Mastering AWS Configuration Management

Configuration management is the cornerstone of reliability and compliance in a DevOps environment. This guide focuses on AWS Config, a core service for auditing and recording resource states, and how it integrates with other AWS services to ensure governance at scale.

Learning Objectives

After studying this guide, you should be able to:

• Define Configuration Management and its benefits for scalability and disaster recovery.
• Differentiate between AWS Config, AWS Systems Manager, and AWS CloudTrail.
• Explain the lifecycle of a Configuration Item (CI) from recording to evaluation.
• Design automated remediation workflows using AWS Config Rules and Systems Manager Automation.
• Implement multi-account, multi-Region data aggregation for enterprise-wide compliance.

Key Terms & Glossary

• Configuration Item (CI): A point-in-time record of the attributes and relationships of a resource.
• Configuration Recorder: The mechanism that records and stores changes to supported resources in an account.
• Config Rule: A set of conditions that define the "desired state" of a resource; used to determine compliance.
• Aggregator: An AWS Config resource type that collects compliance data from multiple accounts and Regions into a single view.
• Conformance Pack: A collection of AWS Config rules and remediation actions that can be deployed as a single entity.

The "Big Idea"

[!IMPORTANT] The "Big Idea" behind AWS Config is Compliance-as-Code. Instead of manual audits, you define your security and operational requirements as logic (rules). AWS Config then acts as a "DVR for your AWS infrastructure," allowing you to playback configuration history to see exactly who changed what, when, and whether it violated your compliance standards.

Formula / Concept Box

Hierarchical Outline

• I. Core Components of AWS Config
  • Configuration Recorder: Must be enabled to track resource types.
  • Configuration History: Stored in Amazon S3; delivered every 6 hours.
  • Configuration Stream: Real-time notifications via Amazon SNS.
• II. Compliance Evaluation
  • Managed Rules: Pre-built by AWS (e.g., s3-bucket-public-read-prohibited).
  • Custom Rules: Written in AWS Lambda for specialized logic.
  • Trigger Types: Configuration Changes vs. Periodic (e.g., every 24 hours).
• III. Automation & Remediation
  • Remediation Actions: Using AWS Systems Manager (SSM) Automation documents to fix non-compliant resources.
  • Event-Driven Response: Integrating with EventBridge to trigger external workflows.
• IV. Governance at Scale
  • Multi-Account/Region: Using Aggregators and AWS Organizations.
  • AWS Control Tower: Automatically enables Config rules across an organization.

Visual Anchors

AWS Config Evaluation Lifecycle

Remediation Workflow Architecture

Definition-Example Pairs

• Drift Detection: Identifying when actual configuration deviates from the template state.
  • Example: A CloudFormation stack creates an S3 bucket with encryption, but a user later manually disables encryption in the console.
• Event-Driven Remediation: Automatically fixing a resource immediately after a rule violation is detected.
  • Example: If an IAM user is created without MFA, AWS Config triggers a Lambda function to disable the user's access keys instantly.
• Software Inventory: Recording changes inside an instance (OS level).
  • Example: Using AWS Config with SSM Agent to track which version of OpenSSL is installed on all EC2 instances for vulnerability management.

Worked Examples

Scenario: Enforcing S3 Bucket Encryption

Objective: Ensure all S3 buckets have server-side encryption enabled.

1. Enable Configuration Recorder: Set to record the AWS::S3::Bucket resource type.
2. Deploy Rule: Select the managed rule s3-bucket-server-side-encryption-enabled.
3. Define Remediation:
   • Choose the SSM Document: AWS-EnableS3BucketEncryption.
   • Map the BucketName parameter to the Resource ID provided by AWS Config.
4. Test: Create an unencrypted bucket.
   • Result: Within minutes, Config marks the bucket as NON_COMPLIANT and triggers the SSM document to enable encryption.

Checkpoint Questions

1. What is the maximum frequency at which configuration history files are delivered to S3? (Ans: Every 6 hours).
2. Which service is used to write Custom Config Rules? (Ans: AWS Lambda).
3. How does AWS Config differ from CloudTrail? (Ans: CloudTrail records who made the call/API; Config records the resulting state of the resource).
4. What tool is used to centralize compliance data from multiple AWS accounts into one master account? (Ans: AWS Config Aggregator).

Muddy Points & Cross-Refs

• Config vs. Systems Manager Inventory: While both track software, SSM Inventory is better for real-time querying across fleets, while AWS Config is better for maintaining a historical timeline and auditing compliance against a baseline.
• Pricing Trap: Recording every single resource change can be expensive in high-churn environments (e.g., frequent Auto Scaling). Use Resource Filtering to record only what you need to audit.

Comparison Tables