AWS Config

What AWS Config is

AWS Config tracks and evaluates the configurations of AWS resources, giving teams a way to review changes and assess configurations against policies. It records configuration history for inspection through the console, API, or CLI, and can also cover third-party resources such as on-premises servers, SaaS monitoring tools, and version control systems. Teams can apply prebuilt rules or create rules using AWS Lambda. Conformance packs group rules and remediation actions for deployment and compliance reporting across an organization. Aggregators centralize resource metadata and rule compliance across accounts and Regions, while advanced queries use a subset of SQL SELECT syntax to search current configuration state. AWS Config integrates with services including Organizations, CloudTrail, Security Hub CSPM, Audit Manager, Systems Manager, Firewall Manager, EC2 Dedicated Hosts, and Application Load Balancers. Its Service Management Connector supports resource tracking through ServiceNow and Jira Service Desk. Charges are usage-based, based on recorded configuration items and rule and conformance-pack evaluations; S3, SNS, and Lambda costs may also apply. Config reports compliance status but does not ensure resources stay compliant or prevent noncompliant changes.