AWS Config Popular2014年〜
A service that records and evaluates AWS resource configuration changes and continuously monitors compliance
What It Does
AWS Config is a service that continuously records the configuration of AWS resources and tracks the history of configuration changes. You can see "when, who, and what was changed" in chronological order, and it automatically evaluates whether resource configurations comply with security policies and compliance standards using rules. When resources that violate rules are detected, it can trigger notifications or automatic remediation actions.
Use Cases
Config is used to continuously monitor compliance with security policies such as "Are all S3 buckets blocking public access?" and "Are all EBS volumes encrypted?" It is also used for compliance audits where you need to submit "the history of security group changes over the past 6 months," and for detecting unintended configuration changes and triggering alerts.
Everyday Analogy
Think of it like a building safety inspection. An inspector (Config) patrols the building (AWS environment) and checks items like fire extinguisher placement, emergency exit availability, and electrical equipment status against a checklist (Config rules). Any areas that don't meet standards are reported with recommendations for improvement. Additionally, past inspection records are kept on file, so you can look back and see when something changed.
What Is Config?
AWS Config is a service that continuously records and evaluates the configuration of AWS resources. It automatically records the settings of resources such as EC2 instances, security groups, S3 buckets, and IAM policies. A snapshot is saved each time a resource's configuration changes, allowing you to review the configuration state at any point in time.
Compliance Evaluation with Config Rules
Config rules are a mechanism that automatically evaluates whether resource configurations meet specific conditions. With over 300 AWS-provided managed rules, you can start evaluating immediately with no setup. Examples include rules like "Is public access blocked on S3 buckets?" and "Do EC2 instances have specific tags?" When custom evaluation logic is needed, you can create custom rules using Lambda functions.
Automatic Remediation and Notifications
When resources that violate Config rules are detected, you can configure automatic remediation actions. For example, when an unencrypted EBS volume is detected, you can automatically run an SSM Automation document to enable encryption. You can also send notifications to an SNS topic to alert administrators. This enables rapid detection and correction of deviations from security policies. For practical tips on using automatic remediation and notifications, tech books on Amazon also cover this topic.
Getting Started
To get started with Config, run the setup wizard in the Config console. Select the resource types to record and specify an S3 bucket for storing configuration history. Then select and enable the Config rules you want to evaluate. Simply choosing managed rules that match your security policies starts continuous compliance monitoring.
Things to Watch Out For
- Config is billed based on the number of recorded resources and Config rule evaluations. Optimize costs by limiting recording to the resource types you need
- Config rule evaluation results are binary: "compliant" or "non-compliant." To identify the cause of non-compliance, you need to examine the resource's configuration details
- Config can be integrated with AWS Organizations to centrally manage Config rules across the organization. In multi-account environments, use aggregators to consolidate compliance status from all accounts
