AWS Config mindmap

AWS Config

Assess, audit and evaluate the configurations of your AWS resources and how they change over time

• Recording
  • Configuration recorder: Records all supported resource types or only the ones you choose
  • Recording frequency: Continuous, or daily
  • Configuration items: A point-in-time view of a resource: attributes, relationships and metadata
  • Configuration history: Every change to a resource over time
  • Relationships: How resources connect, for example an instance and its security groups
  • Delivery channel: Snapshots and history to Amazon S3; notifications through Amazon SNS
• Rules: Evaluate whether resources comply with the settings you want
  • AWS managed rules: Predefined rules, such as s3-bucket-public-read-prohibited
  • Custom rules: Written as Lambda functions or in Guard policy language
  • Triggers: When a configuration changes, or periodically
  • Proactive evaluation: Check resources before you deploy them
• Conformance packs: Rules and remediation actions deployed together, from sample templates for frameworks
• Remediation: Fix noncompliant resources with Systems Manager Automation documents, manually or automatically
• Multi-account and multi-Region
  • Aggregators: One view of configuration and compliance across accounts and Regions
  • Organization rules: Deploy rules and conformance packs to every account
• Querying
  • Advanced queries: SQL over current configuration state
• Integrations
  • AWS Security Hub: Security Hub CSPM controls rely on Config rules
  • AWS Audit Manager: Config rule results become audit evidence
  • AWS Control Tower: Detective controls are Config rules
• Pricing: Per configuration item recorded, per rule evaluation and per conformance pack evaluation