AWS Config
Track resources; Configurations and compliance over time
Config is like a security camera system that records every change to your AWS resources. It tracks configuration history: 'who changed this security group and when?' or 'what did this S3 bucket's settings look like last month?' Config also evaluates resources against rules: 'are all EBS volumes encrypted?' or 'do all EC2 instances have approved AMIs?' It's like having a compliance auditor who continuously checks your infrastructure and alerts you when something violates your policies. Perfect for security, compliance, and troubleshooting, since you can see exactly what changed and when.
Config records configuration changes as configuration items (CIs) stored in S3. It creates a configuration timeline showing resource state over time. Config Rules evaluate resources against desired configurations; AWS provides managed rules (pre-built) and you can create custom rules (Lambda functions). Rules can be triggered by configuration changes or run periodically.
Key Capabilities
Key features: aggregators (view compliance across multiple accounts/regions), conformance packs (collections of rules for compliance frameworks like PCI DSS), and remediation actions (automatically fix non-compliant resources via Systems Manager).
Gotchas & Constraints
Gotcha #1: Config charges per configuration item recorded and per rule evaluation, and costs can add up in large environments. Gotcha #2: Config records configuration, not data; it won't show S3 object contents, only bucket settings. Constraints: Maximum 1,000 Config Rules per region, configuration items retained indefinitely in S3 (you pay S3 storage costs), and rule evaluation can take several minutes.
A financial services company must prove compliance with PCI DSS and SOC 2. Auditors ask: 'Are all S3 buckets encrypted? Are all databases in private subnets? Do all EC2 instances have approved AMIs?' Manually checking 1,000 resources across 20 accounts is impossible. They enable AWS Config in all accounts and regions, creating an aggregator in a central compliance account. They deploy a conformance pack for PCI DSS: Config automatically creates 50+ rules checking encryption, network isolation, logging, and access controls. Config evaluates all resources and shows 200 non-compliant items: 50 unencrypted S3 buckets, 30 databases in public subnets, 120 instances with unapproved AMIs. They configure automatic remediation: Config triggers Systems Manager to enable S3 encryption and terminate non-compliant instances. For audits, they export Config compliance reports showing 100% compliance. When a developer accidentally makes an S3 bucket public, Config detects it within 10 minutes and sends an SNS alert.
The Result
continuous compliance monitoring, automated remediation, and audit-ready reports.