ACKF logoACKF
Management and Governance

AWS Config

View on GitHub

AWS Config

AWS Config is a regional, account-level service that records and stores point-in-time configurations and changes for supported AWS resources. It continuously captures configuration items and can deliver configuration snapshots and change notifications to a designated Amazon S3 delivery channel and Amazon SNS. It is typically used for resource inventory, configuration history, compliance auditing, and drift detection within an AWS environment.

🗂 Resource Category

Management and Governance • Security, Identity, and Compliance

🧠 Exam Memory Hook

Think: "Track resource configuration history and evaluate compliance continuously = AWS Config"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and maintains the AWS Config control plane, APIs, console, backend storage and evaluation infrastructure, and the managed rules catalog and execution environment; AWS also patches and updates the underlying service platform and runtime used to run the Config service. AWS provides the mechanisms to deliver configuration data to customer-specified delivery channels when configured and maintains service availability for the Config control plane. AWS does not perform customer-specific remediation of resources unless the customer configures automation using other services.

Customer responsibilities: The customer configures the configuration recorder, delivery channel (for example an S3 bucket and optional SNS topic), selects or authores AWS Config Rules (managed or custom), secures IAM permissions and delivery channel resources, monitors compliance findings, and implements any remediation or automation using separate services such as AWS Lambda or AWS Systems Manager. The customer is responsible for enabling recorders in desired regions/accounts, managing retention and lifecycle of delivered artifacts, and maintaining any custom rule code and associated resources.

Patching responsibilities: AWS patches the physical infrastructure, hypervisor, and the AWS Config service platform and runtime. The customer patches guest operating systems, application code, packaged dependencies, and any Lambda functions or other compute resources they deploy for custom rules or remediation. For resources outside of AWS Config (for example EC2 instances or managed databases), patching responsibilities follow those services' ownership models and remain the customer's responsibility where applicable.

🏗 Typical Architecture

💡 Top 5 Features

  • Records point-in-time configuration items and tracks configuration changes for supported AWS resources.
  • Delivers configuration snapshots and configuration items to a customer-specified Amazon S3 delivery channel and can publish change notifications to Amazon SNS.
  • Evaluates resource configurations against AWS Config Rules using provided managed rules or customer-defined rules (including Lambda-backed custom rules).
  • Provides a Config Aggregator to aggregate configuration and compliance data across accounts and regions for centralized visibility.
  • Maintains a searchable resource inventory and records resource relationships to support troubleshooting and audits.

✅ Top 5 Use Cases

  • Audit and compliance evidence collection by storing historical configuration snapshots and a change timeline for supported resources.
  • Continuous compliance monitoring by evaluating resource state against managed and custom AWS Config Rules and surfacing noncompliant resources.
  • Configuration drift detection for infrastructure managed by IaC by comparing current resource state to expected configurations over time.
  • Forensic investigation and root cause analysis by reviewing configuration history and relationships when an incident occurs.
  • Centralized governance in multi-account environments by aggregating configuration and compliance data with AWS Config Aggregator.

🏗 Architecture Placement

AWS Config operates as a management-plane service within each account and region that records resource configuration state and changes; it receives configuration and CloudTrail events and stores data to a configured delivery channel such as Amazon S3 and notifications via Amazon SNS. Config Rules evaluate recorded configuration items and can invoke AWS Lambda for custom evaluations; an AWS Config Aggregator can collect data across accounts and regions for organization-level visibility. Placement depends on enabling the recorder in the regions and accounts you want to monitor.

🎯 Commonly Used With

- Amazon CloudWatch
- AWS Lambda
- AWS CloudTrail
- AWS Identity and Access Management
- Amazon S3

🌍 5 Real-World Examples

  • A bank retains configuration snapshots in Amazon S3 and uses AWS Config Rules to provide auditors with a timeline of changes to firewall and IAM configurations.
  • A healthcare provider uses AWS Config to maintain a resource inventory and evidence of configuration changes to support regulatory audits.
  • A retail company detects drift between declared infrastructure-as-code templates and live resources by reviewing AWS Config change history and triggering reviews.
  • A telecommunications operator aggregates AWS Config data from multiple accounts to produce a centralized compliance dashboard for network and infrastructure configurations.
  • A government IT team uses AWS Config Rules to flag noncompliant encryption and logging settings and then investigates configuration timelines during change reviews.

🎓 AWS Exam Clues

  • Require point-in-time configuration history and a timeline of changes for supported AWS resources.
  • Need continuous evaluation of resource state against defined compliance rules (managed or custom).
  • Require cross-account or cross-region aggregation of configuration and compliance data for centralized audits.
  • Need delivery of configuration snapshots and items to Amazon S3 and notifications to SNS for integration with downstream processes.
  • Custom rule logic can be implemented with Lambda, so maintaining that code and permissions is a customer responsibility.

📝 Quick Revision

AWS Config records and stores configuration items and change history for supported resources and evaluates configurations against managed or custom rules. Use it when you need audit evidence, drift detection, or centralized compliance; secure delivery channels and maintain any custom rule code and cross-account aggregation configuration.

🏷 Keywords

configuration recorder • configuration item • configuration snapshot • AWS Config Rules • managed rules • custom rules • Config Aggregator • resource inventory • change timeline • S3 delivery channel • SNS notifications • CloudTrail integration