Amazon Config FAQs

The quickest way to get started with AWS Config is to use the AWS Management Console. You can turn on AWS Config in a few selections. For additional details, see the Getting Started documentation.

You can look up current and historical resource configuration using the AWS Management Console, AWS Command Line Interface or SDKs.

For additional details, refer to AWS Config documentation .

You turn on AWS Config on a per-Region basis for your account.

Yes, you can set up AWS Config to deliver configuration updates from different accounts to one Amazon Simple Storage Service (S3) bucket, once the appropriate IAM policies are applied to the Amazon S3 bucket. You can also publish notifications to the one SNS Topic, within the same Region, once appropriate IAM policies are applied to the SNS Topic.

Yes. All AWS Config API activity, including use of AWS Config API operations to read configuration data, is logged by CloudTrail.

AWS Config displays the time at which Configuration Items (CIs) were recorded for a resource on a timeline. All times are captured in Coordinated Universal Time (UTC). When the timeline is visualized on the management console, the service uses the current time zone (adjusted for daylight savings, if relevant) to display all times in the timeline view.

A Configuration Item (CI) is the configuration of a resource at a given point-in-time. A CI consists of five sections:

Basic information about the resource that is common across different resource types (such as Amazon Resource Names, tags),

Configuration data specific to the resource (such as EC2 instance type),

Map of relationships with other resources (such as EC2::Volume vol-3434df43 is “attached to instance” EC2 Instance i-3432ee3a),

CloudTrail event IDs that are related to this state (only for AWS resources)

Metadata that helps you identify information about the CI, such as the version of this CI, and when this CI was captured.

Learn more about configuration items.

A custom Configuration Item (CI) is the CI for a third-party or custom resource. Examples include on-premises databases, Active Directory servers, version control systems like GitHub and third-party monitoring tools such as Datadog.

AWS Config takes the relationships among resources into account when recording changes. For example, if a new EC2 Security Group is associated with an EC2 Instance, AWS Config records the updated configurations of both the primary resource, the EC2 Security Group, and related resources, if these resources changed.

AWS Config detects change to a resource's configuration and records the configuration state that resulted from that change. In cases where several configuration changes are made to a resource in quick succession, AWS Config will record only the latest configuration of that resource that represents the cumulative impact of the set of changes. In these situations, AWS Config will list only the latest change in the relatedEvents field of the Configuration Item. This helps users and programs to continue to change infrastructure configurations without having to wait for AWS Config to record intermediate transient states.

Periodic recording allows you to decide how often to record changes in your environment, reducing configuration items from resources which change frequently. Instead of receiving updates continuously, you may be able to use periodic recording to receive configuration changes every 24 hours to meet your use cases. 

Periodic recording gives you the option to decide how often to receive updates on your resource configurations. When enabled, AWS Config will only deliver the latest configuration of a resource at the end of a 24-hour period if it has changed, reducing the frequency of configuration data and making the cost of gathering this data more predictable for use cases such as operational planning and audit. If your security and compliance needs require ongoing monitoring of your resources, then continuous recording should be used.

Yes, AWS Config will regularly scan the configuration of resources for changes that haven’t yet been recorded and record these changes. CIs recorded from these scans will not have a relatedEvent field in the message, and only the latest state that is different from state already recorded is selected.

Yes. AWS Config helps you record configuration changes to software within EC2 instances in your AWS account and also virtual machines (VMs) or servers in your on-premises environment. The configuration information recorded by AWS Config includes Operating System updates, network configuration, and installed applications. You can evaluate whether your instances, VMs, and servers are in compliance with your guidelines using AWS Config rules. The deep visibility and continuous monitoring capabilities provided by AWS Config help you assess compliance and troubleshoot operational issues.

AWS Config sends notifications only when the compliance status changes. If a resource was previously non-compliant and is still non-compliant, AWS Config will not send a new notification. If the compliance status changes to “compliant,” you will receive a notification for the change in status.

Yes, you can exclude resources by navigating to the AWS Config 'recorder settings' page in the console and selecting the 'Exclude Resource Types' option and specifying the desired exclusions. Alternatively, you can utilize the PutConfigurationRecorder API to access this feature. This API will disable the configuration recording for that resource type. Also, when you configure AWS Config rules, you can specify whether your rule runs evaluations against specified resource types or resources with a specific tag.

Configuration of a resource is defined by the data included in the Configuration Item (CI) of AWS Config. The initial release of AWS Config rules makes the CI for a resource available to relevant rules. AWS Config rules can use this information along with any other relevant information such as other attached resources and business hours to evaluate compliance of a resource’s configuration.

