AWS Config: The Security Camera That Never Stops Recording Change
A complete, beginner-friendly guide to AWS Config — what it is, how it continuously tracks every configuration change in your account, and how it helps you catch problems before they become disasters.
Imagine a museum with priceless paintings on every wall. Overnight, a security camera silently records every single change — a painting moved slightly, a new frame added, a light fixture removed. The next morning, the curator doesn’t have to guess what happened; they can rewind the footage and see exactly what changed, when it changed, and who was near it. AWS Config is that security camera for your entire AWS account. It continuously watches your resources, records every configuration change, and lets you rewind time to understand exactly what your infrastructure looked like at any given moment.
1What Is AWS Config?
Let’s start with a clear, simple definition before exploring the details.
The Simple Definition
AWS Config is a service that continuously monitors and records the configuration of your AWS resources, allowing you to see how they have changed over time, evaluate them against rules you define, and answer detailed questions about your account’s history.
Think of AWS Config as a very detailed diary kept by a meticulous assistant. Every time something changes in your AWS environment — a security group rule gets added, a storage bucket setting flips, an instance type changes — the assistant writes down exactly what happened, when it happened, and what the resource looked like immediately before and after.
Configuration Item: The Core Building Block
Every time AWS Config detects a change to a supported resource, it creates a “configuration item” — a detailed snapshot capturing that resource’s attributes, relationships, and metadata at that exact moment in time.
AWS Config does not prevent changes from happening — it observes, records, and evaluates them. Preventing unwanted changes typically involves pairing Config with other tools like IAM permissions or Service Control Policies.
2The Problem That AWS Config Solves
To appreciate why AWS Config exists, consider how quickly cloud environments change and how easy it is to lose track.
Cloud Environments Change Constantly
In a growing organization, dozens of engineers might be creating, modifying, and deleting resources every single day. Without a systematic way to track these changes, it becomes nearly impossible to answer simple but important questions like “who opened this security group to the public?” or “what did this server look like last Tuesday?”
Compliance and Governance Challenges
Many organizations must follow strict rules — for example, “all storage buckets must be encrypted” or “no security group should allow unrestricted access.” Manually checking every resource against every rule, across potentially thousands of resources, is impractical without automation.
Answering “What Changed and When?”
Config maintains a detailed history, making it possible to pinpoint exactly when a specific configuration change occurred and what the resource looked like before and after.
Continuous Compliance Checking
Config can automatically evaluate resources against defined rules on an ongoing basis, flagging non-compliant resources as soon as they appear.
Troubleshooting and Root Cause Analysis
When something breaks unexpectedly, Config’s change history often reveals the exact configuration change that caused the issue.
3Core Concepts You Must Know
These foundational terms will come up throughout the rest of this guide.
Configuration Item
A point-in-time snapshot of a single resource’s attributes, relationships, and metadata.
Configuration History
The complete timeline of configuration items for a resource, showing exactly how it changed over time.
Config Rule
A defined condition that resources are automatically evaluated against, determining whether they are compliant or non-compliant.
Configuration Recorder
The component that actively detects and records changes to supported resource types in your account.
Delivery Channel
Defines where recorded configuration data and history are sent, typically an Amazon S3 bucket.
Aggregator
A component that collects configuration and compliance data from multiple accounts and regions into a single view.
A configuration item is like one single photograph in a photo album — capturing exactly what something looked like at one moment. The configuration history is the entire photo album, letting you flip through and see how that thing changed over time.
4Architecture and Components
Let’s look at the building blocks that work together inside AWS Config.
The Configuration Recorder
The configuration recorder is the engine of AWS Config. Once enabled, it continuously detects changes to the resource types you’ve chosen to track, and generates a configuration item each time a relevant change occurs.
The Delivery Channel
Recorded configuration data, along with periodic snapshots and history files, is delivered to a specified Amazon S3 bucket, providing a durable, long-term archive of your account’s configuration history. Notifications about changes can also be delivered through Amazon SNS.
Config Rules
Config Rules define the specific conditions a resource must meet to be considered compliant. AWS provides many managed rules ready to use (like checking whether S3 buckets are publicly accessible), and you can also create custom rules using AWS Lambda for organization-specific requirements.
graph TD
A[AWS Resources] -->|Changes Detected| B[Configuration Recorder]
B --> C[Configuration Items]
C --> D[Delivery Channel]
D --> E[(Amazon S3 - History Archive)]
C --> F[Config Rules Engine]
F --> G[Compliance Status: Compliant / Non-Compliant]
Conformance Packs
A conformance pack bundles multiple related Config Rules together as a single package, making it easier to deploy a comprehensive set of compliance checks — for example, a common security baseline — consistently across accounts.
