AWS Config
Configuration recording and evaluation
Records the configuration history of AWS resources and continuously evaluates them against Config rules (managed or custom-written with Lambda/Guard), with optional automatic remediation via SSM Automation.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?No
- Serverless
- In examsCLF · SAA · SOA · DVA
Think of it asLike a camera that photographs a room every time something is moved and compares it against the rules.
When to use it
✓ Use it when
You need to audit configuration changes and check compliance continuously.
✗ Avoid it when
Need to know who called which API → CloudTrail.
Common uses
- Detect security groups opening port 22 to the Internet
- See how an S3 bucket's configuration has changed
- Conformance packs for compliance standards
What does it cost?
- Pricing model: Charged by the number of configuration items recorded and rule evaluations.
Constantly changing resources (e.g., Auto Scaling, ENIs) generate many configuration items — consider periodic recording.
When the question asks for resource configuration history, continuous compliance checking and auto-remediation, choose AWS Config; for "who called this API", CloudTrail; to prevent noncompliant resources from being created at all, use SCPs or IAM, not Config.
Frequently asked questions
How is AWS Config different from CloudTrail?
CloudTrail records who called which API and when (the "who did it" question). Config records the configuration state of resources over time and checks it against rules (the "what is the configuration now, what was it before, is it compliant" question). The two are often used together when investigating changes.
How do Config rules work, and can they prevent bad configurations?
Config rules (managed, or custom with Lambda or Guard) evaluate resources when configuration changes or on a schedule and mark them COMPLIANT or NON_COMPLIANT. Config only detects and does not block creation of noncompliant resources; for automatic fixes, attach a remediation action that uses SSM Automation.
How do I view compliance across many accounts and Regions?
Use a Config aggregator to collect configuration and compliance data from many accounts and Regions into one account for central viewing. A conformance pack bundles several rules and remediations into one package you can deploy across an organization. Cost mainly grows with the number of configuration items recorded and rule evaluations.
Related services
SAA-C03 study guide
Config is covered in these study modules: