As part of my cloud learning journey, I recently explored AWS Config, a powerful AWS service that helps with configuration tracking, change management, and compliance auditing across AWS resources. AWS Config is especially important for environments where security, governance, and compliance are critical.

In this blog, I’ll share my understanding of AWS Config, how it works, and why it plays a key role in cloud security and operations.

☁️ What is AWS Config?

AWS Config is a configuration management service that continuously records the configuration of AWS resources and tracks changes over time. It allows you to assess, audit, and evaluate resource configurations against desired rules and best practices.

With AWS Config, you can answer questions like:

• What resources exist in my AWS account?

• How have configurations changed over time?

• Are my resources compliant with security standards?

🌟 Why Use AWS Config?

AWS Config provides several key benefits:

• Continuous monitoring of AWS resource configurations

• Configuration history for auditing and troubleshooting

• Compliance evaluation using rules

• Change tracking for security and governance

• Integration with security and monitoring services

AWS Config is widely used by security teams, cloud engineers, and SREs.

🧩 Core Components of AWS Config

🔹 Configuration Recorder

The configuration recorder captures changes to supported AWS resources and stores configuration data.

🔹 Configuration Items

Configuration items represent the state of a resource at a point in time, including metadata, relationships, and settings.

🔹 Config Rules

Config Rules evaluate resource configurations against desired settings. Rules can be:

• AWS-managed rules

• Custom rules (using AWS Lambda)

🔄 How AWS Config Works

1. AWS Config records the configuration of supported resources

2. Any change to a resource is captured

3. Config Rules evaluate the resource against compliance requirements

4. Compliance status is reported as compliant or non-compliant

5. Results can trigger alerts or remediation actions

📏 AWS Config Rules

🔹 AWS-Managed Rules

Predefined rules provided by AWS, such as:

• S3 buckets should not be publicly accessible

• EC2 instances should use approved instance types

🔹 Custom Rules

Custom rules use AWS Lambda to define compliance logic tailored to specific requirements.

🔐 Security and Compliance

AWS Config supports compliance frameworks such as:

• CIS benchmarks

• SOC

• PCI-DSS

It integrates with:

• AWS CloudTrail for API activity

• Amazon SNS for notifications

• AWS Security Hub for centralized security findings

📊 AWS Config vs CloudTrail

Both services complement each other.

AWS Config

we'll use AWS Config to detect compliant and non-compliant ec2 instances for below rule.

• compliant ec2 instance has monitoring enabled

• non-compliant ec2 instance does not have monitoring enabled

Step 1: Set Up AWS Config

Log in to your AWS Management Console.

Navigate to the AWS Config service.

Click on "Get started" if you're using AWS Config for the first time.

Configure the delivery channel settings, which include specifying an Amazon S3 bucket where AWS Config will store configuration history.

Choose the resource types you want AWS Config to monitor. In this case, select "Amazon EC2 Instances."

Step 2: Create a Custom Config Rule

Navigate to the AWS Config console.

In the left navigation pane, click on "Rules."

Click on the "Add rule" button.

Choose "Create a custom rule."

Give your rule a name and description (e.g., "Monitoring for EC2 Instances").

For "Scope of changes," choose "Resources."

Define the rule trigger. You can use AWS Lambda as the trigger source. If you haven't already created a Lambda function for this rule, create one that checks whether monitoring is enabled for an EC2 instance. The Lambda function will return whether the resource is compliant or not based on monitoring status.

Step 3: Define the Custom Rule in AWS Config

Choose your Lambda function from the dropdown list as the evaluator for the rule.

Specify the trigger type (e.g., "Configuration changes").

Save the rule.

Step 4: Monitor and Alert

AWS Config will now continuously evaluate your EC2 instances against the rule you've created.

If any EC2 instance is found without monitoring enabled, the custom rule's Lambda function will mark it as non-compliant.

AWS Config

import boto3
import json

def lambda_handler(event, context):

    # Get the specific EC2 instance.
    ec2_client = boto3.client('ec2')

    # Assume compliant by default
    compliance_status = "COMPLIANT"  

    # Extract the configuration item from the invokingEvent
    config = json.loads(event['invokingEvent'])

    configuration_item = config["configurationItem"]

    # Extract the instanceId
    instance_id = configuration_item['configuration']['instanceId']

    # Get complete Instance details
    instance = ec2_client.describe_instances(InstanceIds=[instance_id])['Reservations'][0]['Instances'][0]

    # Check if the specific EC2 instance has Cloud Trail logging enabled.

    if not instance['Monitoring']['State'] == "enabled":
        compliance_status = "NON_COMPLIANT"

    evaluation = {
        'ComplianceResourceType': 'AWS::EC2::Instance',
        'ComplianceResourceId': instance_id,
        'ComplianceType': compliance_status,
        'Annotation': 'Detailed monitoring is not enabled.',
        'OrderingTimestamp': config['notificationCreationTime']
    }

    config_client = boto3.client('config')

    response = config_client.put_evaluations(
        Evaluations=[evaluation],
        ResultToken=event['resultToken']
    )  

    return response