AWS Config

Records how your resources are configured over time and checks them against rules.

Think of it as: A building inspector with a notebook and a camera.

What to know for Level 0

Config records each resource's configuration, and every change to it, over time.
Config rules mark resources compliant or noncompliant and keep the history as audit evidence. Config reports problems; it doesn't block them. Control Tower's detective controls are Config rules.
Config tells you what changed and when; CloudTrail tells you who made the call.
Config records per Region, so it must be turned on in every Region you use (Control Tower does this). An aggregator collects results from every account and Region into one view.

More detail

Config keeps a history of each resource’s settings (“this bucket became public at 14:02”) and evaluates Config rules against them, marking resources compliant or noncompliant. It reports problems; on its own it doesn’t prevent them. Compare CloudTrail, which records who made the API call, while Config records what the resource looks like now.

Quiz yourself on AWS Config →

← All terms