AWS Config, and CloudWatch vs CloudTrail vs Config

By the end of this lesson you will be able to

• Explain what AWS Config is (a time machine for your resources’ configuration plus a compliance checker), which questions it answers, and why it is regional and needs its configuration recorder turned on.
• Describe how Config records: the recorder and its recording strategy, continuous or daily recording, global resource types, the delivery channel to S3 and SNS, configuration items, history, the resource timeline, relationships and snapshots.
• Use Config rules: managed rules and custom rules (Lambda or Guard), change-triggered, periodic (1, 3, 6, 12 or 24 hours) and hybrid triggers, evaluation results, and the proactive mode; and explain why Config detects but never prevents.
• Set up remediation with SSM Automation documents, manual or automatic, with retries and remediation exceptions; and notifications through EventBridge (compliance changes) or SNS (everything).
• Scale Config to an organization with aggregators, organization rules and conformance packs, and estimate its cost per configuration item and per rule evaluation.
• Tell CloudWatch, CloudTrail and Config apart (and EventBridge, which reacts): the three lenses, the pairwise comparisons, the load balancer example, and the master cheat sheet; and place AWS Health Dashboard, Trusted Advisor, GuardDuty, Security Hub and Audit Manager next to them.

#Why AWS Config: a time machine and a compliance checker

Lessons 19.1 to 19.6 covered three ways to watch an AWS account. CloudWatch measures how the system performs and collects its logs. CloudTrail records who called which API. EventBridge reacts when something happens. One question is still open: what did my resources actually look like, at any moment, and were they configured the way our rules say? That is AWS Config.

AWS Config does two jobs:

1. Records configuration over time. For every supported resource (security groups, EC2 instances, EBS volumes, S3 buckets, IAM roles, load balancers and hundreds more types) it keeps the configuration at each moment and every change since. You can ask: what did this security group allow last Monday at 10:00? When was encryption turned off on this bucket? The owner’s notes call it the resources’ time machine.
2. Evaluates compliance. Config rules check each resource against what it should be (“every EBS volume encrypted”, “no security group open to SSH from the internet”) and mark it compliant or non-compliant, now and over time. Non-compliant resources can be fixed by remediation actions.

Typical questions Config answers, in the slides’ spirit:

• Is there unrestricted SSH access in any of my security groups?
• Do any of my buckets allow public access?
• How has my load balancer’s configuration changed over the last month?
• Has every EBS volume been encrypted all year, as the auditor asks?

#How Config records

#The configuration recorder

Config does nothing until its configuration recorder is running. The recorder notices when a resource is created, changed or deleted and records it. Facts that matter:

• Config is regional. Each Region of each account has its own recorder, its own rules and its own console view. Turning Config on in Singapore tells you nothing about Mumbai. Multi-account, multi-Region views come from an aggregator (later in this lesson).
• Recording strategy. Record all supported resource types (the default in the console, including types AWS adds later), all types except some you exclude (for example short-lived ones that create many items), or only specific types you list.
• Recording frequency (2023). Continuous records every change as it happens. Daily records at most one item per resource per day, only if it changed; cheaper, but you lose the in-between steps and the near-real-time triggers. Security and compliance usually need continuous.
• Global resource types. IAM users, groups, roles and customer managed policies are not tied to a Region. Record them in one Region only, or every Region records duplicate items and runs duplicate evaluations. Newer global types (Route 53 hosted zones, CloudFront distributions, WAF web ACLs and others) are recorded only in their home Region, mostly us-east-1.
• Permissions. The recorder uses the service-linked role AWSServiceRoleForConfig to read your resources.

#The delivery channel

The delivery channel says where Config sends its data:

• An S3 bucket (required) receives configuration history files (about every 6 hours, for each resource type that changed) and configuration snapshots (the state of every recorded resource, on demand or every 1, 3, 6, 12 or 24 hours). From S3 you can keep the data as long as you like (S3 Lifecycle, lesson 10.5) and query it with Athena (lesson 17.1), as the slides suggest.
• An SNS topic (optional) receives a notification for every configuration change and compliance change. Notifications are covered below.

