Start free
AWS Config
Cloud service · AWS · Updated

AWS Config

In short

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources, providing a detailed view of their compliance with the configurations specified by your internal guidelines and regulatory standards.

Cloud Services Hub →

9 key features of AWS Config

AWS Config offers automated configuration recording, continuous monitoring, compliance auditing, change management, security analysis, and integrates with other AWS services for comprehensive infrastructure management and monitoring.

01
Configuration Recording

AWS Config automatically records software and hardware configurations of your AWS resources, enabling you to assess, audit, and evaluate the configurations of your AWS resources.

02
Continuous Monitoring

It continuously monitors and records your AWS resource configurations, allowing for detection of deviations from desired configurations and enabling quick remediation.

03
Compliance Auditing

AWS Config supports compliance auditing by recording and assessing the configurations of your AWS resources against desired configurations, facilitating governance, and compliance.

04
Change Management

It provides a detailed view of the changes in your AWS environments, helping in change management by recording when and how configurations are altered.

05
Security Analysis

AWS Config improves security by enabling the analysis of configurations and relationships between AWS resources, identifying potential security weaknesses.

06
Integration with AWS Services

It seamlessly integrates with other AWS services, like CloudTrail for audit trails, enabling comprehensive infrastructure monitoring and management.

07
Conformance Packs

Conformance packs group AWS Config rules into a collection that can be deployed and monitored as a single entity in your AWS account.

08
Multi-Account, Multi-Region Aggregation

An aggregator collects AWS Config configuration and compliance data from multiple AWS accounts and Regions into a single account and Region, providing a centralized view of resource inventory and compliance.

09
Advanced Queries

AWS Config supports sample queries and custom queries written using the configuration schema of an AWS resource.

Where AWS Config is used

AWS Config is utilized for compliance monitoring, change management, security analysis, inventory and resource management, and disaster recovery planning, enabling organizations to maintain secure, optimized, and compliant cloud environments.

  1. 01
    Compliance Monitoring

    AWS Config allows organizations to continuously monitor and record their AWS resource configurations to ensure compliance with internal policies and external regulations. It can automatically evaluate the recorded configurations against desired guidelines, making it easier for companies to adhere to compliance standards such as HIPAA, PCI-DSS, and GDPR.

  2. 02
    Change Management

    With AWS Config, businesses can enhance change management processes by providing a detailed view of the historical changes across their AWS environment. This visibility helps in understanding the impact of changes, auditing changes against organization policies, and troubleshooting operational issues by pinpointing when and how configurations were altered.

  3. 03
    Security Analysis

    AWS Config aids in security analysis by detecting and evaluating changes in configurations that might lead to security weaknesses or vulnerabilities. By setting up rules to check for undesired configurations, such as overly permissive security groups or improperly configured S3 buckets, teams can proactively identify and remediate security risks.

  4. 04
    Inventory and Resource Management

    Leveraging AWS Config, organizations can maintain a complete inventory of their AWS resources and their current and historical configurations. This detailed inventory supports efficient resource management, optimization of costs, and ensuring resources are correctly deployed and utilized according to organizational needs and policies.

  5. 05
    Disaster Recovery Planning

    AWS Config plays a crucial role in disaster recovery planning by maintaining a configuration history of AWS resources, which can be critical in reconstructing the IT infrastructure after a disaster. This configuration history helps in quickly identifying the most recent and stable configurations to restore services to their last known good state.

How AWS Config is priced

AWS Config pricing is primarily based on the number of rule evaluations, configuration items recorded, and the specific AWS Config Rules applied to the user’s environment.

Rule Evaluations

AWS Config charges based on the number of evaluations performed. Prices are calculated per evaluation, with costs varying by region.

Configuration Items

Charges are incurred for each configuration item recorded in your AWS environment. This includes changes in configurations and relationships between resources, priced per number of configuration items recorded.

AWS Config Rules

Charges for custom and AWS managed rules are based on the number of rule evaluations performed. The cost varies depending on how frequently the rules are triggered and evaluated.

Conformance Pack Evaluations

AWS Config charges per conformance pack evaluation in each AWS account and Region using tiered pricing. An evaluation is the evaluation of a resource by an AWS Config rule within the conformance pack.

Services AWS Config works with

Amazon API GatewayAmazon API Gateway

AWS Config records supported API Gateway APIs and stages and evaluates settings such as access logging, encryption, authorization, and endpoint exposure.

Open Amazon API Gateway →
Amazon AppFlowAmazon AppFlow

AWS Config records AppFlow flow configurations so you can track changes and evaluate whether flows meet your configuration requirements.

