AWS Config

AWS Config continuously records the configuration of your AWS resources and evaluates them against rules you define. It answers two questions: "What does my infrastructure look like right now?" and "Has anything changed, and does it comply with my policies?"

Configuration as a Timeline

Every time a resource changes — a security group rule is added, an S3 bucket's public-access setting is modified, an EC2 instance type is changed — AWS Config records the new configuration alongside the previous one. This creates a timeline for every resource in your account. You can go back to any point in time and see exactly what a resource's configuration looked like.

This makes Config invaluable for security investigations. When you discover a breach or a misconfiguration, you can reconstruct exactly who changed what and when, even if the person who made the change deleted it afterward.

Compliance Rules

Config rules evaluate your resources against policies you define. AWS provides hundreds of managed rules — "all S3 buckets must have server-side encryption enabled", "all RDS instances must have multi-AZ enabled", "no security groups should allow unrestricted SSH access from the internet". You can also write custom rules using Lambda functions for policies specific to your organization.

When a resource violates a rule, Config marks it non-compliant and can trigger a notification via SNS or an automated remediation action via Systems Manager Automation.

Config vs CloudTrail

These two services are complementary and often confused. CloudTrail records API calls — who called what operation. Config records resource state — what does the resource look like. CloudTrail tells you "who ran this command"; Config tells you "what did the result look like, and does it comply with policy?"

A complete audit picture uses both: CloudTrail for the who and the action, Config for the before and after state and ongoing compliance assessment.

Conformance Packs

A conformance pack is a collection of Config rules and remediation actions packaged together to address a specific compliance standard — PCI-DSS, HIPAA, CIS Benchmarks. You deploy a conformance pack and immediately get a compliance dashboard showing how your AWS environment measures up against that standard.