Study guide

Technical reference and lesson notes

AWS Config: Configuration Compliance, History, and Remediation

Purpose of This Lesson

AWS Config is a configuration management service that evaluates AWS resources against desired configuration settings. This lesson focuses on recognizing when AWS Config is the appropriate tool for configuration compliance, historical investigation, change monitoring, notifications, and automated remediation.

For the AWS Certified CloudOps Engineer Associate SOA-C03 context, the key skill is connecting a configuration requirement to the correct AWS Config rule, notification path, or remediation workflow.

Key Concepts

Configuration evaluation: AWS Config checks whether resources match defined desired settings.
Configuration drift: A resource may initially comply and later become noncompliant after a change. AWS Config helps identify this difference.
Current configuration snapshots: You can view the current configuration state of resources in an AWS account.
Configuration history: AWS Config can retrieve historical configurations for one or more resources.
Change notifications: AWS Config can notify you when a resource is created, modified, or deleted.
Resource relationships: AWS Config can show relationships between resources, helping with dependency and impact analysis.
Rules: Rules define the compliance checks applied to resources. AWS-managed rules are available for common requirements.
Remediation: AWS Config can work with AWS Systems Manager to automatically correct a noncompliant configuration when remediation is configured.

AWS Config Evaluation and Event Flow

A typical workflow is:

Define or select an AWS Config rule that represents the desired configuration.
AWS Config evaluates supported resources such as Amazon EC2 instances, Elastic Load Balancing resources, and Amazon RDS instances.
When a resource is created or its configuration changes, AWS Config receives configuration information.
AWS Config determines whether the resource complies with the rule.
The result or change information can be routed to other AWS services.
The organization can investigate, alert, or remediate the configuration.

AWS Config can integrate with several destinations and response services:

Amazon S3: Store AWS Config data and configuration records.
Amazon SNS: Send notifications about configuration changes or compliance-related events.
Amazon EventBridge: Route configuration events to targets and trigger alerts or workflows.
AWS Systems Manager: Perform automatic remediation that updates a resource to meet the desired configuration.

The important distinction is that AWS Config evaluates and records configuration state; it does not, by itself, represent every possible operational monitoring function. Remediation requires an explicitly configured action, such as an AWS Systems Manager automation workflow.

AWS-Managed Rule Examples

The lecture highlights these AWS-managed rules:

Rule	What it checks
S3 bucket versioning enabled	Whether S3 buckets have versioning enabled.
Restricted SSH	Whether security groups in use prevent unrestricted inbound SSH access. The rule distinguishes access from anywhere from access limited to specified IP addresses or ranges.
RDS public access	Whether Amazon RDS instances are configured for public accessibility.
CloudTrail enabled	Whether AWS CloudTrail is enabled in the AWS account.
Approved AMIs by ID	Whether running EC2 instances use AMIs whose IDs are included in the approved list configured in the rule.

These examples illustrate different compliance patterns: required feature settings, network exposure restrictions, public accessibility checks, account-level logging, and approved-image enforcement.

Exam- or Assessment-Relevant Takeaways

Choose AWS Config when the requirement is to evaluate, record, or investigate the configuration state of AWS resources.
A requirement to detect configuration drift points toward AWS Config rather than a general metric-monitoring solution.
Use configuration history when investigating how a resource changed over time, not just its current state.
Use Amazon EventBridge when configuration changes need to trigger alerts or downstream event-driven workflows.
Use Amazon SNS when the primary requirement is notification delivery.
Use Amazon S3 when AWS Config data needs to be stored for later access or analysis.
Use AWS Systems Manager as part of an automatic remediation workflow after AWS Config identifies a noncompliant resource.
For unrestricted SSH questions, focus on whether inbound SSH is allowed from anywhere versus restricted to approved IP addresses or ranges.
For AMI compliance questions, the decisive condition is whether running instances use the AMI IDs approved by the rule.
Do not confuse detecting noncompliance with correcting it: AWS Config evaluates; remediation must be configured separately.

