AWS Config is a fully managed service that provides AWS resource inventory, configuration history, and configuration change notifications to enable security, compliance, and governance.
provides a detailed view of the configuration of AWS resources in the AWS account.
is a regional service.
is strictly a detective service and does not prevent changes but it integrates with other AWS services for remediation.
gives point-in-time and historical states thereby allowing users to see changes visually in a timeline.
will only record the latest configuration of that resource only, in cases where several configuration changes are made to a resource in quick succession (i.e., within a span of a few minutes); this represents the cumulative impact of that entire set of changes.
does not cover all the AWS services and for the services unsupported the configuration management process can be automated using API and code and used to compare current and past data.
provides customizable, predefined rules as well as the ability to define custom rules.
can help with the following:
Evaluate the AWS resource configurations for desired settings.
Get a snapshot of the current configurations of the supported resources that are associated with your AWS account.
Retrieve configurations of one or more resources that exist in the account.
Retrieve historical configurations of one or more resources.
Receive a notification whenever a resource is created, modified, or deleted.
View relationships between resources e.g., you might want to find all resources that use a particular security group.
AWS Config Use Cases
Security Analysis & Resource Administration
enables continuous monitoring and governance over resource configurations and helps evaluate them for any misconfigurations leading to security gaps or weaknesses.
Auditing & Compliance
helps maintain a complete inventory of all resources and their configurations attributes as well as point in time history
helps retrieve historical configurations that can be very useful to ensure compliance and audits with internal policies and best practices
Change Management
helps understand relationships between resources so that the impact of the change can be proactively assessed.
can be configured to notify whenever resources are created, modified, or deleted without having to monitor these changes by polling the calls made to each resource
Troubleshooting
helps to quickly identify and troubleshoot issues, by being able to use the historical configurations and compare the last working configuration to the one recent change causing issues.
Discovery
helps discover resources that exist within an account leading to better inventory and asset management.
Get a snapshot of the current configurations of the supported resources that are associated with the AWS account
AWS Config Concepts
AWS Resources
AWS Resources are entities created and managed for e.g. EC2 instances, Security groups
Resource Relationship
AWS Config discovers AWS resources in the account and then creates a map of relationships between AWS resources for e.g. EBS volume linked to an EC2 instance
Configuration Items
A configuration item represents a point-in-time view of the supported AWS resource
Components of a configuration item include metadata, attributes, relationships, current configuration, and related events.
Configuration Snapshot
A configuration snapshot is a collection of the configuration items for the supported resources that exist in the account.
Configuration History
A configuration history is a collection of the configuration items for a given resource over any time period.
Configuration Stream
Configuration stream is an automatically updated list of all configuration items for the resources that AWS Config is recording.
Configuration Recorder
Configuration recorder stores the configurations of the supported resources in your account as configuration items.
A configuration recorder needs to be created and started for recording and by default records, all supported services in the region.
AWS Config Rules
AWS Config Rules help define desired configuration settings for specific resources or for the entire account.
AWS Config continuously tracks the resource configuration changes against the rules and if violated marks the resource as non-compliant.
can be triggered either periodically or on configuration changes.
AWS Config Flow
When AWS Config is turned on, it discovers the supported resources that exist in the account and generates a configuration item for each resource.
By default, AWS Config creates configuration items for every supported resource in the region but can be customized to limited resource types.
AWS Config
generates configuration items when the configuration of a resource changes, and it maintains historical records of the configuration items of the resources from the time the configuration recorder is started.
keeps track of all changes to the resources by invoking the Describe or the List API call for each resource as well as related resources in the account.
also tracks the configuration changes that were not initiated by the API. It examines the resource configurations periodically and generates configuration items for the configurations that have changed.
Configuration items are delivered in a configuration stream to an S3 bucket.
AWS Config rules, if configured,
are evaluated continuously for resource configurations for desired settings.
resources are evaluated either in response to configuration changes or periodically, depending on the rule.
when the resources are evaluated, it invokes the rule’s AWS Lambda function, which contains the evaluation logic for the rule.
The function returns the compliance status of the evaluated resources.
If a resource violates the conditions of a rule, the resource and the rule are flagged as non-compliant and a notification is sent to the SNS topic.
AWS Config Remediation
AWS Config is strictly a detective service and does not prevent changes but it integrates with other AWS services for remediation.
allows remediation of noncompliant resources that are evaluated by config rules.
Remediation is applied using Systems Manager Automation documents, which define the actions to be performed on noncompliant AWS resources.
provides a set of managed automation documents with remediation actions.
Custom automation documents can also be created and associated with rules.
Multi-Account Multi-Region Data Aggregation
An aggregator helps collect AWS Config configuration and compliance data from the following:
Multiple accounts and multiple regions.
Single account and multiple regions.
An organization in AWS Organizations and all the accounts in that organization that has AWS Config enabled.
AWS Config reports on WHAT has changed, whereas CloudTrail reports on WHO made the change, WHEN, and from WHICH location.
AWS Config focuses on the configuration of the AWS resources and reports with detailed snapshots on HOW the resources have changed, whereas CloudTrail focuses on the events or API calls, that drive those changes. It focuses on the user, application, and activity performed on the system.
AWS Certification Exam Practice Questions
Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
Open to further feedback, discussion and correction.
Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
Open to further feedback, discussion and correction.
One of the challenges in managing AWS resources is to keep track of changes in the resource configuration over time. Which one of the following statements provide the best solution?
Use strict syntax tagging on the resources
Create a custom application to automate the configuration management process
Use AWS Config for supported services and use an automated process via APIs for unsupported services
Use resource groups and tagging along with CloudTrail so that you can audit changes using the logs
Fill the blanks: ____ helps us track AWS API calls and transitions, ____ helps to understand what resources we have now, and ____ allows auditing credentials and logins.