Managed Rules
Pre-built rules provided by AWS covering common compliance and security checks.
Custom Rules
Rules you define yourself, typically using AWS Lambda, for organization-specific requirements.
Aggregator
Combines configuration and compliance data across multiple accounts and regions into one unified view.
Remediation Action
An optional automated response, such as an AWS Systems Manager Automation document, triggered when a resource is found non-compliant.
5Internal Working: How Config Actually Tracks Change
Here is what happens, step by step, from the moment someone modifies a resource.
A Resource Changes
Someone (or some automated process) modifies a tracked resource — for example, updating a security group rule.
Configuration Recorder Detects the Change
AWS Config’s recorder detects that the resource’s state has changed since the last recorded configuration item.
A New Configuration Item Is Created
A detailed snapshot of the resource’s new state, along with metadata about what triggered the change, is generated and stored.
Relevant Rules Are Evaluated
Any Config Rules associated with that resource type are automatically re-evaluated against the new configuration.
Compliance Status Is Updated
The resource’s compliance status is updated accordingly, and optional notifications or remediation actions can be triggered.
sequenceDiagram
participant Engineer as Engineer
participant Resource as AWS Resource
participant Config as AWS Config
participant Rules as Config Rules
Engineer->>Resource: Modify configuration
Resource->>Config: Change detected
Config->>Config: Create new configuration item
Config->>Rules: Re-evaluate compliance
Rules-->>Config: Compliant or Non-Compliant
6Compliance and Rules in Depth
Rules are where AWS Config moves from passive recording to active governance.
How a Rule Evaluates a Resource
A Config Rule contains logic that examines a resource’s configuration and determines whether it meets a specific condition — for example, “does this EBS volume have encryption enabled?” Resources that meet the condition are marked compliant; those that don’t are marked non-compliant.
Periodic vs Change-Triggered Evaluation
Some rules evaluate resources whenever a relevant change occurs (change-triggered), while others run on a fixed schedule regardless of whether anything changed (periodic), which is useful for checks that depend on external factors, like whether a certificate is approaching expiration.
| Rule Type | Description | Example |
|---|---|---|
| Managed Rule | Pre-built by AWS, ready to enable with minimal setup | Checking that S3 buckets are not publicly readable |
| Custom Rule (Lambda) | Custom logic written by you to evaluate organization-specific conditions | Checking that resources have a required internal cost-tracking tag |
| Conformance Pack | A bundle of related rules deployed together as one package | A full security baseline applied consistently across accounts |
Start with a handful of AWS Managed Rules covering common security basics — like checking for public S3 buckets and open security groups — before investing time in writing custom rules.
7Automated Remediation
Detecting a problem is valuable, but automatically fixing it can be even more powerful.
What Remediation Means
Remediation is the process of automatically correcting a non-compliant resource, rather than simply flagging it and waiting for a human to act. AWS Config can trigger a remediation action, often an AWS Systems Manager Automation document, when a rule finds a resource out of compliance.
Manual vs Automatic Remediation
Remediation can be configured to happen automatically as soon as non-compliance is detected, or to require manual approval, giving teams flexibility depending on how risky or disruptive a given automated fix might be.
Automatically Closing Open Security Groups
A remediation action can automatically remove an overly permissive inbound rule the moment a security group is found allowing unrestricted public access.
Automatically Enabling Encryption
A remediation action can enable default encryption on a storage resource found to be unencrypted, bringing it back into compliance without manual intervention.
Automatic remediation is powerful but risky if misconfigured — an overly aggressive automatic fix could unintentionally disrupt a legitimate, intentional configuration. Careful testing and, where appropriate, manual approval steps are recommended.
8Multi-Account and Multi-Region Visibility
Large organizations rarely operate in just one AWS account or region — Config scales to match.
The Aggregator Component
An aggregator collects configuration and compliance data from multiple source accounts and regions into a single, unified account, giving governance and security teams one central place to review the entire organization’s compliance posture.
graph TD
A[Account 1 - Region A] --> D[Config Aggregator]
B[Account 2 - Region A] --> D
C[Account 1 - Region B] --> D
D --> E[Unified Compliance Dashboard]
Organization-Wide Rules
For organizations using AWS Organizations, Config Rules and conformance packs can be deployed consistently across every member account, ensuring the same governance standards apply organization-wide without manually configuring each account separately.
Advantages
- Centralized visibility across many accounts and regions
- Consistent governance standards applied organization-wide
- Easier to spot outlier accounts that fall out of compliance
Disadvantages / Trade-offs
- Requires proper setup of trust relationships between accounts
- Recording many resource types across many accounts increases cost
9Security
Because Config records detailed information about your entire environment, protecting that data matters greatly.
