AWS Config Explanation and Walkthrough For Beginners

AWS Config Deep Dive

Key Concepts:

• AWS Config: An inventorying and compliance service that records changes to AWS resources.
• Rules: Compliance checks that evaluate resource configurations against desired settings.
• Conformance Packs: Pre-built sets of rules for specific AWS services or compliance standards.
• Resource Inventory: A comprehensive list of all resources in an AWS account.
• Resource Timeline: A chronological record of configuration changes for a specific resource.
• Aggregators: A feature to consolidate configuration data from multiple AWS accounts into a central account.
• AWS Managed Rules: Pre-defined rules provided by AWS for common compliance checks.
• Custom Rules: Rules created by users using AWS Lambda functions or Guard (a domain-specific language).
• Guard: A domain-specific language for writing custom rules.
• Detective vs. Proactive Mode: Detective mode identifies non-compliant resources, while proactive mode prevents non-compliant resources from being created.

Setting Up AWS Config

• AWS Config is not enabled by default and incurs costs.
• Two setup options:
  • One-Click Setup: Creates a new S3 bucket for storing events and configures basic settings. Suitable for beginners.
  • Get Started Button: Provides more granular control over settings, including delivery frequency (continuous or daily), delivery destination (S3 bucket), and initial rules. Recommended for users with prior knowledge.
• The service records resource creation, updates, and deletions as events.
• AWS Config only tracks changes after it is enabled. Historical changes prior to enablement are not recorded in the change history.

Core Components and Features

• Conformance Packs:
  • Pre-packaged rule sets for specific services (e.g., API Gateway, S3).
  • Enforce best practices and compliance standards.
  • Notify users when resources are created or modified in a non-compliant manner.
  • Contain multiple individual rules.
• Rules:
  • Compliance checks that evaluate resource configurations.
  • Can be AWS-managed (pre-built) or custom-defined.
  • Custom rules can be created using AWS Lambda functions for complex logic or Guard for simpler checks.
  • Rules can be triggered by configuration changes (event-driven) or run periodically.
• Resource Inventory:
  • Provides a list of all resources in the AWS account, categorized by type.
  • Displays the quantity of each resource type.
• Resource Timeline:
  • Tracks configuration changes for a specific resource over time.
  • Displays a chronological record of events, including creation, modifications, and deletions.
  • Shows a diff of the configuration before and after each change.
  • Integrates with CloudTrail to identify the user or service that initiated the change.
  • Example: Tracking changes to a DynamoDB table, including enabling DynamoDB Streams.
• Aggregators:
  • Consolidate configuration data from multiple AWS accounts into a central account.
  • Useful for large organizations to ensure consistent compliance across all accounts.
• Advanced Queries:
  • Uses natural language processing (AI) to query resource configurations.
  • Allows users to ask questions about their resources in plain English.
  • Example: "Show me all the DynamoDB tables with streams enabled."

Creating and Managing Rules

• Adding Rules:
  • Navigate to the "Rules" section in the AWS Config console.
  • Choose between AWS-managed rules or custom rules.
  • AWS-managed rules are pre-defined and cover common compliance scenarios.
  • Custom rules require writing code or using Guard.
• AWS Managed Rule Example:
  • "S3 account level Public Access blocks": Checks if required public access block settings are configured at the account level.
  • Configure the scope of the rule (resource types to evaluate).
  • Set parameters specific to the rule.
• Modifying Rules:
  • Rules created manually can be modified.
  • Rules created as part of a conformance pack cannot be modified individually.

Practical Examples and Use Cases

• S3 Bucket Compliance: Using AWS Config to ensure that S3 buckets are not publicly accessible.
• API Gateway Compliance: Using a conformance pack to enforce operational best practices for API Gateways.
• Troubleshooting Configuration Changes: Using the resource timeline to track down the cause of an issue by examining the history of changes to a resource.
• Multi-Account Compliance: Using aggregators to monitor compliance across multiple AWS accounts in a large organization.

Disabling AWS Config

• Navigate to the "Settings" section in the AWS Config console.
• Click "Stop recording" to disable the service.

Conclusion

AWS Config is a powerful and versatile service for inventorying and ensuring compliance of AWS resources. Its key features include rules, conformance packs, resource inventory, and resource timeline. By leveraging these features, users can gain better visibility into their AWS environment, enforce best practices, and quickly identify and remediate compliance issues. The advanced query feature and aggregators further enhance its capabilities for complex and multi-account environments.