AWS Config for compliance - Mini Project: Build & Apply

AWS Config for compliance

📖 Scenario: You are working as a cloud engineer for a company that needs to ensure its AWS resources comply with internal security policies. You will create an AWS Config setup to track compliance of EC2 instances and S3 buckets.

🎯 Goal: Build an AWS Config setup that records configuration changes for EC2 instances and S3 buckets, and creates a compliance rule to check if S3 buckets have versioning enabled.

📋 What You'll Learn

Create an AWS Config recorder that records EC2 instances and S3 buckets

Create an S3 bucket to store AWS Config logs

Create an AWS Config delivery channel to deliver configuration snapshots and notifications

Create an AWS Config managed rule to check S3 bucket versioning compliance

💡 Why This Matters

🌍 Real World

AWS Config helps organizations continuously monitor and record their AWS resource configurations to ensure compliance with security and operational policies.

💼 Career

Cloud engineers and security professionals use AWS Config to automate compliance auditing and improve cloud governance.

1

Create the AWS Config recorder

Create an AWS Config recorder named configRecorder that records the resource types AWS::EC2::Instance and AWS::S3::Bucket.

AWS

# Create AWS Config recorder named configRecorder
# Your code here

Hint

Remember to create an IAM role with a trust policy for AWS Config service and attach the AWS managed policy AWSConfigRole.

2

Create the S3 bucket for AWS Config logs

Create an S3 bucket named config-logs-bucket to store AWS Config logs. Enable versioning on this bucket.

AWS

resource "aws_config_configuration_recorder" "configRecorder" {
  name     = "configRecorder"
  role_arn = aws_iam_role.config_role.arn

  recording_group {
    all_supported = false
    resource_types = ["AWS::EC2::Instance", "AWS::S3::Bucket"]
  }
}

resource "aws_iam_role" "config_role" {
  name = "config_role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [{
      Action = "sts:AssumeRole",
      Effect = "Allow",
      Principal = {
        Service = "config.amazonaws.com"
      }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "config_role_attach" {
  role       = aws_iam_role.config_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole"
}

# Create S3 bucket named config-logs-bucket with versioning enabled
# Your code here

Hint

Enable versioning on the S3 bucket to keep track of changes to the logs.

3

Create the AWS Config delivery channel

Create an AWS Config delivery channel named configDeliveryChannel that delivers configuration snapshots and notifications to the S3 bucket config-logs-bucket.

AWS

resource "aws_config_configuration_recorder" "configRecorder" {
  name     = "configRecorder"
  role_arn = aws_iam_role.config_role.arn

  recording_group {
    all_supported = false
    resource_types = ["AWS::EC2::Instance", "AWS::S3::Bucket"]
  }
}

resource "aws_iam_role" "config_role" {
  name = "config_role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [{
      Action = "sts:AssumeRole",
      Effect = "Allow",
      Principal = {
        Service = "config.amazonaws.com"
      }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "config_role_attach" {
  role       = aws_iam_role.config_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole"
}

resource "aws_s3_bucket" "config_logs_bucket" {
  bucket = "config-logs-bucket"

  versioning {
    enabled = true
  }
}

# Create AWS Config delivery channel named configDeliveryChannel
# Your code here

Hint

The delivery channel sends configuration snapshots to the S3 bucket you created.

4

Create AWS Config rule for S3 bucket versioning compliance

Create an AWS Config managed rule named s3-bucket-versioning-enabled that checks if S3 buckets have versioning enabled.

AWS

resource "aws_config_configuration_recorder" "configRecorder" {
  name     = "configRecorder"
  role_arn = aws_iam_role.config_role.arn

  recording_group {
    all_supported = false
    resource_types = ["AWS::EC2::Instance", "AWS::S3::Bucket"]
  }
}

resource "aws_iam_role" "config_role" {
  name = "config_role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [{
      Action = "sts:AssumeRole",
      Effect = "Allow",
      Principal = {
        Service = "config.amazonaws.com"
      }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "config_role_attach" {
  role       = aws_iam_role.config_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole"
}

resource "aws_s3_bucket" "config_logs_bucket" {
  bucket = "config-logs-bucket"

  versioning {
    enabled = true
  }
}

resource "aws_config_delivery_channel" "configDeliveryChannel" {
  name           = "configDeliveryChannel"
  s3_bucket_name = aws_s3_bucket.config_logs_bucket.bucket
}

# Create AWS Config managed rule s3-bucket-versioning-enabled
# Your code here

Hint

Use the AWS managed rule identifier S3_BUCKET_VERSIONING_ENABLED to check bucket versioning compliance.

