AWS Config and Rules: Governance, Compliance, and Remediation

AWS Config is a fully managed service that provides an AWS resource inventory, configuration history, and configuration change notifications to enable security and governance. This guide focuses on implementing and managing AWS Config Rules to maintain your desired infrastructure state.

Learning Objectives

• Define the core components of AWS Config, including Configuration Items (CIs) and the Configuration Recorder.
• Evaluate the differences between AWS Managed Rules and Custom Rules (Lambda-based).
• Configure multi-account and multi-region data aggregation for centralized compliance monitoring.
• Implement automated remediation of noncompliant resources using AWS Systems Manager (SSM) Automation.
• Analyze the integration between AWS Config, Amazon EventBridge, and AWS CloudTrail for event-driven response.

Key Terms & Glossary

• Configuration Item (CI): A record of the configuration of a specific resource at a point in time (the "atomic unit" of AWS Config).
• Configuration Recorder: The mechanism that detects and stores resource changes as CIs.
• Aggregator: An AWS Config resource that collects compliance data from multiple accounts and regions into a single dashboard.
• Noncompliant: A status indicating that a resource does not meet the requirements defined by an AWS Config Rule.
• Configuration History: A collection of CIs for a given resource over time, delivered to an S3 bucket every six hours.

The "Big Idea"

AWS Config acts as the "Compliance Officer" for your cloud environment. While CloudTrail tells you who made a change (the API call), AWS Config tells you what the resource looked like before and after that change. Rules allow you to codify your internal best practices and security standards, ensuring that any deviation is not only recorded but potentially fixed automatically.

Formula / Concept Box

Hierarchical Outline

• I. Core Architecture
  • Configuration Recorder: Tracks all supported resources or a customized subset in a region.
  • Global Resources: Optionally includes IAM users, groups, and roles.
  • S3 & SNS Integration: History files delivered to S3; notifications sent via SNS.
• II. AWS Config Rules
  • Managed Rules: Common checks (e.g., s3-bucket-public-read-prohibited, iam-password-policy).
  • Custom Rules: Use Lambda to define complex logic not covered by managed rules.
  • Evaluation Cycle: Change-triggered (real-time) or Periodic (scheduled).
• III. Governance at Scale
  • Multi-Account Aggregators: Centralize data from individual accounts, multiple regions, or an entire AWS Organization.
  • Remediation Actions: Link Rules to SSM Automation to "auto-heal" infrastructure.

Visual Anchors

The AWS Config Workflow

Structure of a Configuration Item

Definition-Example Pairs

• Resource Relationship: The link between different AWS components.
  • Example: An EC2 instance having a relationship with its attached EBS volume and the VPC it resides in.
• AWS Managed Rule: A predefined, AWS-maintained compliance check.
  • Example: restricted-common-ports checks if security groups allow unrestricted incoming traffic to specific ports.
• Multi-Account Aggregator: A tool for enterprise-wide compliance visibility.
  • Example: A security team uses one Aggregator in a "Security Account" to see the compliance status of all 50 member accounts in their AWS Organization.

Worked Examples

Scenario: Auto-Remediating Unencrypted S3 Buckets

1. Requirement: All S3 buckets must have AES-256 server-side encryption enabled.
2. Config Rule: Deploy the managed rule s3-bucket-server-side-encryption-enabled.
3. Remediation Configuration:
   • Choose SSM Automation as the remediation action.
   • Select the document AWS-ConfigureS3BucketEncryption.
   • Map the BucketName parameter to the Resource ID provided by Config.
4. Result: If a developer creates a public, unencrypted bucket, AWS Config detects the change, marks it noncompliant, and SSM automatically applies encryption within minutes.

Checkpoint Questions

1. How often does AWS Config deliver configuration history files to Amazon S3?
2. What are the five core sections found inside a Configuration Item (CI)?
3. What service would you use to define a custom compliance rule that requires logic not found in AWS Managed Rules?
4. True or False: An AWS Config Aggregator requires that AWS Config be enabled in all source accounts/regions.

Muddy Points & Cross-Refs

• Config vs. CloudTrail: CloudTrail is "Who/When" (API level). Config is "What/State" (Resource level). Use CloudTrail to see who deleted a bucket; use Config to see what the bucket's permissions were before deletion.
• Regional Scope: AWS Config is a regional service. You must enable it in every region you wish to monitor, though Aggregators can provide a cross-regional view.
• Cost Management: Large environments with frequent changes (e.g., massive Auto Scaling groups) can generate many CIs, leading to higher costs. Use the Recorder's "only specific resource types" setting to limit scope.

Comparison Tables

Managed vs. Custom Rules

AWS Config vs. EventBridge