Open Amazon AppFlow →
Amazon AthenaAmazon Athena

AWS Config records Athena workgroups and data catalogs and can check workgroup settings such as encryption. Athena can also query AWS Config configuration history delivered to Amazon S3.

Open Amazon Athena →
Amazon AuroraAmazon Aurora

AWS Config tracks Aurora DB cluster and instance configurations and evaluates requirements such as encryption, backup retention, deletion protection, and restricted public access.

Open Amazon Aurora →
Amazon Aurora ServerlessAmazon Aurora Serverless

AWS Config records the underlying Aurora DB cluster configuration for Aurora Serverless databases, allowing you to audit changes and evaluate applicable database compliance rules.

Open Amazon Aurora Serverless →
Amazon Bedrock

AWS Config records supported Bedrock resources, including agents, knowledge bases, and guardrails, so their configurations can be audited and evaluated for compliance.

Open Amazon Bedrock →
Amazon CloudFrontAmazon CloudFront

AWS Config tracks CloudFront distributions and supported configuration resources. Managed rules can evaluate requirements such as HTTPS enforcement, access logging, and association with AWS WAF.

Open Amazon CloudFront →
Amazon CloudWatchAmazon CloudWatch

AWS Config publishes operational metrics to CloudWatch and records supported CloudWatch resources such as alarms. CloudWatch Observability Admin also uses service-linked AWS Config recorders to discover and audit telemetry configurations.

Open Amazon CloudWatch →
Amazon CodeGuruAmazon CodeGuru

AWS Config records supported CodeGuru resources, including Reviewer repository associations and Profiler profiling groups, providing configuration history for auditing.

Open Amazon CodeGuru →
Amazon CognitoAmazon Cognito

AWS Config tracks supported Cognito user pool and identity pool resources. Config rules can evaluate requirements such as user pool password policies and multi-factor authentication.

Open Amazon Cognito →

What is AWS Config

3 min read

AWS Config is a fully managed service provided by Amazon Web Services (AWS) that enables you to assess, audit, and evaluate the configurations of your AWS resources. It is designed to help you manage your cloud resources more effectively by providing a detailed view of their configurations and how they change over time. AWS Config does this by continuously monitoring and recording your AWS resource configurations and allowing you to automate the evaluation of recorded configurations against desired configurations. 

Periodic recording is also available: it delivers configuration data once every 24 hours, only if a change has occurred, and can be useful for operational planning or audit.

You can specify which resource types AWS Config records.

With AWS Config, you can understand the detailed configuration history of your AWS resources, which can be instrumental in security analysis, change management, and compliance auditing. It tracks changes in the environment, such as creation, modification, and deletion of AWS resources, and captures these changes as configuration items. Each configuration item represents a point-in-time snapshot of the various attributes of a resource, which can include relationships with other AWS resources, current configuration settings, and other relevant metadata. 

AWS Config operates across your AWS environment, making it possible to get a unified view of your resources and their states across the AWS ecosystem. This broad visibility aids in identifying resources that are not compliant with your organization's policies or that deviate from best practices. For example, if a security group is configured in a way that exposes your resources to the internet, AWS Config can help identify this configuration for remediation. 

One of the powerful features of AWS Config is its ability to define rules that represent your ideal configuration states. These rules can be custom defined or selected from a set of AWS-managed rules that represent common compliance scenarios and best practices. AWS Config evaluates your resources against these rules and reports on compliance, making it easier to maintain security, governance, and regulatory compliance standards. 

AWS Config supports a maximum of 1,000 rules per account per Region; this quota cannot be increased.

Supported AWS Config rules can evaluate resource configurations before provisioning using proactive mode. Rules can be configured for proactive-only evaluation, detective-only evaluation, or both modes.

In addition to compliance monitoring, AWS Config facilitates change management by providing a detailed audit trail of configuration changes. This feature is particularly valuable in troubleshooting operational issues or understanding the impact of changes over time. By enabling a detailed view of how resources were configured at specific points in time, AWS Config aids in root cause analysis and helps improve operational efficiency. 

For organizations operating in environments that are subject to regulatory requirements, AWS Config simplifies compliance auditing. By providing a detailed record of the configuration of AWS resources and changes over time, it supports audits by demonstrating how resources were configured and how they complied with policies at different points in time. 

In conclusion, AWS Config is a powerful tool for organizations looking to improve their cloud management practices. By providing comprehensive visibility into resource configurations and changes, facilitating compliance and governance, and aiding in operational troubleshooting, AWS Config helps organizations manage their AWS environments more effectively, securely, and in compliance with their policies and regulatory standards.

Concepts related to AWS Config

AWS architecture icons are the property of Amazon Web Services. BlowStack is not affiliated with or endorsed by AWS.