Inside Config, history is kept for 7 years by default; you can set a retention period from 30 days to 7 years. A hospital that must prove its setup for longer keeps the S3 files with a lifecycle rule.

#Configuration items

A configuration item is the record of one resource at one moment: the notes call it a point-in-time snapshot of the resource’s configuration. It holds:

• Metadata: resource type, resource ID and ARN, Region, account, capture time, status and a version.
• Configuration: the resource’s settings as returned by its describe API (for a security group, every inbound and outbound rule; for a volume, size, type, encryption and key).
• Relationships: what it is connected to (this security group is attached to that network interface, in that VPC).
• Tags, and the CloudTrail event IDs of the API calls that caused the change.

Each change creates a new configuration item with the full configuration, not just the difference. A sequence of items for one resource is its configuration history.

#History, timeline, relationships and snapshots

In the console, every resource has a resource timeline: its configuration items in time order, the compliance result of each rule over time, and the CloudTrail events related to each change. That is the slide’s “Config resource” page: compliance over time, configuration over time, CloudTrail API calls over time, for one resource. Across many resources, advanced queries let you write SQL-like SELECT statements over the current configuration (“all EBS volumes that are not gp3”), even across accounts through an aggregator.

Relationships answer the blast-radius question: before you delete or change a security group, Config shows what uses it. Snapshots give an auditor the complete state of the account at a point in time.

#Config rules

#Managed and custom rules

A Config rule describes the configuration you want and evaluates resources against it. Each evaluation gives a result per resource: COMPLIANT, NON_COMPLIANT, or NOT_APPLICABLE (the resource is out of the rule’s logic, for example a network load balancer for an ALB-only check). The rule itself is non-compliant if any resource in its scope is.

• AWS managed rules are written and maintained by AWS; you add one and set its parameters. The slide says “over 75”: there are now more than 800. The ones the notes name: s3-bucket-ssl-requests-only (bucket policy must deny plain HTTP), restricted-ssh (no security group allows port 22 from 0.0.0.0/0), iam-password-policy (the account’s password policy meets your parameters). Others worth knowing: encrypted-volumes, s3-bucket-public-read-prohibited, required-tags, access-keys-rotated, desired-instance-type, approved-amis-by-id, cloudtrail-enabled, elb-acm-certificate-required.
• Custom rules are for your own logic, written in one of two ways (the slide’s “must be defined in AWS Lambda” is outdated):
  • Custom Lambda rules: Config invokes your Lambda function with the configuration item; the function decides and reports the result back to Config. Use it when the check needs code or extra API calls.
  • Custom policy rules in Guard, the AWS CloudFormation Guard policy language: a few lines that say which properties must have which values, with no Lambda function to maintain.

The slide’s custom-rule examples (“each EBS disk is of type gp2”, “each EC2 instance is t2.micro”) show the idea; today managed rules already cover instance types (desired-instance-type), and a modern team would require gp3, not gp2.

#When rules run: triggers

• Configuration changes: the rule runs when a resource in its scope (resource types, one resource ID, or a tag key and value) changes. This is how a public bucket or an open port is caught within minutes.
• Periodic: the rule runs at a frequency you choose: every 1, 3, 6, 12 or 24 hours (24 by default). Used for account-level checks that are not tied to one resource changing, such as iam-password-policy or cloudtrail-enabled.
• Hybrid: some rules have both triggers.

You can also run any rule on demand (start-config-rules-evaluation).

#Detective, not preventive

#Remediation: fixing what the rules find

#SSM Automation documents

Remediation fixes a non-compliant resource. Config does it with AWS Systems Manager Automation documents (runbooks; Systems Manager is lesson 25.3):

• AWS-managed documents cover common fixes: AWS-DisableS3BucketPublicReadWrite (turns on Block Public Access for a bucket), AWS-DisableIncomingSSHOnPort22, AWSConfigRemediation-RevokeUnusedIAMUserCredentials, AWSConfigRemediation-EnableEbsEncryptionByDefault and many more.
• Custom documents can do anything, including invoke a Lambda function for logic the managed ones lack.
• Parameters are passed from the rule, usually the non-compliant resource ID (the bucket name, the security group ID), plus an automation role (AutomationAssumeRole) that gives the runbook permission to change the resource.