Protecting the Configuration History
Since configuration history is stored in an S3 bucket, applying strict bucket policies, encryption, and access logging to that bucket is essential to prevent unauthorized access to potentially sensitive infrastructure details.
IAM Permissions for Config Itself
Only trusted administrators and automation roles should have permission to modify Config Rules, disable the configuration recorder, or alter the delivery channel, since tampering with these settings could blind an organization to important changes.
S3 Bucket Protection
Encrypts and restricts access to the bucket storing your configuration history.
IAM Least Privilege
Limits who can modify or disable Config’s recording and rule evaluation settings.
CloudTrail Integration
Logs administrative actions taken against Config itself, creating an audit trail of changes to your governance tooling.
Leaving the configuration recorder disabled after a temporary troubleshooting exercise, unintentionally creating a long-term gap in your account’s change history.
10Best Practices and Common Mistakes
Practical guidance for getting real value out of AWS Config.
Best Practices
- Enable AWS Config across all accounts and regions you actively use
- Start with a small set of well-known managed rules before writing custom ones
- Use aggregators to maintain a single, organization-wide compliance view
- Protect the S3 bucket storing configuration history with strict access controls
- Review non-compliant resources regularly rather than letting alerts pile up unreviewed
- Test automated remediation carefully before enabling it broadly
Common Mistakes
- Enabling Config but never actually reviewing compliance results
- Recording every possible resource type without considering cost implications
- Leaving the recorder disabled after temporary troubleshooting
- Enabling aggressive automatic remediation without adequate testing
Treat non-compliant findings as an ongoing to-do list, not just a dashboard to glance at occasionally. The real value of Config comes from consistently acting on what it finds.
11Real-World and Industry Examples
Configuration tracking and compliance automation play a quiet but important role across many industries.
Financial Services Compliance
Banks and financial institutions use configuration tracking tools to demonstrate to regulators and auditors that infrastructure consistently meets required security and compliance standards over time.
Incident Investigation
When something breaks in production, engineering teams frequently rely on configuration history to quickly pinpoint exactly which change caused the issue, dramatically speeding up root cause analysis.
Security Posture Management
Security teams use continuous rule evaluation to catch newly created resources that don’t meet baseline security requirements, such as unencrypted storage or overly open network access.
Large Enterprise Governance
Enterprises running many AWS accounts across different business units use aggregated compliance dashboards to maintain consistent governance standards organization-wide.
Any organization that needs to prove, confidently and in detail, exactly how its systems were configured at any point in the past relies on tools very similar to AWS Config to make that possible.
12Frequently Asked Questions
No. Config observes, records, and evaluates changes, but does not block them by itself. Preventing changes typically requires pairing Config with tools like IAM permissions, Service Control Policies, or automated remediation actions.
A configuration item is a single snapshot of a resource at one point in time. Configuration history is the full timeline of all configuration items for that resource, showing exactly how it evolved.
Yes, through remediation actions, which can be configured to run automatically or require manual approval when a resource is found out of compliance with a rule.
Not necessarily. AWS provides many ready-to-use managed rules covering common compliance checks. Writing code, typically with AWS Lambda, is only needed for custom, organization-specific rules.
Through aggregators, Config can combine configuration and compliance data from multiple accounts and regions into a single, unified dashboard, making organization-wide governance far easier to manage.
No. CloudTrail records who performed which API action and when, while Config focuses on tracking the resulting configuration state of resources over time and evaluating that state against defined rules. They are often used together.
13Summary and Key Takeaways
AWS Config exists to answer a deceptively simple but critically important question: what does my infrastructure look like right now, and how did it get that way? By continuously recording configuration items, evaluating resources against defined rules, and optionally triggering automated remediation, Config transforms configuration management from a manual, error-prone guessing game into a continuous, automated, and auditable process. Understanding configuration items, rules, remediation, and multi-account aggregation gives beginners a strong foundation for building confident, well-governed AWS environments.
Key Takeaways
- AWS Config continuously records configuration changes to your resources, building a detailed historical timeline.
- Configuration items are point-in-time snapshots, and configuration history is the full timeline built from them.
- Config Rules automatically evaluate resources for compliance, using either AWS managed rules or custom Lambda-based logic.
- Remediation actions can automatically fix non-compliant resources, though they should be tested carefully before wide use.
- Aggregators provide a unified compliance view across multiple accounts and regions for large organizations.
- Config does not block changes itself — it observes and evaluates, working alongside preventive controls for full governance.
- Protecting the underlying S3 history and IAM permissions is essential, since this data reflects your entire infrastructure’s story.
