AWS Config

Another crucial component of auditing our cloud infrastructure is tracking and logging any changes in the configurations of the deployed resources on our cloud infrastructure. AWS Config is a service that can monitor and log any AWS resource-related configuration changes over a period of time.

Introduction to AWS Config

AWS Config is an AWS service that allows us to monitor, log, evaluate, and remediate any AWS resource-related configuration changes over a period of time. It’s an essential tool to help with auditing and validating compliance of our AWS resources with industry rules and regulations.

Unlike AWS CloudTrail, AWS Config is a per-region service. However, we can still aggregate Config results across all regions and even across AWS accounts within an organization account. With AWS Config, we can track the compliance, configuration, and CloudTrail API calls of supported AWS resources over time.

We can also set up SNS notifications for critical configuration changes using AWS EventBridge or AWS Lambda. AWS Config logs are usually recorded within S3 buckets that can be queried and analyzed using AWS Athena.

Key concepts

Here’s a list of key AWS Config concepts that we need to know:

Recording configuration changes

The following are the most important concepts related to recording configuration changes that we need to be aware of:

• Configuration recorder: The configuration recorder refers to AWS Config’s component for continuously detecting and recording any AWS resource configurations within our AWS account. We can also specify what resource types we want to monitor for more customized monitoring.

• Configuration items: A configuration item (CI) refers to the configuration of an AWS resource at a specific moment. Every time a resource’s configuration changes, a new configuration item is created detailing that change. Configuration items include the ...