AWS Config for compliance - Step-by-Step Execution

Process Flow - AWS Config for compliance

Start AWS Config Setup

↓

Define Resource Types to Monitor

↓

Create Config Rules

↓

AWS Config Records Resource States

↓

Evaluate Compliance Against Rules

↓

Generate Compliance Reports

↓

Alert or Remediate Non-Compliance

↓

End

AWS Config tracks your cloud resources, checks if they follow rules, and reports compliance.

Execution Sample

AWS

aws configservice put-config-rule --config-rule file://rule.json
aws configservice describe-compliance-by-config-rule

This sets a compliance rule and then checks compliance status.

Process Table

Step	Action	Input/Condition	AWS Config Behavior	Result
1	Start AWS Config	Enable AWS Config in region	AWS Config service starts recording resource changes	Recording started
2	Define Resources	Select EC2, S3, IAM	AWS Config tracks these resource types	Resources monitored
3	Create Rule	Rule: EC2 instances must have tags	Rule created and active	Rule active
4	Resource Change Detected	New EC2 instance launched	AWS Config records instance state	Instance recorded
5	Evaluate Compliance	Check if instance has required tags	Rule evaluates instance	Instance non-compliant
6	Generate Report	Compliance data collected	AWS Config compiles compliance report	Report shows non-compliance
7	Alert	Non-compliance detected	Send notification or trigger remediation	Alert sent
8	End	No new changes	No further action	Waiting for changes

💡 No new resource changes detected, AWS Config waits for next event

Status Tracker

Variable	Start	After Step 4	After Step 5	After Step 6	Final
Resources Monitored	None	EC2 instance added	EC2 instance evaluated	Compliance report generated	Waiting for changes
Compliance Status	N/A	N/A	Non-compliant	Reported	No new changes

Key Moments - 2 Insights

Why does AWS Config show non-compliance after a new resource is added?

Because the new resource does not meet the rule criteria, as shown in step 5 where the rule evaluates and finds missing tags.

What happens if no resource changes occur after AWS Config is set up?

AWS Config waits and does not generate new reports until it detects changes, as shown in step 8.

Visual Quiz - 3 Questions

Look at the execution table, at which step does AWS Config evaluate resource compliance?

A Step 3

B Step 5

C Step 6

D Step 7

💡 Hint

Check the 'AWS Config Behavior' column for evaluation actions.

According to the variable tracker, what is the compliance status after step 5?

A Non-compliant

B Compliant

C Not evaluated

D Unknown

💡 Hint

Look at the 'Compliance Status' row after step 5.

If a resource change is detected at step 4, what is the immediate AWS Config action?

A Send alert

B Generate report

C Record resource state

D Evaluate compliance

💡 Hint

Refer to the 'AWS Config Behavior' column at step 4.

Concept Snapshot

AWS Config monitors AWS resources continuously.
You define rules to check compliance.
It records resource states and evaluates rules.
Reports show which resources comply or not.
Alerts or fixes can be triggered automatically.

Full Transcript

AWS Config is a service that helps you track your cloud resources and check if they follow your rules. First, you enable AWS Config and choose which resources to watch, like EC2 or S3. Then, you create rules that say what is allowed, for example, EC2 instances must have tags. When a resource changes, AWS Config records its state and checks if it follows the rules. It makes reports showing compliance status. If something is not compliant, it can send alerts or fix the problem automatically. If no changes happen, AWS Config waits for new events.

Practice

1. What is the primary purpose of AWS Config in cloud management?

easy

A. To deploy applications automatically

B. To track changes in AWS resource configurations and check compliance

C. To monitor network traffic in real-time

D. To manage user permissions and roles

Solution

1. Step 1: Understand AWS Config's role

   AWS Config records configuration changes and evaluates compliance of AWS resources.

2. Step 2: Compare with other options

   Other options describe different AWS services like deployment, monitoring, or IAM, not AWS Config.