Two modes:

• Manual: the console shows “Remediate”; a person decides and clicks. Safer for risky fixes.
• Automatic: Config runs the document as soon as the resource is non-compliant. With retries: by default up to 5 attempts within 60 seconds (MaximumAutomaticAttempts 1 to 25, RetryAttemptSeconds the window). If every attempt fails, Config adds a remediation exception for that resource and stops, so a broken fix does not loop for ever.

The slide’s example: a rule finds an IAM user’s access key unused for too long (NON_COMPLIANT), and the automatic remediation AWSConfigRemediation-RevokeUnusedIAMUserCredentials deactivates it, with 5 retries.

#Notifications: EventBridge or SNS

Two ways to hear about problems, both on the slides:

• EventBridge (recommended for alerts). Config sends events to the default event bus, notably “Config Rules Compliance Change” (and “Config Configuration Item Change”). An EventBridge rule (lesson 19.5) can match only NON_COMPLIANT results of the rules you care about and send them to SNS, Lambda, SQS or a ticketing tool. Precise and filterable.
• SNS on the delivery channel. Config publishes all its notifications to the topic: every configuration change, compliance change, snapshot and history delivery. Complete, but noisy: filter with an SNS subscription filter policy or in the subscriber.

#Config across accounts and Regions

#Aggregators

A configuration aggregator collects configuration and compliance data from many accounts and Regions into one account, typically a security or audit account. Sources are either the whole AWS Organization (authorized through Organizations, from the management account or a delegated administrator) or a list of individual accounts, each of which must authorize the aggregator.

An aggregator is a read-only view: it shows resources and compliance everywhere and supports advanced queries across them, but it does not create rules, evaluate anything or remediate. Rules and remediation still run in each account and Region, which is why every source Region needs its recorder on.

#Organization rules and conformance packs

• Organization Config rules: from the management account or the Config delegated administrator, deploy a rule to every account in the organization at once (put-organization-config-rule). Member accounts cannot change or delete it, and new accounts get it automatically.
• Conformance packs: a YAML template bundling many Config rules and their remediation actions into one unit that you deploy to an account and Region, or across the organization as an organization conformance pack. AWS publishes sample packs, such as “Operational Best Practices for” CIS benchmarks, NIST frameworks, HIPAA, PCI and the AWS Well-Architected security pillar. A pack shows one compliance score.

#What Config costs

Config has no free tier. You pay per Region, per account (us-east-1 prices):

A quick estimate for the university: 2,000 resources that change on average 5 times a month record 10,000 items, about USD 30. Thirty change-triggered rules evaluating those changes add tens of thousands of evaluations, another USD 30 to 50. The traps are churn and frequency: an Auto Scaling group that launches and terminates hundreds of instances a day, or EMR clusters, create items for every short-lived resource (exclude those types or record them daily), and periodic rules at 1 hour over thousands of resources multiply evaluations.

#CloudWatch vs CloudTrail vs Config

#Three lenses on one account

The three services look alike in exam options because all three “monitor”. They look at different things:

The slides add a few lines worth keeping. CloudWatch also does dashboards, log aggregation and analysis, and “events and alerting” (CloudWatch Events, now EventBridge). CloudTrail records API calls by everyone in the account and can define trails for specific resources (data events). The slide calls CloudTrail a “global service”: more precisely, CloudTrail is a regional service; a multi-Region trail (the console default) collects every Region into one bucket, and events of global services such as IAM, STS and CloudFront are recorded in us-east-1 (lesson 19.6). Config records configuration changes, evaluates resources against rules, and gives a timeline of changes and compliance.

