AWS Config

A service to confirm whether AWS resource configurations conform to rules.

A service that records configuration change history of AWS resources and evaluates compliance state based on rules.

• Detecting publicly exposed S3 settings
• Detecting resources without encryption enabled
• Tracking configuration change history

• Used for resource configuration history and compliance evaluation
• Has a different role from CloudTrail and CloudWatch
• Can perform checks via Config Rules

• Detects violations of security baselines
• Consider aggregating Config across the organization
• Design recorded resources and cost

AWS Config is a service that records the configuration change history of AWS resources and evaluates compliance based on defined rules. It continuously captures configuration snapshots of each resource (EC2 / S3 / IAM / security groups, etc.) and tracks who changed which item, when, and how, in chronological order. Using Config Rules (managed rules and custom rules), compliance conditions can be continuously checked — for example, "Is the public access setting of an S3 bucket disabled?", "Is the EBS volume encrypted?", "Are there any security groups that allow all ports from 0.0.0.0/0?" — with notifications or automated remediation triggered when violations are detected. In practice, AWS Config is adopted for continuous evaluation of security baselines (CIS Benchmark / AWS Foundational Security Best Practices compliance), providing evidence trails during compliance audits, and detecting configuration drift (identifying where manual changes have diverged from the IaC-defined state). The difference from similar services: CloudTrail records "API call logs (who called which API)", while Config records "the state and change history of resource configurations" — a different area of coverage. CloudWatch is a monitoring service for "metrics and logs" and operates in yet another dimension from Config's role. For cross-account governance, the standard design uses Config Aggregator to consolidate records from multiple accounts and regions into a single account. CLF-C02 asks "Which service evaluates the history and compliance state of resource configurations?". A common exam topic is distinguishing among three services — Config, CloudTrail (API call logs), and CloudWatch (metrics monitoring) — by clarifying what each one records. This makes it easier to narrow down to the correct answer. Starting at SAA-C03, the focus expands to baseline violation detection with Config Rules, organization-wide aggregation, and cost optimization through scope-narrowed resource recording.

• AWS Config (AWS Official)
• What is AWS Config (AWS Official Documentation)
• Evaluating Resources with AWS Config (AWS Official Documentation)

Last updated: 2026-06-01