A rule represents desired Configuration Item (CI) attribute values for resources and is evaluated by comparing those attribute values with CIs recorded by AWS Config. There are two types of rules:

AWS–managed rules: AWS–managed rules are pre-built and managed by AWS. You can choose the rule you want to enable, then supply a few configuration parameters to get started. Learn more »

Customer managed rules: Customer managed rules are custom rules, defined, and built by you. You can create a function on AWS Lambda that can be invoked as part of a custom rule and these functions apply in your account. Learn more »

The quickest way to get started with AWS Config is to use the AWS Management Console. You can turn on AWS Config in a few selections. For additional details, see the Getting Started documentation.

Rules are typically set up by the AWS account administrator. They can be created by leveraging AWS–managed rules (a predefined set of rules provided by AWS) or through customer managed rules. With AWS–managed rules, updates to the rule are automatically applied to any account using that rule. In the customer-managed model, customers have a full copy of the rule and apply the rule within their own account. These rules are maintained by the customers.

You can create up to 150 rules in your AWS account by default. Additionally, you can request an increase for the limit on the number of rules in your account by visiting the AWS Service Limits page.

Any rule can be set up as a change-triggered rule or as a periodic rule. A change-triggered rule is applied when AWS Config records a configuration change for any of the resources specified. Additionally, one of the following must be specified:

Tag Key:(optional Value): A tag key:value implies any configuration changes recorded for resources with the specified tag key:value will initiate an evaluation of the rule.

Resource type(s): Any configuration changes recorded for any resource within the specified resource type(s) will initiate an evaluation of the rule.

Resource ID: Any changes recorded to the resource specified by the resource type and resource ID will initiate an evaluation of the rule.

A periodic rule is initiated at a specified frequency. Available frequencies are 1 hr, 3 hr, 6 hr, 12 hr, or 24 hrs. A periodic rule has a full snapshot of current Configuration Items (CIs) for all resources available to the rule.

Evaluation of a rule determines whether a rule is compliant with a resource at a particular point in time. It is the result of evaluating a rule against the configuration of a resource. AWS Config rules will capture and store the result of each evaluation. This result will include the resource, rule, time of evaluation, and a link to the Configuration Item (CI) that caused non-compliance.

A resource is compliant if it observes all rules that apply to it; otherwise it is noncompliant. Similarly, a rule is compliant if all resources evaluated by the rule comply with the rule; otherwise it is noncompliant. In some cases, such as when inadequate permissions are available to the rule, an evaluation cannot exist for the resource, leading to a state of insufficient data. This state is excluded from determining the compliance status of a resource or rule.

The AWS Config rules dashboard gives you an overview of resources tracked by AWS Config, and a summary of current compliance by resource and by rule. When you view compliance by resource, you can determine if any rule that applies to the resource is currently not compliant. You can view compliance by rule, which tells you if any resource under the purview of the rule is currently non-compliant. Using these summary views, you can explore further the AWS Config timeline view of resources, to determine which configuration parameters changed. Using this dashboard, you can start with an overview and drill into fine-grained views that give you full information about changes in compliance status, and which changes caused non-compliance.

You can use individual AWS Config rules to evaluate resource configuration compliance in one or more accounts. Conformance packs provide the additional benefit of packaging rules along with remediation actions into a single entity that can be deployed across an entire organization with a single selection. Conformance packs are intended to simplify compliance management and reporting at scale when you are managing several accounts. Conformance packs are designed to provide aggregated compliance reporting at the pack level and immutability. This helps the managed AWS Config rules and remediation documents within the conformance pack to not be modified or deleted by the individual member accounts of an organization.

AWS Security Hub is a security and compliance service that provides security and compliance posture management as a service. It uses AWS Config and AWS Config rules as its primary mechanism to evaluate the configuration of AWS resources. AWS Config rules can also be used to evaluate resource configuration directly. AWS Config rules are also used by other AWS services, such as AWS Control Tower and AWS Firewall Manager.

If a compliance standard, such as PCI DSS, is already present in Security Hub, then the fully managed Security Hub service is an easier way to operationalize it. You can investigate findings through Security Hub’s integration with Amazon Detective, and you can build automated or semiautomated remediation actions using the Security Hub integration with Amazon EventBridge. However, if you want to assemble your own compliance or security standard, which can include security, operational, or cost optimization checks, AWS Config conformance packs are the way to go. AWS Config conformance packs simplify management of AWS Config rules by packaging a group of AWS Config rules and associated remediation actions into a single entity. This packaging simplifies deployment of rules and remediation actions across an organization. It also enables aggregated reporting, as compliance summaries can be reported at the pack level. You can start with the AWS Config conformance pack samples we provide and customize as you see fit.

