Config

AWS Config – Monitor and Manage AWS Resources

AWS Config is an AWS service that helps you record, monitor, and evaluate the configuration of AWS resources.

It helps you understand how your AWS resources are configured and whether they follow your organization's rules.

What is AWS Config?

AWS Config continuously monitors the configuration of supported AWS resources.

For example, if you have an EC2 instance, AWS Config can record information such as its configuration and changes made to it.

It can also help identify whether resources comply with specific rules.

How AWS Config Works

A simple flow is:

AWS Resource → AWS Config → Configuration Record → Rules → Compliance Status

For example:

S3 Bucket → AWS Config checks configuration → Is encryption enabled? → Compliant / Non-compliant

What Can AWS Config Do?

1. Record Resource Configuration

AWS Config can record configuration information about AWS resources.

2. Track Changes

It helps you see how the configuration of a resource changes over time.

3. Check Compliance

AWS Config Rules can check whether resources meet specific requirements.

For example:

«“All S3 buckets must have encryption enabled.”»

If a bucket doesn't meet the rule, AWS Config can mark it as non-compliant.

4. Troubleshooting

Configuration history can help you understand what changed when an AWS resource starts behaving unexpectedly.

AWS Config Rules

Config Rules are conditions used to evaluate AWS resources.

Examples:

- Check whether S3 buckets are encrypted.
- Check whether EC2 instances use approved configurations.
- Check whether security groups allow unrestricted access.
- Check whether resources follow organizational policies.

The result can be:

✅ Compliant

or

❌ Non-compliant

AWS Config vs CloudTrail

These two services are often confused.

Service| Main Purpose
AWS Config| Checks resource configuration and compliance
AWS CloudTrail| Records API activity and user actions

Easy way to remember:

CloudTrail → Who did what?

Config → What is the resource configuration?

Real-World Example

Imagine a company has 100 S3 buckets.

The company wants all buckets to use encryption.

Instead of checking every bucket manually, it can use AWS Config Rules to evaluate the buckets and identify resources that don't meet the requirement.

Benefits of AWS Config

- Configuration monitoring
- Compliance checking
- Configuration history
- Security and governance
- Troubleshooting
- Automated evaluation of resources

Conclusion

AWS Config helps organizations understand, monitor, and control the configuration of their AWS resources.

For cloud learners, remember:

AWS Config = “Is my AWS resource configured correctly and following my rules?”