AWS Config

What AWS Config is

AWS Config assesses, audits, and evaluates configurations of AWS resources. It records configuration changes so teams can inspect earlier states through the console, API, or CLI. It can also record configurations for third-party resources such as on-premises servers, SaaS monitoring tools, and version control systems.

Teams can apply prebuilt rules or implement custom rules with AWS Lambda to assess configurations against policies. Conformance packs group rules and remediation actions for deployment and aggregated compliance reporting. Aggregators provide a centralized view of resource metadata and rule compliance across accounts and Regions, while advanced queries use a subset of SQL SELECT syntax to search current state. The feature page lists integrations with AWS Organizations, CloudTrail, Security Hub CSPM, Audit Manager, Systems Manager, Firewall Manager, EC2 Dedicated Hosts, and Application Load Balancers. Service Management Connector supports resource tracking through ServiceNow and Jira Service Desk. Charges are usage-based, reflecting recorded configuration items and rule and conformance pack evaluations; S3, SNS, and Lambda charges may also apply.

Who it suits

AWS Config is intended for security and governance teams, administrators in larger organizations, information security and compliance users, and infrastructure operators managing AWS resources.

Limits

An AWS account can create up to 150 Config rules by default, with limit increases available by request. Rules report compliance status but do not guarantee ongoing compliance or prevent noncompliant changes. The lowest listed plan has usage-based charges, and S3, SNS, and Lambda charges may also apply.

Getting started

1. Open AWS Config through the web console or use its API.
2. Configure recording for the AWS resources and supported third-party resources you need to track.
3. Apply prebuilt rules or implement custom rules with AWS Lambda.
4. Use conformance packs to deploy grouped rules and remediation actions.
5. Configure an aggregator for a centralized view across accounts and Regions.
6. Use advanced queries to search current resource configuration state.

Verdict

AWS Config combines configuration history, policy evaluation, querying, and multi-account views. Its rules report compliance status but cannot prevent later noncompliant changes, and usage charges vary with recorded items and evaluations.