Yes, both Security Hub and AWS Config conformance packs support continuous compliance monitoring, given their reliance on AWS Config and AWS Config rules. The underlying AWS Config rules can be triggered either periodically or upon detecting changes to the configuration of resources. This helps you continuously audit and assess the overall compliance of your AWS resource configurations with your organization’s policies and guidelines.

The quickest way to get started is by creating a conformance pack using one of our sample templates through the CLI or the AWS Config console. Some of the sample templates include S3 Operational Best Practices, Amazon DynamoDB Operational Best Practices, and Operational Best Practices for PCI. These templates are written in YAML. You can download these templates from our documentation site and modify them to suit your environment using your favorite text editor. You can even add custom AWS Config rules that you could have previously written into the pack.

Conformance packs will be charged using a tiered pricing model. For more details, visit the AWS Config Pricing page .

Data aggregation on AWS Config helps you aggregate AWS Config data from multiple accounts and Regions into a single account and a single Region. Multi-account data aggregation is useful for central IT administrators to monitor compliance for multiple AWS accounts in the enterprise.

The data aggregation capability cannot be used for provisioning rules across multiple accounts. It is purely a reporting capability that provides visibility into your compliance. You can use AWS CloudFormation StackSets to provision rules across accounts and Regions. Learn more in this blog link .

Once AWS Config and AWS Config rules are enabled in your account, and the accounts being aggregated, you can enable data aggregation by creating an aggregator in your account. Learn more .

An aggregator is an AWS Config resource type that collects AWS Config data from multiple accounts and Regions. Use an aggregator to view the resource configuration and compliance data recorded on AWS Config for multiple accounts and Regions.

The aggregated view displays the total count of non-compliant rules across the organization, the top five non-compliant rules by number of resources, and the top five AWS accounts that have the highest number of non-compliant rules. You can then drill down to view more details about the resources that are violating the rule and the list of rules that are being violated by an account.

You can specify the accounts to aggregate the AWS Config data from by uploading a file or by individually entering accounts. Note that since these accounts are not part of any AWS organization, you will need each account to explicitly authorize the aggregator account. Learn more .

The data aggregation capability is useful for multi-Region aggregation as well. Thus, you can aggregate the AWS Config data for your account across multiple Regions using this capability.

For details on the Regions where multi-account, multi-Region data aggregation is available, visit the AWS Config Developer Guide: Multi-Account Multi-Region Data Aggregation .

When you create an aggregator, you specify the Regions from where you can aggregate data. This list shows only Regions where this feature is available. You can also select “all Regions,” in which case as soon as support is added in other Regions, it will automatically aggregate the data.

Review our documentation for a complete list of supported resource types.

For more information about the AWS Regions where AWS Config is available, see the AWS Region table.

With AWS Config, you are charged based on the number of configuration items recorded, the number of active AWS Config rule evaluations, and the number of conformance pack evaluations in your account. A configuration item is a record of the configuration state of a resource in your AWS account. There are two frequencies at which AWS Config can deliver configuration items: continuous and periodic. Continuous recording records and delivers configuration changes whenever a change occurs. Periodic recording delivers configuration data once every 24 hours, only if a change has occurred. An AWS Config rule evaluation is a compliance state evaluation of a resource by an AWS Config rule in your AWS account. A conformance pack evaluation is the evaluation of a resource by an AWS Config rule within the conformance pack. For more detail and examples, visit https://aws.amazon.com/config/pricing/ .

You can choose from a set of managed rules provided by AWS or you can author your own rules, written as Lambda functions. Managed rules are fully maintained by AWS and you do not pay any additional Lambda charges to run them. You can enable managed rules, provide any required parameters, and pay a single rate for each active AWS Config rule in a given month. Custom rules give you full control as they are applied as Lambda functions in your account. In addition to monthly charges for an active rule, standard Lambda free tier * and function application rates apply to custom AWS Config rules.

*AWS Free Tier is not available in the AWS China (Beijing) Region or the AWS China (Ningxia) Region.

Charges are incurred whenever a new rule is created and it becomes active. If you must update or replace the Lambda function associated with a rule, the recommended approach is to update the rule instead of deleting it and creating a new rule.

APN Partner solutions such as Splunk, ServiceNow, Evident.io, CloudCheckr, Redseal, and Red Hat CloudForms provide offerings that are fully integrated with data from AWS Config. Managed service providers, such as 2nd Watch and Cloudnexa have also announced integrations with AWS Config. Additionally, with AWS Config Rules, partners such as CloudHealth Technologies, Alert Logic, and Trend Micro are providing integrated offerings that can be used. These solutions include capabilities such as change management and security analysis and help you visualize, monitor, and manage AWS resource configurations.