AWS Config Rules

Definition

AWS Config continuously records configuration changes to AWS resources and evaluates them against Config rules — managed or custom checks that mark resources COMPLIANT or NON_COMPLIANT. Rules run on configuration changes and on a periodic schedule. Conformance packs bundle dozens of rules aligned to CIS, PCI DSS, HIPAA, or NIST. Config tells you what drifted; pair it with CloudTrail to learn who changed it and with Systems Manager Automation or custom remediation for how you fix it.

When to use it

• Continuous compliance monitoring instead of quarterly manual config reviews.
• Detective controls for encryption (S3, EBS, RDS), public exposure (SG rules, S3 ACLs), logging (CloudTrail, VPC Flow Logs), and tagging standards.
• Organization-wide aggregation via AWS Config Aggregator across accounts and regions.
• Conformance pack deployment as a baseline for a new account or landing zone OU.
• Custom rules (Lambda-backed) for org-specific policies — e.g., required cost-center tags or approved instance types.

When not to use it

• Real-time blocking of API calls — Config detects after the fact; use SCPs, IAM, or service control policies for preventive denial.
• Automatic remediation without testing — a remediation action that opens a security group or deletes a resource can cause outages.
• Every possible rule on day one — hundreds of NON_COMPLIANT resources with no owner creates alert fatigue and ignored dashboards.

Tips

• Start with 10–15 high-impact managed rules (encryption, public access, CloudTrail enabled) before expanding.
• Route NON_COMPLIANT notifications through EventBridge → SNS/Slack/Jira with severity tiers — not every drift is P1.
• Use Config Aggregator in the security/compliance account for a single pane across the org.
• Document exceptions with Config rule exclusions scoped by resource ID or tag — blanket disables defeat the purpose.
• Combine Config findings with Security Hub for a unified compliance scorecard alongside GuardDuty and Inspector.

Gotchas

Serious

• Auto-remediation in production without a dry run — Config can modify live resources; test in a sandbox account first.
• Config not enabled in all regions — resources in opt-in regions you forgot about stay invisible to rules.
• Assuming COMPLIANT means secure — rules check configuration snapshots, not runtime behavior or application vulnerabilities.

Regular

• Custom rule Lambda timeouts — complex evaluations fail silently or flap compliance state; keep evaluators fast and idempotent.
• Ignoring periodic trigger delays — some drift is caught only on the periodic schedule, not instantly on change.
• Duplicate rules across accounts without aggregator — each account team sees a slice, not the org picture.

Official references

• What is AWS Config?
• AWS Config managed rules
• Conformance packs
• Remediation actions

Related FactualMinds content

• AWS Security Hub and compliance monitoring setup
• Continuous compliance automation with Config and Audit Manager
• Cloud Compliance Services
• AWS Cloud Security Services