AWS Config Rules and Remediation

AWS Config is a continuous configuration audit service that records the configuration state of your AWS resources over time and evaluates those configurations against desired rules. Unlike CloudTrail (which records who did what), AWS Config answers what does this resource look like right now? and what did it look like at any point in the past?. It also answers: does this configuration comply with my policy? — making it the go-to service for governance and compliance.

When AWS Config records a resource, it creates a configuration item (CI) — a snapshot of the resource's attributes, relationships, and metadata at a point in time. Every time a resource changes, a new CI is recorded. AWS Config maintains a full configuration history for each resource, allowing you to see how a security group evolved over months and exactly when a rule was added or removed. CIs are delivered to an S3 bucket and optionally to CloudWatch Events.

To start using AWS Config, you create a configuration recorder (specifying which resource types to record) and a delivery channel (specifying an S3 bucket and optional SNS topic for change notifications). You can record all supported resource types or a specific subset. A configuration aggregator lets you consolidate Config data from multiple accounts and Regions into a single view for organisation-wide compliance reporting.

Config rules define the desired configuration state for your resources. AWS Managed Config rules are pre-built rules provided by AWS covering common compliance checks — for example, s3-bucket-public-read-prohibited checks that S3 buckets are not publicly readable, ec2-instance-no-public-ip checks that EC2 instances don't have public IPs, and iam-password-policy verifies your account password policy meets complexity requirements. Over 300 managed rules are available.

When no AWS Managed rule covers your requirement, you can write a custom Config rule using an AWS Lambda function. Lambda receives configuration items as event payloads and must return a COMPLIANT or NON_COMPLIANT verdict. Custom rules can enforce organisation-specific naming conventions, required tags, approved AMI IDs, or any logic your compliance team requires. Rules can evaluate on change (when the resource changes), periodically (every 1/3/6/12/24 hours), or both.

Config also supports proactive rules using AWS CloudFormation Guard — a policy-as-code language. Proactive rules evaluate resources before they are created via CloudFormation, AWS CDK, or Terraform Cloud, catching non-compliant configurations at deploy time rather than after they exist in production. This shifts compliance left in your infrastructure pipeline. Proactive evaluation is a newer feature that the SAA-C03 exam may reference in shift-left governance scenarios.

Config rules can be paired with automatic remediation actions so that non-compliant resources are fixed without human intervention. Remediation actions are AWS Systems Manager (SSM) Automation documents. For example, if an S3 bucket becomes non-compliant because someone enabled public access, Config can automatically run the AWS-DisableS3BucketPublicReadWrite SSM document to re-enable the bucket's public access block. Remediation can be automatic (immediate) or manual (triggered on demand).

The AWS Config Resource Timeline in the console shows every configuration change for a resource as a timeline — you can scroll back to any point and see exactly what the resource looked like, including its relationships to other resources (for example, which security groups were attached, which IAM role was associated). Clicking on a relationship navigates to that related resource's timeline. This makes Config invaluable for root-cause analysis: you can pinpoint exactly which change broke production.

A configuration aggregator collects Config data from multiple AWS accounts and Regions into a single account for centralised compliance reporting. In an AWS Organisation, you can create an aggregator in the management account that automatically includes all member accounts without requiring individual authorisation. Aggregators support querying with Advanced Queries — a SQL-like interface to find all non-compliant resources across the organisation in seconds.

When you have thousands of non-compliant resources, Config's remediation exceptions let you exempt specific resources for a defined period with a documented reason — avoiding false-positive remediation of legitimate edge cases. For large-scale clean-up you can trigger manual remediation in bulk from the console or use Systems Manager State Manager associations to apply desired configurations to fleets of EC2 instances on a schedule, combining Config's detection with SSM's enforcement.

A common SAA-C03 question is distinguishing Config from CloudTrail. CloudTrail answers: who did what, when, from where (API call audit log). AWS Config answers: what does the resource look like now, and what has it looked like over time (configuration state history and compliance). They are complementary — CloudTrail tells you that someone called ModifySecurityGroup at 3pm, while Config shows you the before-and-after state of the security group. Use both together for complete security governance.

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

In this lesson you learned: AWS Config records configuration state over time and evaluates resources against compliance rules, managed and custom rules check hundreds of resource attributes with automatic or on-demand evaluation, and SSM Automation remediation can automatically fix non-compliant resources without human intervention. Next up we explore Conformance Packs and Organisation Trails for enterprise-scale governance.