Understanding AWS Config Compliance Audits

Introduction

AWS Config is a service that continuously records the configuration state of your AWS resources and evaluates them against desired-state rules. While CloudTrail records API actions (who did what), Config records resource state (what the configuration looks like right now, and what it looked like before). This makes Config essential for compliance auditing — you can answer questions like “Was this S3 bucket publicly accessible last Tuesday?” or “Which EC2 instances are running without IMDSv2 enforced?” and automatically remediate violations.

Step-by-Step: How Config Works

flowchart TD
    A["1. Configuration Recorder"]
    B["2. Configuration Items (CI)"]
    C["3. Config Rules"]
    D["4. Custom Rules with Lambda"]
    E["5. Auto-Remediation with SSM Automation"]
    A --> B
    B --> C
    C --> D
    D --> E

Step 1: Configuration Recorder

Enable the Config recorder for the resources you want to track:

# Enable Config for all supported resource types
aws configservice put-configuration-recorder   --configuration-recorder name=default,roleARN=arn:aws:iam::123456789:role/config-role   --recording-group allSupported=true,includeGlobalResourceTypes=true

# Start recording
aws configservice start-configuration-recorder --configuration-recorder-name default

Step 2: Configuration Items (CI)

Every time a resource changes, Config creates a Configuration Item (CI) — a point-in-time snapshot:

{
  "configurationItemCaptureTime": "2024-03-15T14:23:11Z",
  "resourceType": "AWS::S3::Bucket",
  "resourceId": "my-prod-bucket",
  "configuration": {
    "publicAccessBlockConfiguration": {
      "blockPublicAcls": false,       ← Was this changed?
      "blockPublicPolicy": true,
      "ignorePublicAcls": true,
      "restrictPublicBuckets": false
    },
    "serverSideEncryptionConfiguration": null  ← Not encrypted!
  }
}

Step 3: Config Rules

Rules evaluate resources against compliance requirements. AWS provides 150+ managed rules:

# Enable managed rule: S3 buckets must have public access blocked
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "s3-bucket-public-read-prohibited",
  "Source": {
    "Owner": "AWS",
    "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"
  }
}'

# Common managed rules:
# s3-bucket-public-read-prohibited
# ec2-imdsv2-check
# encrypted-volumes
# iam-root-access-key-check
# restricted-ssh
# rds-storage-encrypted

Step 4: Custom Rules with Lambda

# Custom rule: All EC2 instances must have a "CostCenter" tag
import boto3, json

def lambda_handler(event, context):
    config = boto3.client('config')
    invoking_event = json.loads(event['invokingEvent'])
    configuration_item = invoking_event['configurationItem']
    
    # Check for required tag
    tags = configuration_item.get('tags', {})
    is_compliant = 'CostCenter' in tags
    
    config.put_evaluations(
        Evaluations=[{
            'ComplianceResourceType': configuration_item['resourceType'],
            'ComplianceResourceId': configuration_item['resourceId'],
            'ComplianceType': 'COMPLIANT' if is_compliant else 'NON_COMPLIANT',
            'Annotation': 'Missing required CostCenter tag' if not is_compliant else 'OK',
            'OrderingTimestamp': configuration_item['configurationItemCaptureTime']
        }],
        ResultToken=event['resultToken']
    )

Step 5: Auto-Remediation with SSM Automation

# Auto-remediate non-compliant resources
aws configservice put-remediation-configurations   --remediation-configurations '[{
    "ConfigRuleName": "s3-bucket-public-read-prohibited",
    "TargetType": "SSM_DOCUMENT",
    "TargetId": "AWS-DisableS3BucketPublicReadWrite",
    "Automatic": true,
    "MaximumAutomaticAttempts": 3,
    "RetryAttemptSeconds": 60
  }]'

Key Takeaways

• AWS Config tracks resource configuration state (what it looks like), while CloudTrail tracks API actions (what changed it) — use both for complete auditability.
• Configuration Items are timestamped snapshots enabling “what did this resource look like on date X?” historical queries.
• AWS Managed Rules cover OWASP and CIS benchmark requirements — deploy them via AWS Security Hub for consolidated compliance dashboards.
• Custom Lambda rules allow evaluation of any business logic (tagging policies, naming conventions, approved AMI lists).
• Auto-remediation via SSM Automation documents closes the loop — Config detects, evaluates, and remediates without human intervention.