AWS Config

Concept

AWS Config regularly records the settings (configuration) of your AWS resources. So you can later see what a resource was like before and what changed when. With Config rules you can set rules, and Config checks whether each resource follows them (compliant). When a rule is broken, it is flagged, and if you want you can also set up automatic fixing. CloudTrail tells you who changed something, and Config tells you what changed.

Simple example

Taking a photo of every room in the house every day, while an inspector compares them to see whether any rule has been broken.

Why it’s needed

If someone changes something by mistake across many resources (for example, makes something private public), it needs to be caught.

Where it’s used

Checking rules like “all S3 buckets must stay private”, seeing what a resource was like before.

Azure equivalent

Azure Policy + Azure Resource Graph

Remember

Config = a history of resource settings plus a rules inspector.

Learn more

For details and the latest information, see the official documentation:

• AWS Config — AWS official documentation ↗