AWS Config
A service that continuously records and evaluates AWS resource configuration changes, enabling automated compliance auditing and configuration history tracking based on defined rules
Overview
AWS Config is a service that continuously records the configuration of AWS resources and automatically evaluates their compliance against defined rules. It tracks configuration changes across over 300 resource types including EC2 instances, security groups, S3 buckets, and IAM policies. A configuration snapshot is recorded each time a change occurs, allowing you to review the resource configuration at any point in time. Using AWS-provided managed rules (over 350) and custom rules implemented with Lambda, you can automatically evaluate compliance with your organization's security policies and regulatory requirements.
Configuration Recording and Change History
When Config is enabled, a Configuration Item (CI) is recorded each time a configuration change occurs on a monitored resource. A CI includes the resource type, ID, configuration details, related resources, and the timestamp of the change. This history lets you instantly answer questions like "When and who changed this security group rule?" or "When was encryption enabled on this S3 bucket?" Config's advanced query feature lets you search current resource configurations across your environment using SQL-like syntax. For example, you can instantly retrieve a list of S3 buckets with encryption disabled or security groups allowing public access. Configuration history is delivered to an S3 bucket for long-term storage and analysis with Athena.
Compliance Rules and Auto-Remediation
Config rules automatically evaluate whether resource configurations comply with defined conditions. Examples of managed rules include s3-bucket-server-side-encryption-enabled (checks if S3 bucket encryption is enabled), ec2-instance-no-public-ip (checks if EC2 instances have no public IP), and iam-password-policy (checks if the IAM password policy meets requirements). When non-compliant resources are detected, you can configure auto-remediation actions. Remediation actions are defined as Systems Manager Automation runbooks that automatically bring non-compliant resources into compliance. For example, if an S3 bucket with encryption disabled is detected, a remediation action can automatically enable encryption. The corresponding Azure service is Azure Policy, which similarly evaluates resource configuration compliance and executes auto-remediation.
Practical Usage Patterns
Config serves as the foundation for security auditing and compliance evidence. Regulatory requirements such as PCI DSS, HIPAA, and SOC 2 mandate tracking resource configuration changes and continuous compliance with security policies. Config's Conformance Packs are templates that bundle rule sets aligned with specific regulatory frameworks. Integration with Organizations lets you apply uniform Config rules across all accounts in your organization and manage compliance status from a centralized aggregated view. Config pricing is based on the number of Configuration Items recorded. In environments with many resources, costs can increase, so it is recommended to limit recording to only the resource types you need. To learn Config from basics to advanced topics, books (Amazon) offer a structured learning path.