Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS Config is a configuration management and compliance service. It records the configuration state of supported AWS resources, evaluates those configurations against rules, and helps identify changes or drift from an organization’s desired state.
This lesson focuses on how AWS Config supports governance, security, reliability, monitoring, notifications, and automated remediation.
Key Concepts
Configuration recording
AWS Config can record the configuration of resources in an AWS account, such as:
- Amazon EC2 instances
- Security groups
- Amazon S3 buckets
- Elastic Load Balancing resources
- Amazon RDS instances
The recorded data can be used to view the current configuration of a resource and, where available, review historical configuration states. This provides an audit trail of configuration changes, including resources being created, modified, or deleted.
AWS Config can also show relationships between resources. For example, it can help identify which security group is associated with an EC2 instance or which resources are related to a load balancer.
Configuration rules
AWS Config evaluates resources against configuration rules. A rule describes a desired condition, such as:
- S3 bucket versioning must be enabled.
- Security groups must not allow unrestricted inbound SSH access.
- RDS instances must not be publicly accessible.
- AWS CloudTrail must be enabled.
- EC2 instances must use approved AMI IDs.
A resource can be evaluated as compliant or noncompliant according to the applicable rule. Rules can be evaluated when configuration changes occur or according to an evaluation schedule, depending on the rule and configuration.
AWS provides managed rules for common compliance checks, and organizations can also create custom rules for requirements specific to their environment.
Change notifications and integrations
When resource configurations change, AWS Config can integrate with other AWS services to support notification, analysis, and response workflows:
- Amazon S3: Store configuration history and snapshots.
- Amazon SNS: Send notifications to subscribers.
- Amazon EventBridge: Route configuration change or compliance events to targets such as Lambda functions, workflows, or operational systems.
- AWS Systems Manager: Support remediation actions that restore a resource to the desired configuration.
A typical workflow is:
- A resource configuration changes.
- AWS Config records the new state.
- A Config rule evaluates the resource.
- The resource is identified as compliant or noncompliant.
- EventBridge or SNS distributes an event or notification.
- Systems Manager Automation, or another approved mechanism, performs remediation if required.
Automatic remediation
AWS Config identifies the compliance problem, but it is not itself the general-purpose mechanism that changes every resource configuration. Remediation can be integrated with AWS Systems Manager Automation or another target.
For example, if an EC2 instance uses an unapproved AMI, an automated workflow might stop or isolate the instance, notify an operations team, or perform a predefined corrective action. Remediation should be designed carefully because automatic changes can affect availability or application behavior.
AWS Config versus CloudTrail
These services answer different questions:
- AWS Config: What is the resource configured like, and is that configuration compliant? How has the configuration changed over time?
- AWS CloudTrail: Which principal or AWS service performed an API action, when did it happen, and what API call was made?
They are complementary. For example, Config can identify that a security group now allows unrestricted SSH, while CloudTrail can help determine which API activity caused the change.
Architecture Decision Guide
| Requirement | Appropriate capability | Reason |
|---|---|---|
| Determine whether resources match approved settings | AWS Config rules | Evaluates current resource configurations for compliance |
| Review configuration history | AWS Config configuration history | Shows prior recorded resource states and changes |
| Identify the actor that made an API change | AWS CloudTrail | Records API activity, identity, time, and request details |
| Notify subscribers about compliance or configuration events | Amazon SNS | Delivers notifications to subscribed endpoints |
| Route events to automated workflows | Amazon EventBridge | Matches events and invokes configured targets |
| Store configuration snapshots and history | Amazon S3 | Provides durable storage for Config data |
| Correct a noncompliant configuration automatically | AWS Systems Manager Automation or another remediation target | Executes a defined corrective workflow |
| Check for prohibited inbound SSH exposure | AWS Config managed rule for restricted SSH | Evaluates whether SSH is unrestricted in security groups |
| Check whether S3 versioning is enabled | AWS Config managed rule for S3 versioning | Detects buckets without the required versioning setting |
| Ensure RDS is not publicly accessible | AWS Config managed rule for RDS public access | Detects publicly accessible database instances |
Exam-Relevant Takeaways
- AWS Config is used to record, evaluate, and track AWS resource configurations.