#Pairwise comparisons

CloudWatch vs CloudTrail. CloudWatch shows the effect on performance: EC2 CPU above 80%, ERROR lines in the logs. CloudTrail shows the action that caused it: user John launched an EC2 instance, or opened a new port in a security group firewall. In practice: CloudWatch raises the alarm, CloudTrail identifies the responsible user or API call.

CloudTrail vs Config. CloudTrail records the event: “at 12:00 the AuthorizeSecurityGroupIngress API was called to open port 22.” Config records the resulting state: “security group X is now NON_COMPLIANT because port 22 is open to 0.0.0.0/0.” CloudTrail is for audit reports of who did what; Config is for legal compliance and keeping track of resources. Each links to the other: Config’s timeline shows the CloudTrail events beside each change.

CloudWatch vs Config. CloudWatch is near-real-time monitoring of metrics: memory, disk I/O, network latency. Config is point-in-time configuration auditing: is this EBS volume encrypted? Does this S3 bucket have default encryption, versioning, a required sensitivity tag? The notes also give “does this bucket have malware scanning?” as a Config example; that is not a bucket setting Config evaluates. Scanning objects for malware is GuardDuty Malware Protection for S3 (lesson 21.7).

#The load balancer example

The slides’ example for one Application Load Balancer:

• CloudWatch: incoming connections and request count, error codes (HTTP 4xx and 5xx) as a percentage over time, latency, and a dashboard of load balancer performance.
• Config: track the load balancer’s security group rules and configuration changes (listeners, attributes), and make sure an SSL/TLS certificate is always attached (the managed rule elb-acm-certificate-required, or alb-http-to-https-redirection-check for redirects).
• CloudTrail: who changed the load balancer, through which API calls.

#Which tool answers this question

The notes’ master cheat sheet, plus the neighbours the exam uses as distractors:

#What goes wrong

#Config in system design

• Detective layer of a landing zone. In a multi-account organization, Config runs in every account and Region, an aggregator and conformance packs are managed from a security or audit account, and the S3 delivery bucket sits in a separate log-archive account with CloudTrail logs, protected with bucket policies and Object Lock. AWS Control Tower sets exactly this up; its detective controls are Config rules (lesson 20.3).
• Prevent, detect, correct. SCPs and service settings prevent; Config rules detect; SSM remediation corrects; EventBridge and SNS notify. Automate the corrections that are safe and reversible (block public access, remove a 0.0.0.0/0 SSH rule); leave risky ones manual.
• Change and incident investigation. Config’s history answers “what changed before the outage?”; CloudTrail answers who; CloudWatch shows when the effect began. Use all three together.
• Audit evidence. Compliance history over time, conformance pack scores and S3 snapshots queried with Athena are the evidence auditors ask for. Keep the history as long as your regulator requires (a hospital: 7 years, with S3 Lifecycle to Glacier for the S3 copy).
• Shift left. Proactive evaluation and CloudFormation Guard in the pipeline catch problems before deployment; Config detective rules still watch what reaches the account.

#Try it yourself

Set up Config in one Region, add rules, remediate, and look at history. Output is shortened; names, IDs and numbers are examples. Config bills per item and per evaluation, so clean up at the end.

1. 1. Turn on the recorder and the delivery channel

   aws configservice put-configuration-recorder \
     --configuration-recorder name=default,roleARN=arn:aws:iam::111122223333:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig \
     --recording-group allSupported=true,includeGlobalResourceTypes=true \
     --recording-mode recordingFrequency=CONTINUOUS
   
   aws configservice put-delivery-channel --delivery-channel \
     'name=default,s3BucketName=config-history-example,snsTopicARN=arn:aws:sns:ap-southeast-1:111122223333:config-all,configSnapshotDeliveryProperties={deliveryFrequency=TwentyFour_Hours}'
   
   aws configservice start-configuration-recorder --configuration-recorder-name default
   aws configservice describe-configuration-recorder-status
   

   "ConfigurationRecordersStatus": [ { "name": "default", "recording": true,
     "lastStatus": "SUCCESS", "lastStartTime": "2026-11-01T09:12:03+06:00" } ]
   

   Set includeGlobalResourceTypes=true in one Region only.

