AWS Config
AWS Config. Is AWS’s managed service for resource inventory, configuration history, and continuous compliance evaluation.
Blurb
AWS Config is a config tool that helps you assess, audit, and evaluate the configurations and relationships of your resources.
Summary
Garden stance: We assess AWS Config for our estate.
Overview: We assess it under Tool for estates that already run AWS.
Detail 1: It fits native rules, conformance packs, and multi-account aggregators without Cloud Custodian.
Detail 2: Prefer Cloud Custodian or Policy as Code when you need one policy language across clouds.
Details
| Topic | Notes |
|---|---|
| Rules | Managed rules, custom rules, conformance packs (bundled rules + remediation) |
| Aggregation | Central compliance view across accounts and Regions |
| Remediation | Manual or automatic; SSM documents or custom Lambda |
| Notifications | SNS on non-compliance and configuration changes |
Practices: Start with detective rules (notify, dashboard) before auto-remediate. Scope recording to resource types you need. Use aggregators so security teams see compliance without console access to every account.
References