7 questions found
What is AWS Config and what problem does it help solve?
Beginner
AWS Config is a service that continuously records the configuration state of your AWS resources over time and evaluates them against rules you define, letting you answer questions like what did this resource's configuration look like last week, or is this resource currently compliant with our security policies, without needing to manually track configuration changes yourself.
aws configservice put-configuration-recorder --configuration-recorder name=default,roleARN=arn:aws:iam::123456789012:role/ConfigRole
Real-world example
A security team uses AWS Config to detect the exact moment a security group was accidentally modified to allow public internet access, along with a clear before and after view of the configuration change.
Common follow-ups: What is the difference between AWS Config and CloudTrail?;How much historical configuration data does AWS Config retain?
AWS CloudTrail & Auditing;AWS Security Hub & GuardDuty
How do AWS Config rules work to evaluate resource compliance?
Beginner
A Config rule represents a desired configuration state, either using an AWS managed rule covering common best practices, such as ensuring S3 buckets are not publicly readable, or a custom rule you write yourself using a Lambda function, and Config continuously evaluates your actual resources against these rules, marking each resource as compliant or non compliant whenever its configuration is created or changed.
aws configservice put-config-rule --config-rule '{"ConfigRuleName":"s3-bucket-public-read-prohibited","Source":{"Owner":"AWS","SourceIdentifier":"S3_BUCKET_PUBLIC_READ_PROHIBITED"}}'
Real-world example
A company enables the AWS managed rule that checks for publicly readable S3 buckets, and Config immediately flags an existing bucket as non compliant, prompting the team to correct its permissions before any sensitive data is exposed.
Common follow-ups: What is the difference between AWS managed rules and custom Config rules?;How quickly does Config evaluate a resource after it changes?
S3 & Storage;IAM
How can AWS Config automatically remediate non compliant resources once they are detected?
Intermediate
AWS Config supports automatic remediation actions, typically implemented using AWS Systems Manager Automation documents, that can be triggered the moment a resource is flagged as non compliant, allowing the system to automatically fix common issues, such as disabling public access on an S3 bucket or attaching a required tag, without needing a human to manually intervene every time a violation is detected.
aws configservice put-remediation-configurations --remediation-configurations '[{"ConfigRuleName":"s3-bucket-public-read-prohibited","TargetType":"SSM_DOCUMENT","TargetId":"AWS-DisableS3BucketPublicReadWrite"}]'
Real-world example
A company configures automatic remediation so that any time Config detects an S3 bucket has been accidentally made public, the bucket's public access is automatically disabled within minutes, without requiring a manual response from the security team.
Common follow-ups: What remediation actions are available as AWS managed Systems Manager documents?;How do you test a remediation action safely before enabling it in production?
AWS Systems Manager;S3 & Storage
What is a Config conformance pack, and how does it simplify compliance management at scale?
Intermediate
A conformance pack is a collection of Config rules and remediation actions packaged together as a single deployable template, representing an entire compliance framework, such as a set of best practices for a specific industry regulation, which can be deployed consistently across a single account or an entire AWS Organization, rather than needing to configure dozens of individual rules manually in every account.
aws configservice put-conformance-pack --conformance-pack-name my-pack --template-body file://conformance-pack.yaml
Real-world example
A healthcare company deploys a HIPAA aligned conformance pack across every account in its AWS Organization, instantly applying dozens of relevant compliance rules consistently everywhere instead of manually configuring each rule account by account.
Common follow-ups: Are there prebuilt conformance packs available directly from AWS for common frameworks?;How do you monitor overall compliance status across all accounts using conformance packs?
AWS Organizations & Multi Account Strategy;AWS Security Hub & GuardDuty
How does the AWS Config configuration timeline help with troubleshooting and root cause analysis?
Intermediate
The Config configuration timeline shows a chronological history of every configuration change made to a specific resource, along with the related CloudTrail event that caused each change when available, letting you quickly trace exactly what changed, when it changed, and who made the change, which is extremely valuable when troubleshooting an issue that started appearing after some unknown configuration change was made.
aws configservice get-resource-config-history --resource-type AWS::EC2::SecurityGroup --resource-id sg-12345678
Real-world example
An engineer investigating why an application suddenly lost database connectivity uses the Config timeline for the relevant security group to discover that a specific inbound rule was removed the previous day, immediately pointing to the root cause.
Common follow-ups: How far back does the Config configuration timeline typically go?;Does Config track configuration history for every single AWS resource type?
AWS CloudTrail & Auditing;Monitoring (CloudWatch)
How does AWS Config aggregator support monitoring compliance across multiple AWS accounts and regions from a single place?
Advanced
A Config aggregator collects configuration and compliance data from multiple source accounts and regions into one central account, giving a security or compliance team a single unified dashboard to view the compliance status of resources across an entire organization, rather than needing to log into each individual account and region separately to check compliance status one at a time.
aws configservice put-configuration-aggregator --configuration-aggregator-name org-aggregator --organization-aggregation-source RoleArn=arn:aws:iam::123456789012:role/ConfigAggregatorRole,AllAwsRegions=true
Real-world example
A large enterprise with operations spread across fifteen AWS accounts and three regions sets up a single Config aggregator in its central security account, giving its compliance team one dashboard to monitor every resource's compliance status organization wide.
Common follow-ups: What permissions are needed to set up an organization wide Config aggregator?;Can an aggregator include accounts outside of the same AWS Organization?
AWS Organizations & Multi Account Strategy;IAM
How can custom Config rules built with Lambda functions evaluate complex, organization specific compliance requirements that AWS managed rules do not cover?
Advanced
A custom Config rule invokes a Lambda function you write whenever a relevant resource changes, and that function contains your own logic to evaluate whatever specific business or security requirement you need to check, such as ensuring an EC2 instance's tags follow a specific naming convention or that a database's backup retention period meets an internally mandated minimum, giving you unlimited flexibility beyond what any predefined managed rule could offer.
def lambda_handler(event, context):
configuration_item = event['configurationItem']
is_compliant = configuration_item['tags'].get('CostCenter') is not None
return {'compliance_type': 'COMPLIANT' if is_compliant else 'NON_COMPLIANT'}
Real-world example
A company writes a custom Config rule that flags any EC2 instance missing a required CostCenter tag as non compliant, enforcing an internal financial tracking requirement that no AWS managed rule could have covered out of the box.
Common follow-ups: What event structure does a custom Config rule Lambda function receive?;How do you test a custom Config rule before deploying it broadly?
Lambda & Serverless;Tagging Strategies & Resource Management