User modifies an AWS resource
Cloud / Knowledge library
AWS Config
Records resource configuration and evaluates it against managed or custom rules
Why learn AWS Config?
Teams use AWS Config to adopt cloud policy governance without building the complete underlying platform themselves.
The problem it solves
Evaluates and enforces organizational configuration rules across resources
Where it came from
AWS Config is Amazon Web Services's offering for cloud policy governance. Its closest catalog counterparts are Azure Policy and Google Cloud Organization Policy; they address the same broad need but are not feature-for-feature identical.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Explain the main responsibility of AWS Config.
- Choose a workload that fits AWS Config.
- Identify one operational tradeoff of AWS Config.
- Compare AWS Config with Azure Policy.
- Compare AWS Config with Google Cloud Organization Policy.
Documentation and sources
- AWS cloud services catalog (aws.amazon.com)
Connect the ideas
Alternatives
Real World Example
Automated Compliance for Financial Data Pipelines
A regional financial services firm managing sensitive customer data across multiple AWS accounts.
The business problem
Manual auditing of infrastructure changes leads to configuration drift, where unauthorized security group modifications or unencrypted storage volumes persist undetected, increasing the risk of data exposure.
How this topic solves it
AWS Config provides continuous monitoring and recording of resource configurations. By implementing managed rules, the firm can automatically evaluate resource states against security policies, triggering alerts or remediation actions the moment a non-compliant change occurs.
- Enable AWS Config in the target region to start recording resource configuration changes.
- Select and deploy managed rules that enforce encryption-at-rest for storage volumes.
- Configure an Amazon SNS topic to receive notifications whenever a resource is marked as non-compliant.
- Review the resource timeline in the AWS Config console to identify the specific IAM user who initiated the non-compliant change.
This diagram illustrates the flow from resource modification to compliance notification.
Captures the configuration state
Evaluates compliance against policy
Alerts the security team
- Resource Change → triggers recording → AWS Config Recorder
- AWS Config Recorder → evaluates state → Managed Rule
- Managed Rule → sends alert if non-compliant → SNS Notification
Expected business outcome
The firm achieves a continuous compliance posture where security teams receive near real-time visibility into configuration drift, allowing for rapid remediation without manual periodic audits.
Limitations and checks
AWS Config incurs costs based on the number of configuration items recorded and the number of rule evaluations performed; to check this, monitor the monthly billing dashboard for Config-specific line items.