Which service is used to review configuration change history of AWS resources and check whether the configurations comply with rules?

Explanation

AWS Config is a service that records the configuration history of AWS resources and evaluates whether the configurations comply with rules. It is often confused with CloudWatch and CloudTrail.

Per-choice explanations

Practical Use

AWS Config is a service that continuously records the configuration information of AWS resources, retains configuration change history, and evaluates whether the configurations comply with rules defined in advance (Config Rules). It records the "composition (configuration values) of resources," such as Amazon EC2 security groups, Amazon S3 bucket encryption settings, and IAM role policies, on a time series basis, so you can track when, by whom, and what was changed. By enabling Config Rules, you can continuously evaluate compliance conditions such as "block public access on Amazon S3 buckets" or "Amazon EBS volumes are encrypted" and detect non-compliant resources. On the exam, AWS Config is the expected answer for the prompt asking which service records configuration change history of AWS resources and checks whether the configurations comply with rules. Common distractors include Amazon SQS (message queue), Amazon CloudFront (CDN), and AWS Budgets (budget alerts). None of these are related to configuration change history or compliance evaluation. Confusion with CloudWatch and CloudTrail is a frequently tested point. Config covers "how resource configurations have changed" and "whether configurations comply," CloudTrail covers "who called which API," and CloudWatch covers "the operational state of resources and applications." In practice, Config is used for auditing and compliance purposes. More than 100 managed rules, such as s3-bucket-public-read-prohibited, encrypted-volumes, and root-account-mfa-enabled, are provided in advance, and continuous compliance monitoring can be started simply by enabling them. A common pattern is to combine Config with AWS Security Hub to aggregate the compliance status across an entire organization. CLF-C02 repeatedly asks about the division of role among Config, CloudTrail, and CloudWatch, and the organization of "Config Rules for compliance monitoring," "CloudTrail for API auditing," and "CloudWatch for operational monitoring."