Continuous Compliance Monitoring with AWS Config - Rule Evaluation and Auto-Remediation
Learn how to record resource configurations with AWS Config, evaluate compliance using Config rules, and set up auto-remediation actions.
Overview of Config
AWS Config is a service that continuously records configuration changes to your AWS resources and automatically evaluates compliance. It captures configuration changes to the resource types it records, including security group modifications on EC2 instances, public access setting changes on S3 buckets, and IAM policy updates. With managed Config rules, you can define conditions such as "S3 bucket public access must be blocked" and detect non-compliant resources. Each configuration item consists of metadata, attributes, relationships, current configuration, and related events, and represents a point-in-time view of a resource.
Rules and Auto-Remediation
Managed rules are pre-defined rules provided by AWS, including s3-bucket-public-read-prohibited, ec2-instance-no-public-ip, and iam-password-policy. Custom rules let you implement your own evaluation logic using Lambda functions. Guard rules define policies using AWS CloudFormation Guard's declarative syntax, letting you create custom rules without writing Lambda code. Auto-remediation executes SSM Automation documents when non-compliant resources are detected - for example, automatically blocking public access on an S3 bucket. Remediation actions can include a manual approval step to help avoid unintended changes in production environments. Triggers can be change-triggered (evaluated on resource change) or periodic (1, 3, 6, 12, or 24 hours); applying periodic triggers to infrequently changed rules reduces the number of evaluations.
Conformance Packs and Aggregation
Conformance packs are templates that package multiple Config rules and remediation actions together. Pre-defined packs are available for compliance frameworks including CIS Benchmark, PCI DSS, and NIST 800-53. You can define custom conformance packs with organization-specific rule sets and deploy them across your entire Organizations structure at once. Config Aggregator consolidates compliance status from multiple accounts and regions into a single account, providing a dashboard view of organization-wide compliance. Advanced queries let you run cross-account searches such as "find all resources with unencrypted EBS volumes across all accounts."
Design Best Practices and Pitfalls
When enabling Config, recording all resource types increases the number of configuration items and the costs. One approach is to start by recording security-critical resource types (IAM, S3, EC2, RDS) and expand gradually. Setting up auto-remediation involves checking the risk of cascading remediation, where a remediation action triggers another rule violation. For example, a remediation that deletes security group inbound rules could disrupt application communication. One approach is to begin auto-remediation with a manual approval step and then automate it incrementally. When deploying rules across the organization, manage exclusion lists for certain accounts (sandboxes, development environments) to avoid excessive evaluations. Config recording and CloudTrail recording are complementary - Config records "what changed" while CloudTrail records "who made the change" - so incident investigations use both together.
Config and Security Hub Integration
Config rule evaluation results can also be viewed in AWS Security Hub. Enabling Security Hub auto-deploys Config rules for CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices, displaying each resource's compliance status as a scorecard. While Config alone aggregates individual rule evaluations via Aggregator, Security Hub organizes these as prioritized findings by severity. In practice, Config serves as the engine for rule definition, custom evaluation, and auto-remediation, while Security Hub functions as the organization-wide security posture visualization dashboard. Config rule violations can also be routed through Security Hub to EventBridge for automated ticket creation or Slack notifications.
Optimizing Config Costs
Config pricing depends on factors such as the number of configuration items recorded, rule evaluations, and conformance pack evaluations. Enabling recording for all resource types can result in a massive number of configuration items, so you should limit recording to only the resource types required for compliance to manage costs. Use a mix of periodic evaluation (every 24 hours) and change-triggered evaluation, applying periodic evaluation to resources that change infrequently. Config's advanced queries can be used for compliance reporting. For accounts with many rules, using change triggers can reduce re-evaluations against resources whose evaluation results haven't changed.
Summary
AWS Config is a service that records resource configuration changes and continuously evaluates compliance. Conformance packs let you batch-deploy rule sets for CIS Benchmark and PCI DSS, while Aggregator provides organization-wide compliance visibility. Auto-remediation can run the flow from detecting non-compliant resources to fixing them automatically.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS Config official page
- AWS Organizations official page
- AWS Systems Manager official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.