2.1.4. Automated Assessments and Investigations

First Principle: Continuous automated assessment ensures your security posture doesn't degrade over time — catching configuration drift, non-compliant resources, and emerging vulnerabilities without waiting for a manual audit.

AWS Config provides continuous configuration assessment:

• Config Rules evaluate resource configurations against desired baselines (e.g., s3-bucket-server-side-encryption-enabled). Change-triggered rules evaluate within minutes of a recorded configuration change; periodic rules run on a fixed frequency (1, 3, 6, 12, or 24 hours)
• Conformance Packs deploy collections of related Config Rules as a single unit (e.g., PCI DSS pack, CIS Benchmark pack)
• Remediation Actions automatically fix non-compliant resources using SSM Automation documents
• Aggregators provide cross-account, cross-Region compliance dashboards

Systems Manager State Manager ensures instances maintain desired configuration:

• Applies configuration documents on a schedule (e.g., ensure antivirus is installed and running)
• Reports compliance status to a central dashboard
• Works alongside Config for a complete compliance picture

Security Hub Standards provide automated benchmarking:

• AWS Foundational Security Best Practices — AWS-recommended controls
• CIS AWS Foundations Benchmark — Center for Internet Security standards
• PCI DSS — Payment card industry standards
• NIST SP 800-53 Rev. 5 — U.S. federal security and privacy controls
• Standards run automated checks and produce a security score — the percentage of enabled controls that passed — which the delegated administrator sees aggregated across member accounts. Filter findings by severity label (Critical down to Informational) to fix the worst first. Security Hub itself doesn't remediate — route findings through EventBridge for that

Amazon Inspector provides continuous vulnerability assessment:

• Scans EC2 instances, ECR container images, and Lambda functions. A new or updated Lambda function is scanned automatically when it is deployed, and resources are rescanned whenever new CVEs are published — there is no scan schedule to manage
• Network reachability findings (EC2) show that a path from the internet exists through the internet gateway, route tables, NACLs and security groups. They are computed from configuration — evidence of exposure, not of active traffic or compromise

⚠️ Exam Trap: Config Rules evaluate configuration compliance (is this S3 bucket encrypted?). Inspector evaluates vulnerability status (does this EC2 instance have CVE-2024-1234?). They're complementary but distinct.

Scenario: A compliance team needs to ensure all EC2 instances across 50 accounts are running approved AMIs and have the latest patches. You deploy a Config conformance pack with approved-amis-by-id and ec2-managedinstance-patch-compliance-status-check rules, with auto-remediation using SSM Patch Manager.

Reflection Question: How does the combination of Config rules, conformance packs, and auto-remediation create a "self-healing" security posture?