Tool / Feature Decision Guide

Requirement	Best-fit AWS Config capability or integration	Reason
Determine whether resources match desired settings	AWS Config rules	Rules evaluate resource configuration compliance.
Review the current state of a resource	Current configuration snapshot	Shows the resource’s present configuration.
Investigate when or how settings changed	Configuration history	Provides historical configurations for resources.
Know when a resource is created, modified, or deleted	AWS Config change notifications/events	Tracks configuration changes and resource lifecycle changes.
Persist configuration data	Amazon S3	Stores AWS Config information.
Notify people or systems	Amazon SNS	Delivers notifications.
Trigger an event-driven alert or workflow	Amazon EventBridge	Routes configuration events to targets.
Correct a noncompliant setting automatically	AWS Systems Manager with configured remediation	Applies an automated action to restore the desired configuration.

Common Traps / Misconceptions

Trap: AWS Config is only a point-in-time inventory. It provides current state, but it can also retain and retrieve historical configurations.
Trap: AWS Config automatically fixes every violation. Evaluation and remediation are separate. Automatic correction requires a configured remediation action, such as an AWS Systems Manager workflow.
Trap: Restricted SSH means SSH is disabled. The rule concerns unrestricted inbound SSH access; SSH may still be allowed from specific IP addresses or ranges.
Trap: RDS public access checks whether a database is reachable from every network path. The stated rule checks the public accessibility configuration of the RDS instance.
Trap: Approved AMI compliance checks all AMIs ever used. The example rule checks whether running instances use specified approved AMI IDs.
Trap: Amazon SNS and EventBridge are interchangeable. SNS is primarily a notification destination, while EventBridge is used to route events and trigger workflows.
Trap: Configuration compliance is the same as performance monitoring. AWS Config evaluates configuration settings; the lesson does not describe it as a replacement for performance metrics and alarms.

Real-World Engineer / Analyst Notes

Start with the desired state before selecting a rule. A precise requirement such as “SSH must not be open to the internet” maps more clearly to the restricted SSH rule than a vague requirement to “improve security.”
Treat configuration history as an investigation tool. When a resource becomes noncompliant, historical records can help establish what changed and support troubleshooting.
Separate detection, notification, and correction in system design. A robust workflow may use AWS Config for evaluation, EventBridge or SNS for communication, and Systems Manager for remediation.
Automatic remediation should be selected carefully because correcting a configuration can affect connectivity, availability, or application behavior. Validate the remediation action against the intended desired state.
Resource relationships are valuable when assessing the impact of a configuration change, especially when resources such as EC2 instances, load balancers, and databases interact.

Quick Reference Summary

AWS Config evaluates resource configurations against desired settings.
It helps detect configuration drift and provides current and historical configuration information.
It can report resource creation, modification, and deletion events.
It can show relationships between resources.
AWS Config data can be sent to Amazon S3, Amazon SNS, and Amazon EventBridge.
AWS Systems Manager can be used for configured automatic remediation.
Key example checks include S3 versioning, unrestricted SSH, RDS public access, CloudTrail enablement, and approved EC2 AMI IDs.
Evaluation is not the same as remediation; correction requires an explicit workflow.

Flashcards

Q: A company needs to determine whether AWS resources still match required security settings after administrators make changes. Which service should perform the evaluation, and what problem is being detected?

A: AWS Config should perform the evaluation. The problem is configuration drift: the actual resource settings have diverged from the desired state.

Q: When would you use AWS Config configuration history instead of a current configuration snapshot?

A: Use configuration history when you need to investigate how a resource changed over time. Use a current snapshot when you only need its present configuration.

Q: A security team wants an alert whenever a resource is created, modified, or deleted. What AWS Config capability addresses this requirement?

A: AWS Config records configuration changes and can provide notifications or events for resource creation, modification, and deletion.

Q: Which integration is the most appropriate when a configuration change should trigger an event-driven alert or workflow?

