AWS Config

What it is

AWS Config gives you a detailed view of how your AWS resources are configured, how they relate to each other, and how their configurations have changed over time. It can also evaluate those configurations against rules that describe how they should be configured, and remediate resources that don't comply.

Choose Config when a question asks to track configuration changes, see what a resource looked like at a point in time, audit compliance with rules (for example "all EBS volumes must be encrypted" or "no Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry may allow SSH (Secure Shell)A protocol for secure remote logins and commands over an encrypted connection, usually on TCP port 22. Session Manager in AWS Systems Manager gives shell access to instances without opening that port.Glossary entry from 0.0.0.0/0"), or fix noncompliant resources automatically.

Recording configurations

The configuration recorder records changes to the resource types in scope as configuration items: point-in-time records of a resource's attributes, relationships, and related events.
Configuration history shows every change to a resource over time; a configuration snapshot captures all recorded resources at once. Config delivers both to an S3 bucket, and can send change notifications to an SNS topic.
Config is Regional: turn on recording in each AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry you use (and for global resources such as IAM where needed).

Rules

A Config rule represents your desired configuration and marks each resource compliant or noncompliant.
Managed rules are predefined and customizable, such as encrypted-volumes, s3-bucket-public-read-prohibited, or restricted-ssh.
Custom rules can be written in Guard (policy as code) or as Lambda functions.
Trigger types:
- Configuration changes: evaluate when a matching resource changes.
- Periodic: evaluate on a schedule, such as every 24 hours.
- Some rules use both.
Evaluation modes: detective rules evaluate resources that already exist. Proactive evaluation checks resources before they are deployed, for some rules.
Remediation: associate a Systems Manager Automation document with a rule to fix noncompliant resources, manually or automatically. AWS provides managed remediation documents, and you can write your own.
Conformance packs: a collection of rules and remediation actions, written as a YAML template, deployed as one unit to an account and Region or across an organization. AWS provides sample packs for common frameworks.

Multi-account view

An aggregator collects configuration and compliance data from multiple accounts and Regions, or from all accounts in an AWS Organizations organization, into one account and Region.
Organization rules and conformance packs deploy rules across member accounts.

Security, resilience, performance, and cost

Security

Config shows what changed; CloudTrail shows who made the change. Use both together, for example by looking up the CloudTrail events for a resource whose configuration changed.
Restrict access to the S3 bucket and SNS topic that Config uses, and protect Config from being turned off, for example with SCP (Service control policy)An AWS Organizations policy that sets the maximum permissions for IAM users and roles in member accounts. It grants nothing by itself, and it does not apply to the management account.Glossary entry.

Resilience

Use the configuration history to see what changed before an incident, and roll back by restoring the previous settings.

Cost

Pay per configuration item recorded, per active rule evaluation, and per conformance pack evaluation.
Record only the resource types you need, and choose daily recording instead of continuous recording for resources that change often, to control cost.

Monitoring

Compliance results appear on the Config dashboard and can be sent to AWS Security Hub. Use EventBridge to react to compliance changes.

Config, CloudTrail, or CloudWatch?

Question asks for	Choose
How a resource was configured last month, and its change history	AWS Config
Whether resources comply with our configuration rules	AWS Config rules
Fix noncompliant resources automatically	Config remediation with Systems Manager Automation
One compliance view across all accounts	Config aggregator
Who made the API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry call that changed it	AWS CloudTrail
Performance metrics and alarms	Amazon CloudWatch

Reverse mindmap: when the question points here

Is it AWS Config?

Yes, when the question says
- Track configuration changes to resources leads to Config
- What did this security group look like last week leads to Configuration history
- Audit that all volumes are encrypted leads to Config managed rule
- Prove continuous compliance to auditors leads to Config rules and conformance packs
Choose the feature
- Check on every change leads to Configuration change trigger
- Check on a schedule leads to Periodic trigger
- Our own logic leads to Custom rule with Guard or Lambda
- Block bad resources before deployment leads to Proactive evaluation
- Fix noncompliant resources automatically leads to Remediation with SSM Automation
- Deploy many rules at once leads to Conformance pack
- Compliance across all accounts and Regions leads to Aggregator
No, when the question says
- Who made the change leads to CloudTrail
- CPU alarm leads to CloudWatch

Key takeaways

Config records resource configurations and relationships over time as configuration items, with history and snapshots delivered to S3.
Config rules (managed, or custom with Guard or Lambda) mark resources compliant or noncompliant, triggered by changes or on a schedule.
Remediation uses Systems Manager Automation documents; conformance packs bundle rules; aggregators give a multi-account view.
Config is Regional; it pairs with CloudTrail, which shows who made each change.
Pricing is per configuration item recorded and per rule evaluation.