AWS Config and Observability Tools

Configuration history and compliance

AWS Config records supported resource configuration changes as configuration items and evaluates Config Rules. A rule marks resources compliant or noncompliant; it does not block the API call. Remediation can run afterward through Systems Manager Automation documents, manually or automatically.

flowchart LR
  CH["Change<br/>SG opens port 22"] --> REC["Config recorder<br/>configuration item"]
  REC --> RULE["Config rule<br/>restricted-ssh"]
  RULE -- "NON_COMPLIANT" --> REM["Remediation<br/>SSM Automation"]
  REC --> HIS["Timeline<br/>who, what, when"]
  CT["CloudTrail<br/>AuthorizeSecurityGroupIngress"] -.-> HIS
  %% step CH: Someone changes a resource, here a Security Group rule.
  %% step REC: The recorder captures the new configuration and its relationships.
  %% step RULE: Rules evaluate the change, either on every change or on a schedule.
  %% step REM: A noncompliant resource can trigger an automatic fix, such as removing the rule.
  %% step HIS: Config keeps a timeline of each resource's configuration.
  %% step CT: CloudTrail events are linked, so you can see which API call by which principal caused the change.

Config in practice

Config is regional: enable the recorder in each Region you use, with delivery to an S3 bucket (and optionally SNS). Recording must be enabled and delivery configured for useful history. An aggregator collects data from many accounts and Regions into one view, and conformance packs bundle rules and remediations, for example for CIS benchmarks.

Rules come as AWS managed rules (hundreds, such as s3-bucket-public-read-prohibited, encrypted-volumes, restricted-ssh) or custom rules written in Lambda or Guard. You pay per configuration item recorded and per rule evaluation, so record only the resource types you need in large accounts.

Which service answers which question

Choose by question: CloudWatch — metrics, logs, and alarms; CloudTrail — who called which API; Config — what configuration changed and whether it complies.

One incident, three services

For a Security Group opening SSH to 0.0.0.0/0:

1. Config flags the SG as noncompliant with restricted-ssh, shows the before-and-after configuration, and can auto-remediate.
2. CloudTrail identifies the actor calling AuthorizeSecurityGroupIngress, their IP and time.
3. EventBridge (or a CloudWatch alarm on a metric filter) drives the alert workflow, for example a message to the on-call channel.

Preventive versus detective

Config is a detective control: it finds problems after they happen. Preventive controls stop them up front: IAM policies, SCPs, and CloudFormation Guard or policy checks in the pipeline. Good setups use both.

Traps: expecting Config rules to block changes; enabling Config in one Region and assuming full coverage; using Config to find out who made a change without CloudTrail.