	Discovers and records configuration changes for supported resource types
Config Rule	Evaluates whether a resource configuration complies with a desired state
Managed Rule	Pre-built rule maintained by AWS (150+ available)
Custom Rule	User-defined rule backed by a Lambda function
Conformance Pack	Collection of Config rules + remediation actions deployed as a single unit
Remediation Action	An SSM Automation document triggered to fix non-compliant resources
Aggregator	Collects Config data from multiple accounts and regions into a central view
Configuration Snapshot	Complete set of configuration items at a point in time (delivered to S3)

How AWS Config Works

Resource Change (EC2, S3, IAM, etc.)
    → Configuration Recorder (detects change)
        → Configuration Item (stored)
            → Config Rules (evaluate compliance)
                ├── COMPLIANT → No action
                └── NON_COMPLIANT → SNS notification
                                  → Remediation Action (SSM Automation)

Config Rules

Rule Types

Type	Description	Example
AWS Managed Rule	Pre-built by AWS; covers common compliance checks	`s3-bucket-versioning-enabled`
Custom Rule (Lambda)	Custom evaluation logic in a Lambda function	Check naming conventions
Custom Rule (Guard)	Policy-as-code using CloudFormation Guard DSL	Declarative compliance rules

Trigger Types

Trigger	When It Evaluates
Configuration changes	When a monitored resource's configuration changes
Periodic	On a schedule (1h, 3h, 6h, 12h, 24h)

Common Managed Rules

Rule	Checks
`s3-bucket-versioning-enabled`	S3 bucket has versioning enabled
`encrypted-volumes`	EBS volumes are encrypted
`restricted-ssh`	Security groups do not allow unrestricted SSH
`rds-instance-public-access-check`	RDS instances are not publicly accessible
`required-tags`	Resources have specific required tags
`root-account-mfa-enabled`	Root account has MFA enabled
`cloudtrail-enabled`	CloudTrail is enabled in the account

Conformance Packs

Bundle of Config rules + remediation actions deployed as a single unit
AWS provides sample packs for common frameworks (PCI DSS, CIS, HIPAA, NIST)
Custom packs defined in YAML templates
Deployed at organization level via Organizations integration

Remediation

Non-Compliant Resource
    → Config Rule (detects violation)
        → Remediation Action
            → SSM Automation Document
                → Fix: enable encryption, add tag, restrict SG, etc.

Remediation Type	Description
Manual remediation	Notification via SNS; human goes and fixes the resource
Automatic remediation	SSM Automation runs when non-compliance is detected
Retry	Configurable retry attempts for failed remediations

Multi-Account Aggregation

Aggregator collects compliance data from multiple accounts and regions
Provides a single-pane view of compliance posture across the organization
Does not enforce rules — only aggregates results
Deploy rules at scale using Organizations integration or conformance packs

Config vs CloudTrail vs CloudWatch

Aspect	AWS Config	CloudTrail	CloudWatch
Focus	Resource configuration state	API call history (who did what)	Performance metrics and logs
Question answered	"Is this resource compliant?"	"Who changed this resource?"	"How is this resource performing?"
Data type	Configuration items	API event logs	Metrics, logs, traces
Trigger	Configuration change / periodic	Every API call	Threshold breach / schedule

Common Use Cases

Compliance auditing — Evaluate all resources against regulatory frameworks (PCI DSS, HIPAA) using conformance packs.
Security posture — Detect unencrypted EBS volumes, public S3 buckets, or unrestricted security groups.
Configuration history — Track how a resource's configuration has changed over time for root cause analysis.
Automated remediation — Automatically fix non-compliant resources (e.g., enable S3 versioning, restrict open security groups).
Organization-wide governance — Aggregate compliance data from all accounts into a central view using Config Aggregator.

SAA/SAP Exam Tips

SAA Tip: "Ensure resources comply with company policies" or "detect configuration drift" → AWS Config rules. "Track who made changes" → CloudTrail (different service).

Exam Trap: AWS Config records WHAT the resource configuration IS (and whether it is compliant). CloudTrail records WHO made API calls. Both are needed together for a complete audit trail.

SAP Tip: For organization-wide compliance, deploy Config rules via conformance packs through AWS Organizations — not by configuring rules individually in each account.

Cross-Cloud Equivalents

Provider	Service / Solution	Notes
AWS	AWS Config	Baseline
Azure	Azure Policy + Azure Resource Graph	Policy enforces; Resource Graph queries state
GCP	Google Cloud Asset Inventory + Policy Analyzer	Asset history + policy compliance
On-Premises	Chef InSpec, Puppet, Ansible (compliance modules)	Configuration management with compliance checks

Pricing Model

Dimension	Unit	Notes
Configuration items recorded	Per item	Charged when a change is detected
Config rule evaluations	Per evaluation	Per rule × per resource evaluation
Conformance pack evaluations	Per evaluation	Same rate as individual rule evaluations
Advanced queries	Per query	For Config advanced query API

Amazon CloudWatch — performance monitoring and alerting (complementary)
AWS CloudTrail — API call auditing (who changed what)
AWS Organizations — deploy Config rules across all accounts
AWS Systems Manager — SSM Automation for remediation actions

AWS Config

On this page