3. Final Answer:

   To track changes in AWS resource configurations and check compliance -> Option B

4. Quick Check:

   AWS Config = Compliance tracking [OK]

Hint: AWS Config = resource change tracking + compliance [OK]

Common Mistakes:

• Confusing AWS Config with deployment services
• Thinking AWS Config manages user permissions
• Mixing AWS Config with network monitoring tools

2. Which AWS Config component is responsible for recording resource configuration changes?

easy

A. Delivery Channel

B. Config Rule

C. Configuration Recorder

D. Compliance Pack

Solution

1. Step 1: Identify the component that records changes

   The Configuration Recorder captures resource configuration changes in AWS Config.

2. Step 2: Understand other components

   Config Rules evaluate compliance, Delivery Channel sends data to storage, Compliance Packs group rules.

3. Final Answer:

   Configuration Recorder -> Option C

4. Quick Check:

   Recorder = records changes [OK]

Hint: Recorder records changes; rules check compliance [OK]

Common Mistakes:

• Confusing Delivery Channel with recording
• Thinking Config Rule records changes
• Mixing Compliance Pack with recording function

3. Given this AWS Config rule JSON snippet, what does it check?

{
  "ConfigRuleName": "s3-bucket-public-read-prohibited",
  "Source": {
    "Owner": "AWS",
    "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"
  }
}

medium

A. Checks if S3 buckets allow public read access

B. Checks if S3 buckets have versioning enabled

C. Checks if S3 buckets are encrypted

D. Checks if S3 buckets have lifecycle policies

Solution

1. Step 1: Analyze the SourceIdentifier

   The SourceIdentifier "S3_BUCKET_PUBLIC_READ_PROHIBITED" indicates the rule checks for public read access on S3 buckets.

2. Step 2: Match with options

   Checks if S3 buckets allow public read access matches the rule's purpose; others relate to different bucket settings.

3. Final Answer:

   Checks if S3 buckets allow public read access -> Option A

4. Quick Check:

   Rule name = public read check [OK]

Hint: Rule names often describe their check clearly [OK]

Common Mistakes:

• Assuming it checks encryption or versioning
• Ignoring the SourceIdentifier meaning
• Confusing lifecycle policies with access controls

4. You configured AWS Config but notice no compliance data is delivered. What is the most likely issue?

medium

A. Configuration Recorder is not started

B. Config Rules are disabled

C. IAM user lacks EC2 permissions

D. Delivery Channel is missing or misconfigured

Solution

1. Step 1: Understand data flow in AWS Config

   Configuration Recorder records changes; Delivery Channel sends data to S3 or SNS.

2. Step 2: Identify cause of no data delivery

   If no compliance data arrives, Delivery Channel is likely missing or misconfigured.

3. Final Answer:

   Delivery Channel is missing or misconfigured -> Option D

4. Quick Check:

   Delivery Channel = data delivery [OK]

Hint: Check Delivery Channel if no data arrives [OK]

Common Mistakes:

• Assuming Recorder is off without checking
• Confusing Config Rules with data delivery
• Blaming IAM permissions unrelated to Config

5. You want to enforce that all EC2 instances have a specific tag for cost center. Which AWS Config setup achieves this best?

hard

A. Create a Config Rule that checks EC2 instances for the required tag and alerts non-compliance

B. Use Configuration Recorder to record EC2 instance tags only

C. Set up Delivery Channel to send EC2 instance data to CloudTrail

D. Manually review EC2 instances weekly for tag compliance

Solution

1. Step 1: Identify enforcement method

   A Config Rule can automatically check EC2 instances for required tags and report compliance.

2. Step 2: Evaluate other options

   Recorder only records data, Delivery Channel sends data but doesn't enforce, manual review is inefficient.

3. Final Answer:

   Create a Config Rule that checks EC2 instances for the required tag and alerts non-compliance -> Option A

4. Quick Check:

   Config Rule = automatic compliance check [OK]

Hint: Use Config Rules to enforce resource settings automatically [OK]

Common Mistakes:

• Thinking Recorder enforces compliance
• Confusing Delivery Channel with enforcement
• Relying on manual checks instead of automation