Practice

1. What is the primary purpose of AWS Config in cloud management?

easy

A. To deploy applications automatically

B. To track changes in AWS resource configurations and check compliance

C. To monitor network traffic in real-time

D. To manage user permissions and roles

Solution

1. Step 1: Understand AWS Config's role

   AWS Config records configuration changes and evaluates compliance of AWS resources.

2. Step 2: Compare with other options

   Other options describe different AWS services like deployment, monitoring, or IAM, not AWS Config.

3. Final Answer:

   To track changes in AWS resource configurations and check compliance -> Option B

4. Quick Check:

   AWS Config = Compliance tracking [OK]

Hint: AWS Config = resource change tracking + compliance [OK]

Common Mistakes:

• Confusing AWS Config with deployment services
• Thinking AWS Config manages user permissions
• Mixing AWS Config with network monitoring tools

2. Which AWS Config component is responsible for recording resource configuration changes?

easy

A. Delivery Channel

B. Config Rule

C. Configuration Recorder

D. Compliance Pack

Solution

1. Step 1: Identify the component that records changes

   The Configuration Recorder captures resource configuration changes in AWS Config.

2. Step 2: Understand other components

   Config Rules evaluate compliance, Delivery Channel sends data to storage, Compliance Packs group rules.

3. Final Answer:

   Configuration Recorder -> Option C

4. Quick Check:

   Recorder = records changes [OK]

Hint: Recorder records changes; rules check compliance [OK]

Common Mistakes:

• Confusing Delivery Channel with recording
• Thinking Config Rule records changes
• Mixing Compliance Pack with recording function

3. Given this AWS Config rule JSON snippet, what does it check?

{
  "ConfigRuleName": "s3-bucket-public-read-prohibited",
  "Source": {
    "Owner": "AWS",
    "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"
  }
}

medium

A. Checks if S3 buckets allow public read access

B. Checks if S3 buckets have versioning enabled

C. Checks if S3 buckets are encrypted

D. Checks if S3 buckets have lifecycle policies

Solution

1. Step 1: Analyze the SourceIdentifier

   The SourceIdentifier "S3_BUCKET_PUBLIC_READ_PROHIBITED" indicates the rule checks for public read access on S3 buckets.

2. Step 2: Match with options

   Checks if S3 buckets allow public read access matches the rule's purpose; others relate to different bucket settings.

3. Final Answer:

   Checks if S3 buckets allow public read access -> Option A

4. Quick Check:

   Rule name = public read check [OK]

Hint: Rule names often describe their check clearly [OK]

Common Mistakes:

• Assuming it checks encryption or versioning
• Ignoring the SourceIdentifier meaning
• Confusing lifecycle policies with access controls

4. You configured AWS Config but notice no compliance data is delivered. What is the most likely issue?

medium

A. Configuration Recorder is not started

B. Config Rules are disabled

C. IAM user lacks EC2 permissions

D. Delivery Channel is missing or misconfigured

Solution

1. Step 1: Understand data flow in AWS Config

   Configuration Recorder records changes; Delivery Channel sends data to S3 or SNS.

2. Step 2: Identify cause of no data delivery

   If no compliance data arrives, Delivery Channel is likely missing or misconfigured.

3. Final Answer:

   Delivery Channel is missing or misconfigured -> Option D

4. Quick Check:

   Delivery Channel = data delivery [OK]

Hint: Check Delivery Channel if no data arrives [OK]

Common Mistakes:

• Assuming Recorder is off without checking
• Confusing Config Rules with data delivery
• Blaming IAM permissions unrelated to Config

5. You want to enforce that all EC2 instances have a specific tag for cost center. Which AWS Config setup achieves this best?

hard

A. Create a Config Rule that checks EC2 instances for the required tag and alerts non-compliance

B. Use Configuration Recorder to record EC2 instance tags only

C. Set up Delivery Channel to send EC2 instance data to CloudTrail

D. Manually review EC2 instances weekly for tag compliance

Solution

1. Step 1: Identify enforcement method

   A Config Rule can automatically check EC2 instances for required tags and report compliance.

2. Step 2: Evaluate other options

   Recorder only records data, Delivery Channel sends data but doesn't enforce, manual review is inefficient.

3. Final Answer:

   Create a Config Rule that checks EC2 instances for the required tag and alerts non-compliance -> Option A

4. Quick Check:

   Config Rule = automatic compliance check [OK]

Hint: Use Config Rules to enforce resource settings automatically [OK]

Common Mistakes:

• Thinking Recorder enforces compliance
• Confusing Delivery Channel with enforcement
• Relying on manual checks instead of automation