How AWS Config Records Resource State
Understand the configuration snapshots Config keeps for you.
How AWS Config Records Resource State is a free AWS Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the AWS Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What AWS Config Is
AWS Config is a service that records the configuration of your AWS resources over time and lets you assess whether they comply with desired settings. Where CloudTrail records the API calls that change things, Config records the resulting state of the resources themselves. The two are complementary.
Configuration Items
The core unit is the configuration item (CI): a point-in-time snapshot of a resource's attributes, relationships, and metadata. Every time a resource changes, Config records a new CI. This stream of CIs forms a complete history of what each resource looked like and when.
The Configuration Recorder
Recording is done by the configuration recorder, which you enable per region. You choose whether it tracks all supported resource types or a selected subset. For broad security and compliance coverage, recording all resource types is the common, recommended setting.
The Delivery Channel
Config sends configuration snapshots and history to a delivery channel, which points at an S3 bucket for storage and optionally an SNS topic for notifications. The S3 bucket becomes the durable record you can query later, so locking it down is part of protecting your audit trail.
Resource Relationships
Config captures not just a resource's settings but its relationships to others, such as which security groups attach to an instance or which subnet a network interface lives in. This relationship map is powerful during investigations, letting you understand how a change to one resource affects connected ones.
Config Versus CloudTrail
A frequent exam distinction: CloudTrail answers "who made which API call," while Config answers "what did this resource look like and how did it change." If you need to prove a security group allowed open SSH last Tuesday, Config holds that state; CloudTrail shows who authorized the rule.
Multi-Account, Multi-Region
Config is regional, so you enable it in each region you use. An aggregator can roll up data from many accounts and regions into a single view, which is essential for organization-wide compliance reporting. Without an aggregator you would check each account and region separately.
Querying Current State
Config's advanced query feature lets you run SQL-like queries over current resource configurations, such as finding all unencrypted EBS volumes or publicly accessible buckets across an aggregator. This turns Config into an inventory and posture tool, not just a passive recorder.
SELECT resourceId, configuration.encrypted
WHERE resourceType = 'AWS::EC2::Volume'
AND configuration.encrypted = falseCost Awareness
Config bills per configuration item recorded and per rule evaluation. Recording every change on highly dynamic resources can add up. You can use recording exclusions or periodic recording for some resource types to manage cost while keeping the security-relevant resources fully tracked.
Conformance and Aggregation
Config integrates with conformance packs that bundle compliance rules and with aggregators that combine results across accounts. This lets a central security team see the configuration posture of an entire organization in one place, rather than logging into each account to assess compliance separately.
Why It Matters for Security
Config is foundational for compliance: it provides the evidence of resource state over time that auditors demand, feeds automated rules that detect insecure settings, and supports auto-remediation. It is the system of record for "is my environment configured the way it should be," a central theme of the exam.
Quick Check
Test your understanding of AWS Config.
Recap
AWS Config records resource state as configuration items via a regional configuration recorder, delivering snapshots to an S3 delivery channel. It captures relationships between resources, complements CloudTrail (state versus API calls), and rolls up across accounts with an aggregator. It powers inventory queries, compliance rules, and remediation.
Frequently asked questions
Is the “How AWS Config Records Resource State” lesson free?
Yes — the full text of “How AWS Config Records Resource State” is free to read here on the web, and the AWS Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the AWS Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “How AWS Config Records Resource State”?
Understand the configuration snapshots Config keeps for you. You practise AWS Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start AWS Security Academy?
No prior experience is required. AWS Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “How AWS Config Records Resource State” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this AWS Security Academy lesson?
Yes. Every AWS Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- How AWS Config Records Resource State
- Viewing Configuration Timeline History
- Managed and Custom Config Rules
- Auto-Remediation Through Config Rules