Security Foundations and Governance · Topic 5 of 6
AWS Config Rules and Aggregation
Evaluate compliance with AWS Config recorders, managed and custom rules, conformance packs, organization aggregators, advanced queries and remediation.
- 5 min
- Config records configuration changes and evaluates compliance. It does not block actions.
- Rules can be AWS managed, custom with Guard, or custom with Lambda, and trigger on change or on a schedule.
- A conformance pack deploys a set of rules and remediations as a unit, including across an organization.
What it is
AWS Config records the configuration of your AWS resources over time, and evaluates it against rules. It answers "what does this resource look like now, how did it look before, and does it comply with our standard?".
Config is the detective engine behind many other services, including Security Hub controls and Control Tower detective controls. It records configuration, not data or network traffic, and it does not block actions by itself.
How it works
Recorder and delivery
The configuration recorder captures a configuration item each time a supported resource changes. You choose to record all supported resource types or only chosen ones. Items are delivered to an S3 bucket through the delivery channel, with optional SNS notifications, and also feed the resource timeline.
The recorder must be on for anything else to work. Rules cannot evaluate resources that Config does not record, and Security Hub controls depend on it.
Rules
| Rule type | What it is | Choose it when |
|---|---|---|
| AWS managed rule | A ready made rule from AWS | A common check exists, such as encrypted volumes or public buckets |
| Custom rule with Guard | A rule written in CloudFormation Guard syntax | You need a custom check without writing Lambda code |
| Custom rule with Lambda | A function that evaluates the resource | Complex logic or calls to other systems |
Rules run on two kinds of triggers: when the configuration changes, or on a periodic schedule. Rules can also run in a proactive mode, which evaluates a resource definition before it is created. This works with CloudFormation Hooks.
# AWS CLI: add a managed rule that flags publicly readable buckets
aws configservice put-config-rule --config-rule '{
"ConfigRuleName": "s3-bucket-public-read-prohibited",
"Source": { "Owner": "AWS", "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED" },
"Scope": { "ComplianceResourceTypes": ["AWS::S3::Bucket"] }
}'A resource is evaluated as COMPLIANT, NON_COMPLIANT, or NOT_APPLICABLE. A rule shows INSUFFICIENT_DATA when Config has not yet evaluated it or lacks the data to decide.
Conformance packs
A conformance pack is a collection of rules and remediation actions, packaged in a template, that you deploy as one unit to an account or to an organization. AWS provides sample packs aligned to frameworks, and you can write your own. Use them to apply a standard set of checks everywhere and to report compliance for the whole pack.
Aggregation
An aggregator collects configuration and compliance data from several accounts and Regions into one place. An organization aggregator uses Organizations, so it covers all accounts including future ones, with a delegated administrator account holding it. Aggregation lets you view and query but does not change the member accounts.
# AWS CLI: create an organization aggregator
aws configservice put-configuration-aggregator \
--configuration-aggregator-name org-aggregator \
--organization-aggregation-source RoleArn=arn:aws:iam::222233334444:role/ConfigAggregatorRole,AllAwsRegions=trueAdvanced queries
Config advanced queries run SQL like statements over current configuration, across an aggregator if you use one. Use them to find resources by property, such as every instance with a public IP or every volume that is not encrypted.
# AWS CLI
aws configservice select-resource-config \
--expression "SELECT resourceId, resourceType WHERE resourceType = 'AWS::EC2::Instance'"Remediation
Each rule can have a remediation action that runs a Systems Manager Automation document on non compliant resources. Remediation can be manual or automatic.
Automatic remediation retries a set number of times, which avoids endless loops. The incident response chapter shows a full example.
Compliance over time
The resource timeline shows every change to a resource with the configuration at each point. Together with CloudTrail, it answers "who changed this and what was it before". Config can also send compliance change events to EventBridge for alerting.
Troubleshooting Config
| Symptom | Likely cause |
|---|---|
| Rule shows no resources or INSUFFICIENT_DATA | Recorder is off or the resource type is not recorded |
| No items delivered to S3 | Delivery channel bucket policy or role is wrong |
| Rule never re evaluates | Trigger type is periodic and the schedule has not run |
| Aggregator misses accounts | Authorisation not granted or organization integration not enabled |
| Remediation fails | The Automation role lacks permissions or parameters are wrong |
| Surprise cost | Recording all resource types in every Region, or frequent change recording |
Config, Security Hub and CloudTrail
These services are often confused.
| Service | Records or reports |
|---|---|
| CloudTrail | Who made which API call |
| Config | What the resource looked like and whether it complies |
| Security Hub | Aggregated findings and standard control status |
What to remember for the exam
- Config records configuration changes and evaluates compliance. It does not block actions.
- Rules can be AWS managed, custom with Guard, or custom with Lambda, and trigger on change or on a schedule.
- A conformance pack deploys a set of rules and remediations as a unit, including across an organization.
- An organization aggregator gives a central view across accounts and Regions, run from a delegated administrator.
- Advanced queries search current configuration with SQL like expressions.
- Remediation runs Systems Manager Automation documents, automatically or manually.
- The recorder must be on for rules and for Security Hub controls to work.
- Use Config for "what changed and is it compliant", and CloudTrail for "who did it".
For "check every account's S3 buckets for encryption and automatically fix violations", combine a conformance pack or rule with automatic remediation, and view results in an organization aggregator.
Common mistakes
Leaving the recorder off. Rules and Security Hub controls then show nothing useful.
Expecting Config to prevent a change. It reports after the fact, and SCPs or Hooks prevent.
Forgetting aggregator authorisation. Without it, member accounts are not collected.
Recording everything everywhere without need. This increases cost, so record the resource types you need.
Automatic remediation can modify production resources, so test it in a non production account and cap the number of attempts.
Check yourself
What is a conformance pack?
A packaged set of Config rules and remediation actions that you deploy as a single unit to an account or organization.
How do you view compliance across all accounts in an organization?
Create an organization aggregator in a delegated administrator account.
Which service tells you the previous configuration of a changed resource?
AWS Config, through its resource timeline.
Topic 5 of 6 in Security Foundations and Governance
Test yourself on Security Foundations and Governance
The full AWS SCS-C03 question bank has 858 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.