AWS Config: Automated Remediation and Governance

This study guide focuses on the critical DevOps Professional capability of using AWS Config not just for auditing, but as an active tool for infrastructure self-healing through automated remediation.

Learning Objectives

By the end of this guide, you should be able to:

• Configure AWS Config rules to identify non-compliant resources.
• Implement automated remediation using AWS Systems Manager (SSM) Automation documents.
• Differentiate between change-triggered and periodic evaluations.
• Design multi-account remediation workflows using aggregators and IAM roles.
• Troubleshoot remediation failures and execution errors.

Key Terms & Glossary

• Configuration Item (CI): A point-in-time record of a resource's attributes (e.g., ID, type, tags, relationships).
• Configuration Recorder: The mechanism that records and stores CI changes in an S3 bucket.
• Managed Rules: Predefined, AWS-authored rules (e.g., s3-bucket-public-read-prohibited) that require minimal configuration.
• Custom Rules: Rules backed by AWS Lambda functions for complex logic not covered by managed rules.
• Remediation Action: A specific task (usually an SSM Automation document) triggered when a resource is flagged as non-compliant.
• Aggregator: A resource that collects compliance data from multiple accounts and regions into a single dashboard.

The "Big Idea"

In a DevOps environment, Compliance-as-Code moves the security and auditing process from a periodic "check-the-box" activity to a real-time, self-healing loop. Instead of waiting for a security audit to find an unencrypted S3 bucket, AWS Config detects the change immediately and uses SSM Automation to "remediate" it—applying the encryption without human intervention. This reduces the Mean Time to Remediate (MTTR) and enforces a desired state across the entire cloud fleet.

Formula / Concept Box

Hierarchical Outline

• I. Configuration Recording
  • Global Resources: Recording IAM users, groups, and roles (region-specific settings).
  • Resource Relationships: Mapping how an EC2 instance relates to a VPC or EBS volume.
• II. Rule Evaluation Logic
  • Scope of Change: Defining which resources trigger the rule (tags, resource ID, or resource type).
  • Trigger Types: Understanding why a rule runs (Configuration changes vs. Cron-like schedules).
• III. The Remediation Workflow
  • SSM Automation Integration: Selecting the appropriate AWS-* document or custom document.
  • Parameters: Passing the ResourceId from the Config evaluation to the SSM document inputs.
  • IAM Permissions: The AutomationConsumeRole required for SSM to perform actions on your behalf.
• IV. Governance at Scale
  • Aggregators: Centralizing multi-region and multi-account compliance status.
  • Organization Rules: Deploying rules across all accounts in an AWS Organization.

Visual Anchors

The Remediation Loop

Multi-Account Aggregation Architecture

Definition-Example Pairs

• Managed Remediation: Using an AWS-provided SSM document to fix a common issue.
  • Example: Using AWS-TerminateEC2Instance to automatically shut down instances that don't have a required CostCenter tag.
• Manual Remediation: A workflow where an admin reviews the non-compliance before triggering the fix.
  • Example: An S3 bucket is found public; the security team receives an alert and manually clicks "Remediate" after verifying the bucket isn't intended for public hosting.
• Resource Scope: The filter applied to a rule to limit which assets are evaluated.
  • Example: A rule checking for EBS encryption is scoped only to resources of type AWS::EC2::Volume.

Worked Examples

Scenario: Remediating Public S3 Buckets

Goal: Ensure no S3 buckets allow public read access. If one is found, automatically set it to private.

1. Rule Creation: Select the managed rule s3-bucket-public-read-prohibited.
2. Remediation Configuration:
   • Action: Select AWS-ConfigureS3BucketPublicAccessBlock.
   • Parameters: Map the BucketName parameter to the ResourceId discovered by AWS Config.
   • Execution Role: Provide an IAM Role ARN that has the AmazonS3FullAccess and AmazonSSMAutomationRole policies.
3. Testing:
   • Create a test bucket and manually disable "Block all public access."
   • Wait for the Config evaluation (Change-triggered).
   • Observe the status change from "Non-compliant" to "Compliant" as the SSM document executes and flips the setting back.

Checkpoint Questions

1. What is the main difference between a change-triggered rule and a periodic rule?
2. Which service does AWS Config primarily use to execute automated remediation actions?
3. True or False: An AWS Config Aggregator can consolidate data from multiple AWS Organizations if the appropriate handshakes are in place.
4. If a remediation action fails, how many times will AWS Config attempt to retry it by default?

[!TIP] Answer Key: 1. Change-triggered runs on API activity; Periodic runs on a schedule. 2. AWS Systems Manager (SSM) Automation. 3. True. 4. 5 times.

Muddy Points & Cross-Refs

• Config vs. GuardDuty: Config is for compliance (state of resources). GuardDuty is for threat detection (behavioral anomalies). Use Config for "Is this bucket public?" and GuardDuty for "Is someone exfiltrating data from this bucket?"
• IAM Role for Remediation: A common failure point is the AutomationConsumeRole. It must have permissions to perform the actual fix (e.g., ec2:StopInstances) AND be trustable by the SSM service.
• Cross-Region Aggregation: Remember that while an Aggregator gives you a global view, remediation is still triggered by rules in the local region where the resource exists.

Comparison Tables

Evaluation Types

Remediation Options