A: Amazon EventBridge is the appropriate integration because it can receive events and route them to targets or workflows.

Q: When is Amazon SNS a better destination than Amazon EventBridge in the workflow described here?

A: SNS is the better choice when the main requirement is delivering notifications. EventBridge is more appropriate when events must be routed to targets or used to trigger workflows.

Q: A company must retain AWS Config information for later access. Which destination from the lesson should it use?

A: Amazon S3 can store AWS Config data for later access and analysis.

Q: A noncompliant resource must be automatically changed back to the desired configuration. Which service works with AWS Config for this purpose?

A: AWS Systems Manager can perform configured automatic remediation after AWS Config identifies the noncompliant configuration.

Q: What is the operational distinction between an AWS Config rule and a remediation action?

A: A rule evaluates whether a resource complies with a desired state. A remediation action performs a correction; it is not automatically implied by the evaluation.

Q: A security group permits inbound SSH from 0.0.0.0/0, but the requirement is access only from corporate IP ranges. Which example rule is relevant?

A: The restricted SSH rule is relevant because it checks whether in-use security groups allow unrestricted inbound SSH instead of limiting access to specific IPs or ranges.

Q: What does the approved AMIs by ID rule evaluate?

A: It evaluates whether running EC2 instances use AMI IDs included in the approved list configured in the rule.

Q: Which rule should be considered when the requirement is that databases not be publicly accessible?

A: The RDS public access rule checks the public accessibility configuration of Amazon RDS instances.

Q: How does the S3 bucket versioning enabled rule differ from a general S3 inventory?

A: The rule evaluates a desired compliance setting—whether versioning is enabled—rather than merely listing buckets or their existence.

Practice Questions

Question 1

An operations team wants to identify EC2 instances that are currently running from AMIs not approved by the security team. Which approach best fits the requirement?

A. Configure the AWS Config approved AMIs by ID rule with the approved AMI IDs.

B. Configure an SNS topic to compare EC2 instance metrics.

C. Use Amazon EventBridge to enable S3 versioning.

D. Use AWS Systems Manager without an AWS Config rule.

Correct answer: A

Explanation: The approved AMIs by ID rule evaluates whether running instances use specified approved AMI IDs.

Question 2

An organization detects that an RDS instance violates its desired public-access setting. It wants the violation recorded and then corrected automatically. Which design is most appropriate?

A. Use SNS alone to change the RDS configuration.

B. Use an AWS Config rule for RDS public access and configure AWS Systems Manager remediation.

C. Use S3 alone to identify and correct the public-access setting.

D. Use CloudTrail alone to enforce the desired RDS setting.

Correct answer: B

Explanation: AWS Config evaluates the RDS configuration, while AWS Systems Manager can execute a configured automatic remediation action.

Question 3

An investigator needs to determine how a security group changed before it began allowing unrestricted SSH. Which AWS Config capability is most useful?

A. Current configuration snapshot only

B. Configuration history

C. S3 bucket versioning enabled rule

D. RDS public access rule

Correct answer: B

Explanation: Configuration history is designed to retrieve historical configurations and support investigation of changes over time.

Question 4

A team wants a configuration change event to start a downstream alerting workflow. Which integration is the best fit based on the lesson?

A. Amazon EventBridge

B. Amazon S3 only

C. AWS Systems Manager only

D. The approved AMIs by ID rule

Correct answer: A

Explanation: EventBridge can receive AWS Config-related events and route them to targets or workflows. Systems Manager is associated with remediation, not the primary event-routing requirement.

WordPress Metadata

Suggested Slug:
aws-config-configuration-compliance-history-remediation

Meta Description:
Study AWS Config for SOA-C03 by learning how to evaluate resource configurations, track drift and history, notify on changes, and automate remediation.

Tags:
AWS Config, AWS CloudOps, configuration compliance, configuration drift, AWS Systems Manager, Amazon EventBridge, AWS Security, AWS Certified CloudOps Engineer