AWS Config
A service that continuously records and evaluates AWS resource configuration changes, enabling automated compliance auditing and configuration history tracking based on defined rules
Overview
AWS Config is a service that continuously records the configuration of AWS resources and automatically evaluates their compliance against defined rules. It tracks configuration changes across over 300 resource types including EC2 instances, security groups, S3 buckets, and IAM policies. A configuration snapshot is recorded each time a change occurs, allowing you to review the resource configuration at any point in time. Using AWS-provided managed rules (over 350) and custom rules implemented with Lambda, you can automatically evaluate compliance with your organization's security policies and regulatory requirements.
Configuration Recording and Change History
When Config is enabled, a Configuration Item (CI) is recorded each time a configuration change occurs on a monitored resource. A CI includes the resource type, ID, configuration details, related resources, and the timestamp of the change. This history lets you answer questions like "When was this security group rule changed?" or "When was encryption enabled on this S3 bucket?" A CI does not record who made a change, so you find that out by matching the change against CloudTrail event history. Config's advanced query feature lets you search current resource configurations across your environment using SQL-like syntax. For example, you can retrieve a list of S3 buckets with encryption disabled or security groups allowing public access. Configuration history is delivered to an S3 bucket for long-term storage and analysis with Athena.
Compliance Rules and Auto-Remediation
Config rules automatically evaluate whether resource configurations comply with defined conditions. Examples of managed rules include s3-bucket-server-side-encryption-enabled (checks if S3 bucket encryption is enabled), ec2-instance-no-public-ip (checks if EC2 instances have no public IP), and iam-password-policy (checks if the IAM password policy meets requirements). When non-compliant resources are detected, you can configure auto-remediation actions. Remediation actions are defined as Systems Manager Automation runbooks that automatically bring non-compliant resources into compliance. For example, if an S3 bucket with encryption disabled is detected, a remediation action can automatically enable encryption. The corresponding Azure service is Azure Policy, which similarly evaluates resource configuration compliance and executes auto-remediation.
Practical Usage Patterns
Config serves as the foundation for security auditing and compliance evidence. When addressing regulations and audit standards such as PCI DSS, HIPAA, and SOC 2, Config's records of configuration changes can serve as audit evidence. Config's Conformance Packs are templates that bundle rule sets aligned with specific regulatory frameworks. Integration with Organizations lets you apply uniform Config rules across all accounts in your organization and manage compliance status from a centralized aggregated view. The official pricing page states that charges are based on the number of configuration items recorded, AWS Config rule evaluations, and conformance pack evaluations (as of October 2026). Costs grow in environments with many resources, and you can reduce them by limiting recording to the resource types you need or by switching the recording frequency from continuous recording (every change) to daily recording. Daily recording keeps only the latest state over the past 24 hours, so intermediate changes cannot be traced.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
If this page and the official documentation disagree, treat the official documentation as authoritative.