Conformance Packs and Organisation Trails

AWS Config Conformance Packs are collections of Config rules and remediation actions packaged together as a single deployable unit using a CloudFormation-like YAML template. They represent a set of compliance controls for a specific standard or framework — such as the CIS AWS Foundations Benchmark, PCI-DSS, HIPAA, or NIST 800-53. Instead of deploying dozens of individual Config rules manually, you deploy a conformance pack and get comprehensive coverage in minutes.

AWS provides dozens of sample conformance pack templates on GitHub and in the AWS console. Examples include: Operational-Best-Practices-for-CIS-AWS-v1.4-Level1 (foundational security controls), Operational-Best-Practices-for-PCI-DSS (payment card industry controls), and Operational-Best-Practices-for-HIPAA-Security (healthcare data controls). You can use these templates as-is or customise them by adding, removing, or modifying individual rules before deployment.

A conformance pack template is a YAML document containing a Parameters section and a Resources section. Each resource in the template is a Config rule definition using the AWS::Config::ConfigRule CloudFormation resource type. You can also include AWS::Config::RemediationConfiguration resources to attach automatic remediation actions. Parameters make the template reusable — for example, you can parameterise which S3 bucket stores results or which IAM role the remediation assumes.

Once deployed, you can view a compliance summary for each conformance pack — showing how many rules pass, how many fail, and how many resources are non-compliant for each rule. You can drill down from the pack level to the rule level to the individual resource level. The compliance data can be exported to S3 in a results bucket you specify, enabling you to ingest it into a SIEM or compliance reporting dashboard.

An Organisation Conformance Pack deploys a conformance pack to all accounts in an AWS Organisation simultaneously from the management account (or a delegated administrator account). Member accounts cannot delete or modify the deployed rules. New accounts joining the organisation automatically receive the conformance pack. This is the most efficient way to enforce compliance baselines across hundreds of accounts without visiting each account individually.

In an AWS Organisation, you can designate a delegated administrator account for AWS Config so the management account does not need to be used for day-to-day Config operations. The delegated administrator can deploy organisation Config rules, conformance packs, and aggregators, and can view compliance data from all member accounts. This follows the best practice of keeping the management account minimally used for operational tasks.

An organisation trail in AWS CloudTrail captures API activity from every account in the AWS Organisation — current and future members — and delivers logs to a centralised S3 bucket in the management account. Unlike account-level trails that each account must maintain, an organisation trail is created once and automatically applies everywhere. Member accounts can see the organisation trail in their CloudTrail console but cannot modify or delete it.

The organisation trail S3 bucket uses a structured key prefix: AWSLogs/ORGANIZATION_ID/ACCOUNT_ID/CloudTrail/REGION/YYYY/MM/DD/. This hierarchy allows you to query all accounts' logs with a single Athena table partitioned by organisation ID and account ID, or to use S3 object prefixes to grant specific accounts read access to only their own logs. The bucket policy must explicitly allow cloudtrail.amazonaws.com to write from all accounts in the organisation.

Service Control Policies (SCPs) in AWS Organisations are a complementary preventive control that restricts what member accounts are allowed to do. Pairing SCPs with Config rules creates a layered defence: SCPs prevent non-compliant actions from being taken at all (for example, deny creation of unencrypted EBS volumes), while Config rules detect non-compliant states and trigger remediation. The SAA-C03 exam tests your ability to choose between preventive controls (SCPs) and detective controls (Config) for different scenarios.

AWS Security Hub ingests findings from Config (compliance check results), GuardDuty (threat detections), Inspector (vulnerability findings), Macie (data sensitivity), and partner tools into a single, normalised view. It maps findings against security standards like CIS Foundations, PCI-DSS, and the AWS Foundational Security Best Practices. While Config focuses on configuration state, Security Hub is where you go to get an overall security score and prioritised list of findings across all services.

The complete enterprise governance architecture uses multiple services together: SCPs prevent violations before they happen, AWS Config + Organisation Conformance Packs detect and remediate violations automatically, Organisation CloudTrail records all API activity centrally, Security Hub aggregates findings into a prioritised security score, and EventBridge + Lambda provides automated responses to high-severity findings. This layered approach is what AWS calls the defence-in-depth model for cloud governance.

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

In this lesson you learned: Conformance Packs bundle multiple Config rules into a single deployable YAML template for framework compliance, Organisation Conformance Packs apply automatically to all AWS Organisation accounts and cannot be modified by members, and Organisation Trails centralise API audit logs from all accounts without per-account configuration. Next up we explore EBS Volume Types in the Storage Deep Dive.