AWS Config 규칙 및 문제 해결

AWS Config란 무엇입니까?

구성 항목과 구성 기록

# Get the full configuration history for an EC2 security group
aws configservice get-resource-config-history \
  --resource-type AWS::EC2::SecurityGroup \
  --resource-id sg-0abc1234def567890 \
  --limit 10 \
  --query 'configurationItems[].{Time:configurationItemCaptureTime,Status:configurationItemStatus}'

AWS Config 활성화

# Enable AWS Config recording for all resource types
aws configservice put-configuration-recorder \
  --configuration-recorder \
    name=default,roleARN=arn:aws:iam::111122223333:role/AWSConfigRole \
  --recording-group allSupported=true,includeGlobalResourceTypes=true

# Set up delivery channel
aws configservice put-delivery-channel \
  --delivery-channel \
    name=default,s3BucketName=my-config-bucket-111122223333,snsTopicARN=arn:aws:sns:us-east-1:111122223333:ConfigChanges

aws configservice start-configuration-recorder --configuration-recorder-name default

AWS Config Rules: 관리형 규칙

# Add the managed rule to check S3 buckets are not publicly readable
aws configservice put-config-rule \
  --config-rule '{
    "ConfigRuleName": "s3-bucket-public-read-prohibited",
    "Source": {
      "Owner": "AWS",
      "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"
    },
    "Scope": {
      "ComplianceResourceTypes": ["AWS::S3::Bucket"]
    }
  }'

# View compliance status of all rules
aws configservice describe-compliance-by-config-rule \
  --query 'ComplianceByConfigRules[].{Rule:ConfigRuleName,Compliance:Compliance.ComplianceType}'

Lambda를 사용한 사용자 지정 Config 규칙

# Register a custom Lambda-backed Config rule
aws configservice put-config-rule \
  --config-rule '{
    "ConfigRuleName": "required-tags-enforcer",
    "Source": {
      "Owner": "CUSTOM_LAMBDA",
      "SourceIdentifier": "arn:aws:lambda:us-east-1:111122223333:function:RequiredTagsChecker",
      "SourceDetails": [{
        "EventSource": "aws.config",
        "MessageType": "ConfigurationItemChangeNotification"
      }]
    },
    "Scope": {
      "ComplianceResourceTypes": ["AWS::EC2::Instance","AWS::S3::Bucket"]
    }
  }'

CloudFormation Guard를 사용한 사전 예방 규칙

SSM을 사용한 자동 수정

# Add automatic remediation to a Config rule
aws configservice put-remediation-configurations \
  --remediation-configurations '[
    {
      "ConfigRuleName": "s3-bucket-public-read-prohibited",
      "TargetType": "SSM_DOCUMENT",
      "TargetId": "AWS-DisableS3BucketPublicReadWrite",
      "Parameters": {
        "S3BucketName": {"ResourceValue": {"Value": "RESOURCE_ID"}},
        "AutomationAssumeRole": {"StaticValue": {"Values": ["arn:aws:iam::111122223333:role/ConfigRemediationRole"]}}
      },
      "Automatic": true,
      "MaximumAutomaticAttempts": 3,
      "RetryAttemptSeconds": 60
    }
  ]'

Config 타임라인 및 리소스 관계

# Get current compliance status for all EC2 instances
aws configservice get-compliance-details-by-resource \
  --resource-type AWS::EC2::Instance \
  --resource-id i-0123456789abcdef0 \
  --query 'EvaluationResults[].{Rule:EvaluationResultIdentifier.EvaluationResultQualifier.ConfigRuleName,Compliance:ComplianceType}'

계정 간 Config 집계

# Query all non-compliant resources across an organisation using Advanced Query
aws configservice select-aggregate-resource-config \
  --configuration-aggregator-name OrgAggregator \
  --expression "SELECT resourceId, resourceType, accountId, awsRegion
    WHERE complianceType = 'NON_COMPLIANT'
    AND resourceType = 'AWS::S3::Bucket'"
  --query 'Results'

대규모 수정

# Add a remediation exception for a specific resource
aws configservice put-remediation-exceptions \
  --config-rule-name s3-bucket-public-read-prohibited \
  --resource-keys ResourceType=AWS::S3::Bucket,ResourceId=my-public-website-bucket \
  --message 'Static website hosting requires public access' \
  --expiration-time 2025-01-01T00:00:00Z

AWS Config와 CloudTrail 비교

빠른 확인

레슨 요약