- Config rules compare resource settings with desired compliance conditions.
- Config can provide both current and historical configuration information.
- Configuration changes can generate notifications or events through services such as Amazon SNS and Amazon EventBridge.
- Amazon S3 is commonly used as a destination for Config configuration history and snapshots.
- AWS Systems Manager can be used to implement automated remediation for noncompliant resources.
- AWS Config can evaluate resources such as EC2, security groups, S3 buckets, Elastic Load Balancing resources, and RDS instances.
- Common managed rule scenarios include S3 versioning, restricted SSH, RDS public accessibility, CloudTrail enablement, and approved AMI usage.
- Use CloudTrail when the question asks who made an API change. Use Config when it asks what the resource configuration is or whether it complies.
Common Exam Traps
- Confusing Config with CloudTrail: Config records resource configuration and compliance state; CloudTrail records API activity and the identity that made the call.
- Assuming Config automatically fixes every violation: Config detects noncompliance. Remediation requires an associated action, such as Systems Manager Automation, Lambda, or another workflow.
- Using CloudWatch as the primary configuration history service: CloudWatch is primarily for metrics, logs, alarms, and operational monitoring. Config is the service designed for resource configuration history and compliance evaluation.
- Treating an SNS notification as remediation: SNS informs subscribers. It does not, by itself, change the resource configuration.
- Assuming a security group is compliant merely because SSH is allowed: A restricted SSH rule normally requires access from approved IP addresses or ranges rather than from the entire internet.
- Ignoring the distinction between public and private database access: A rule checking RDS public accessibility evaluates whether the database is configured for public access, not whether an application can connect privately within a VPC.
- Assuming one rule covers all compliance requirements: Rules must be selected or created for the specific control being evaluated, such as approved AMIs or S3 versioning.
Real-World Engineer Notes
- Begin with read-only compliance checks before enabling automatic remediation. Some corrective actions can interrupt workloads or remove intentionally configured exceptions.
- Use clear ownership and exception processes for resources that are intentionally noncompliant. A blanket remediation workflow can be dangerous when legacy or vendor-managed resources are involved.
- Combine Config and CloudTrail during investigations: Config identifies the resulting state, while CloudTrail helps establish the change history and actor.
- Centralize configuration data and compliance findings when operating across multiple accounts and Regions, while accounting for the scope and support of the resources and rules being evaluated.
- Define approved AMIs through a controlled publishing process. An approved-AMI rule is useful only when the list of permitted AMI IDs is maintained accurately.
- Restrict inbound SSH at the network boundary and prefer managed access mechanisms where possible. A Config rule is a detection and governance control, not a replacement for sound network design.
- Configuration recording and rule evaluation can have service costs and operational implications. Enable recording and rules deliberately for the resources and Regions required by the compliance objective.
Quick Reference Summary
- AWS Config: Resource configuration recording, history, relationships, and compliance evaluation.
- Config rule: A condition that determines whether a resource configuration is compliant.
- S3: Common destination for Config snapshots and configuration history.
- SNS: Notification delivery.
- EventBridge: Event routing and workflow triggering.
- Systems Manager: Possible automation and remediation target.
- CloudTrail: API activity and identity tracking, not configuration compliance.
- Typical checks: S3 versioning, restricted SSH, RDS public access, CloudTrail enabled, and approved EC2 AMIs.
Flashcards
- Q: What is the primary purpose of AWS Config?
A: To record AWS resource configurations, track configuration changes, and evaluate resources against compliance rules.
- Q: What does an AWS Config rule determine?
A: Whether a resource’s configuration satisfies a defined desired condition.
- Q: Which service stores Config configuration snapshots and history?
