3.2.2.4. AWS Config Rules

3.2.2.4. AWS Config Rules

AWS Config continuously evaluates resource configurations against rules. It doesn't just monitor — it maintains a complete configuration history of every resource change.

How Config works:

1. Config records configuration changes to supported resources
2. Each change triggers evaluation against applicable Config rules
3. Non-compliant resources are flagged
4. Optional: automatic remediation via SSM Automation

Config rule types:

Commonly tested Config rules:

• restricted-ssh: Security groups don't allow unrestricted SSH (0.0.0.0/0:22)
• cloud-trail-enabled: CloudTrail is active in the region
• rds-multi-az-support: RDS instances have Multi-AZ enabled
• iam-root-access-key-check: Root account has no access keys

Config aggregator collects compliance data across multiple accounts and regions — essential for organizational security dashboards.

# Deploy a managed Config rule
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "encrypted-ebs-volumes",
  "Source": {
    "Owner": "AWS",
    "SourceIdentifier": "ENCRYPTED_VOLUMES"
  },
  "Scope": {
    "ComplianceResourceTypes": ["AWS::EC2::Volume"]
  }
}'

Exam Trap: Config records resource configuration changes — not API calls (that's CloudTrail). Config answers "what is the current state of my resources?" CloudTrail answers "who changed what and when?" For compliance auditing, you typically need both: CloudTrail for the audit trail and Config for current state assessment.