What is AWS Config?

AWS Config is a service that provides a detailed inventory of your AWS resources and their configurations. It continuously monitors and records configurations and changes, enabling you to assess compliance with internal policies, industry regulations, and best practices.

Key Features and Benefits

1. Configuration Visibility and Tracking

AWS Config captures a detailed snapshot of your AWS environment, including resource configurations and their relationships. This allows for a comprehensive understanding of the setup, aiding in troubleshooting, auditing, and maintaining consistency.

2. Continuous Monitoring and Compliance Checks

By continuously monitoring resource configurations, AWS Config helps maintain compliance with desired configurations, security standards, and regulatory requirements. It enables the creation of rules to assess resource configurations against predefined policies, flagging any deviations for remediation.

3. Change Management and Notification

Tracking changes in your AWS infrastructure is simplified with AWS Config. It logs every modification, allowing for the review of historical configurations and enabling timely identification of alterations. Notifications can be set up to alert stakeholders about any changes made to configurations.

4. Security and Governance

Enhanced security is facilitated by AWS Config through the ability to track configuration changes and assess compliance against security standards. This helps in implementing proactive measures to safeguard against potential vulnerabilities.

How AWS Config Works

AWS Config operates around the concept of configuration items, which are records representing the state of a resource at a given point in time. These items are stored in a Configuration History and can be retrieved and analyzed for insights or compliance auditing.

Configuration Recorder

The Configuration Recorder is a key component that continuously tracks changes to resources in your AWS environment. It records the configurations and stores them in Amazon S3 buckets, facilitating analysis, audits, and compliance checks.

Rules and Compliance

AWS Config Rules evaluate the configurations against predefined rulesets. These rules can be AWS-managed or custom, allowing you to define specific criteria for compliance. When a configuration doesn’t meet the rule criteria, AWS Config generates an evaluation that can trigger notifications or automated remediation actions.

Implementing AWS Config

Implementing AWS Config involves setting up a Configuration Recorder and defining rules to monitor and evaluate your resource configurations. This can be done through the AWS Management Console, Command Line Interface (CLI), or AWS SDKs.

AWS Config works very similarly to Cloud Trail works

When you make a change for example to the security group an event is created
AWS Config picks up this event
AWS Config stores everything inside the configured S3 bucket
What happens after this depends on how you set this up, e.g. you use the AWS Standard Rules or you set up your own Custom Rules.
As an example, you can schedule a Lambda function that constantly looks for new events in the AWS config or you can look with Lambda whether there is a broken rule in the AWS config and trigger an SNS notification

AWS Config terminology

a) Configuration Items: Point-in-Time attributes of a resource
b) Configuration Snapshots: Collection of Config Items
c) Configuration Streams: Stream of changed config Items
d) Configuration History: Collection of config items for a resource over time
e) Configuration Recorder: The configuration records and stores config items

In summary, AWS Config primarily focuses on monitoring and managing resource configurations, while AWS CloudTrail specializes in tracking API activity and user actions within an AWS environment. Both services play crucial roles in maintaining security, compliance, and operational insights, often working together to provide a comprehensive view of AWS environments.

AWS Config