A: Amazon S3 is commonly used for this storage.
- Q: Which service can notify subscribers about Config events?
A: Amazon SNS.
- Q: Which service can route Config events to automated targets?
A: Amazon EventBridge.
- Q: Which service can execute automated remediation for a Config finding?
A: AWS Systems Manager Automation, or another explicitly configured remediation target.
- Q: How does AWS Config differ from AWS CloudTrail?
A: Config evaluates and tracks resource configuration state; CloudTrail records API calls and the principals that made them.
- Q: What does a restricted SSH rule check?
A: Whether security groups permit unrestricted inbound SSH access, typically TCP port 22 from anywhere.
- Q: What does an approved AMI rule evaluate?
A: Whether running EC2 instances use AMI IDs included in an approved list.
- Q: What type of RDS exposure can Config detect with an appropriate rule?
A: Whether an RDS instance is configured for public accessibility.
Practice Questions
Question 1
A security team requires an ongoing compliance check that identifies S3 buckets without versioning enabled. The team wants AWS to evaluate the configuration and report noncompliant buckets without building a custom polling application. Which solution meets the requirement?
A. Enable CloudTrail data events for all S3 buckets.
B. Create or enable the appropriate AWS Config managed rule.
C. Create a CloudWatch alarm on S3 request metrics.
D. Configure an SNS topic with an S3 event notification.
Correct answer: B
Explanation: AWS Config evaluates resource configuration against rules. An S3 versioning rule can identify buckets whose versioning setting does not meet the requirement. CloudTrail records API activity, CloudWatch monitors operational telemetry, and S3 notifications do not perform compliance evaluation.
Question 2
An organization discovers that a security group now permits SSH from 0.0.0.0/0. The organization needs to determine both whether the configuration violates policy and which IAM principal made the change. Which combination should be used?
A. AWS Config for compliance and AWS CloudTrail for the API actor
B. AWS CloudTrail for compliance and Amazon SNS for the API actor
C. Amazon Inspector for compliance and AWS Config for the API actor
D. Amazon EventBridge for compliance and CloudWatch for the API actor
Correct answer: A
Explanation: AWS Config can evaluate the security group against a restricted-SSH rule. CloudTrail records the API call, timestamp, and identity responsible for the modification.
Question 3
A company wants noncompliant resources to trigger an automated corrective workflow. The workflow must receive a configuration compliance event and invoke an approved remediation procedure. Which architecture is most appropriate?
A. AWS Config, Amazon EventBridge, and AWS Systems Manager Automation
B. Amazon S3, Amazon CloudWatch Logs, and Amazon RDS
C. AWS CloudTrail, Amazon S3 Glacier, and Amazon SNS only
D. Amazon Inspector, Elastic Load Balancing, and AWS WAF
Correct answer: A
Explanation: Config identifies the noncompliant state, EventBridge can route the event, and Systems Manager Automation can execute a predefined remediation procedure. SNS could be added for notification, but notification alone does not correct the resource.
Question 4
A governance team wants to ensure that all running EC2 instances use AMIs from an approved list. Which AWS Config capability addresses this requirement?
A. A rule that checks running instances against approved AMI IDs
B. A CloudTrail trail that records AMI launches
C. An SNS topic that receives EC2 state-change notifications
D. A security group rule that restricts access to the AMI repository
Correct answer: A
Explanation: An approved-AMI Config rule evaluates whether running EC2 instances use specified AMI IDs. The other options may provide activity records or notifications but do not evaluate the desired AMI configuration.
Question 5
A database compliance policy prohibits publicly accessible RDS instances. The team wants a managed AWS rule to identify violations. Which service should be configured?
A. AWS Config
B. AWS CloudTrail
C. Amazon Route 53 Resolver
D. AWS Trusted Advisor only
Correct answer: A
Explanation: AWS Config provides managed rules that evaluate whether RDS instances are configured for public accessibility. CloudTrail records changes, but it does not determine ongoing configuration compliance.