AWS for DevOps — AWS Config

11.4 — AWS Config

AWS Config continuously monitors and records your AWS resource configurations. It answers: “What does my infrastructure look like right now, and how has it changed over time?”

Real-World Analogy

AWS Config is like a building inspector who visits every day. They photograph every room, note every change, and flag anything that violates the building code. If someone removes a fire extinguisher (deletes an important security rule), the inspector reports it immediately.

How AWS Config Works

  ┌───────────────────────────────────────────────┐
  │                AWS Account                     │
  │                                                │
  │  EC2 ──┐                                       │
  │  S3  ──┼──→ AWS Config ──→ Configuration       │
  │  IAM ──┤      │            History (S3)        │
  │  RDS ──┤      │                                │
  │  VPC ──┘      ├──→ Config Rules ──→ Compliant? │
  │               │                    Non-compliant│
  │               └──→ SNS Notification            │
  └───────────────────────────────────────────────┘

Setting Up AWS Config

# Create the S3 bucket for config recordings
$ aws s3 mb s3://my-config-recordings-123456

# Create the Config Recorder
$ aws configservice put-configuration-recorder \
    --configuration-recorder name=default,roleARN=arn:aws:iam::123456789012:role/ConfigRole \
    --recording-group allSupported=true,includeGlobalResourceTypes=true

# Create the delivery channel
$ aws configservice put-delivery-channel \
    --delivery-channel name=default,s3BucketName=my-config-recordings-123456

# Start recording
$ aws configservice start-configuration-recorder --configuration-recorder-name default

Config Rules

Config rules evaluate whether your resources comply with your desired configuration:

# Add a managed rule: S3 buckets must have versioning enabled
$ aws configservice put-config-rule \
    --config-rule '{
      "ConfigRuleName": "s3-bucket-versioning-enabled",
      "Source": {
        "Owner": "AWS",
        "SourceIdentifier": "S3_BUCKET_VERSIONING_ENABLED"
      },
      "Scope": {
        "ComplianceResourceTypes": ["AWS::S3::Bucket"]
      }
    }'

# Add a rule: EC2 instances must be in a VPC
$ aws configservice put-config-rule \
    --config-rule '{
      "ConfigRuleName": "ec2-instances-in-vpc",
      "Source": {
        "Owner": "AWS",
        "SourceIdentifier": "INSTANCES_IN_VPC"
      }
    }'

Essential Config Rules for DevOps

Rule	What It Checks
s3-bucket-versioning-enabled	S3 buckets have versioning on
s3-bucket-public-read-prohibited	No public S3 buckets
encrypted-volumes	EBS volumes are encrypted
iam-root-access-key-check	Root account has no access keys
iam-user-mfa-enabled	IAM users have MFA enabled
restricted-ssh	Security groups don’t allow 0.0.0.0/0 on port 22
rds-instance-public-access-check	RDS instances are not publicly accessible
cloudtrail-enabled	CloudTrail is enabled

Checking Compliance

# Get compliance summary
$ aws configservice get-compliance-summary-by-config-rule
{
    "ComplianceSummary": {
        "CompliantResourceCount": {"CappedCount": 42, "CapExceeded": false},
        "NonCompliantResourceCount": {"CappedCount": 3, "CapExceeded": false}
    }
}

# Get details for non-compliant resources
$ aws configservice get-compliance-details-by-config-rule \
    --config-rule-name s3-bucket-public-read-prohibited \
    --compliance-types NON_COMPLIANT

Configuration Timeline

View how a resource’s configuration changed over time:

# Get configuration history for an S3 bucket
$ aws configservice get-resource-config-history \
    --resource-type AWS::S3::Bucket \
    --resource-id my-production-bucket \
    --limit 5

Remediation

Auto-remediate non-compliant resources:

# Auto-enable S3 versioning on non-compliant buckets
$ aws configservice put-remediation-configurations \
    --remediation-configurations '[{
      "ConfigRuleName": "s3-bucket-versioning-enabled",
      "TargetType": "SSM_DOCUMENT",
      "TargetId": "AWS-ConfigureS3BucketVersioning",
      "Parameters": {
        "BucketName": {
          "ResourceValue": {"Value": "RESOURCE_ID"}
        },
        "VersioningState": {
          "StaticValue": {"Values": ["Enabled"]}
        }
      },
      "Automatic": true,
      "MaximumAutomaticAttempts": 3,
      "RetryAttemptSeconds": 60
    }]'

Common Mistakes

Mistake	Why It Hurts	Fix
Not enabling Config	No visibility into configuration changes	Enable in all regions
Too many rules at once	Alert fatigue	Start with 5-10 critical rules
No remediation	Non-compliance persists	Add auto-remediation for critical rules
Ignoring global resources	Miss IAM changes	Set includeGlobalResourceTypes=true

Quick Reference

Task	Command
Start recording	aws configservice start-configuration-recorder --configuration-recorder-name default
Add rule	aws configservice put-config-rule --config-rule '...'
Check compliance	aws configservice get-compliance-summary-by-config-rule
Get non-compliant resources	aws configservice get-compliance-details-by-config-rule --config-rule-name RULE --compliance-types NON_COMPLIANT
Get resource history	aws configservice get-resource-config-history --resource-type TYPE --resource-id ID

---

Next → SSM Run Command