2. 2. Add two managed rules

   aws configservice put-config-rule --config-rule '{
     "ConfigRuleName": "restricted-ssh",
     "Source": { "Owner": "AWS", "SourceIdentifier": "INCOMING_SSH_DISABLED" },
     "Scope": { "ComplianceResourceTypes": ["AWS::EC2::SecurityGroup"] } }'
   
   aws configservice put-config-rule --config-rule '{
     "ConfigRuleName": "iam-password-policy",
     "Source": { "Owner": "AWS", "SourceIdentifier": "IAM_PASSWORD_POLICY" },
     "InputParameters": "{\"MinimumPasswordLength\":\"14\"}",
     "MaximumExecutionFrequency": "TwentyFour_Hours" }'
   

   The SourceIdentifier is the managed rule’s identifier (INCOMING_SSH_DISABLED is restricted-ssh).

3. 3. Break a rule and read the result

   aws ec2 authorize-security-group-ingress --group-id sg-0prod1234example \
     --protocol tcp --port 22 --cidr 0.0.0.0/0
   
   # a minute or two later
   aws configservice get-compliance-details-by-config-rule \
     --config-rule-name restricted-ssh --compliance-types NON_COMPLIANT
   

   "EvaluationResults": [ { "EvaluationResultIdentifier": { "EvaluationResultQualifier": {
       "ConfigRuleName": "restricted-ssh", "ResourceType": "AWS::EC2::SecurityGroup",
       "ResourceId": "sg-0prod1234example" } },
     "ComplianceType": "NON_COMPLIANT", "ResultRecordedTime": "2026-11-01T12:01:22+06:00" } ]
   

4. 4. Add automatic remediation

   aws configservice put-remediation-configurations --remediation-configurations '[{
     "ConfigRuleName": "restricted-ssh",
     "TargetType": "SSM_DOCUMENT",
     "TargetId": "AWS-DisableIncomingSSHOnPort22",
     "Parameters": {
       "SecurityGroupIds": { "ResourceValue": { "Value": "RESOURCE_ID" } },
       "AutomationAssumeRole": { "StaticValue": { "Values": ["arn:aws:iam::111122223333:role/config-remediation"] } } },
     "Automatic": true,
     "MaximumAutomaticAttempts": 5,
     "RetryAttemptSeconds": 60 }]'
   
   aws configservice describe-remediation-execution-status --config-rule-name restricted-ssh
   

   "RemediationExecutionStatuses": [ { "ResourceKey": { "resourceId": "sg-0prod1234example" },
     "State": "SUCCEEDED", "StepDetails": [ { "Name": "DisableIncomingSSHTemplate", "State": "SUCCEEDED" } ] } ]
   

   RESOURCE_ID passes the non-compliant security group’s ID into the runbook.

5. 5. Look back in time

   aws configservice get-resource-config-history \
     --resource-type AWS::EC2::SecurityGroup --resource-id sg-0prod1234example --limit 3 \
     --query 'configurationItems[].{time:configurationItemCaptureTime,status:configurationItemStatus}'
   
   aws configservice select-resource-config --expression \
     "SELECT resourceId, configuration.volumeType WHERE resourceType = 'AWS::EC2::Volume' AND configuration.encrypted = false"
   

   [ { "time": "2026-11-01T12:34:58+06:00", "status": "OK" },
     { "time": "2026-11-01T12:00:41+06:00", "status": "OK" },
     { "time": "2026-10-01T09:00:12+06:00", "status": "ResourceDiscovered" } ]
   "Results": [ "{\"resourceId\":\"vol-07ab12cd34example\",\"configuration\":{\"volumeType\":\"gp2\"}}" ]
   

6. 6. Get alerted through EventBridge

   aws events put-rule --name config-noncompliant --event-pattern '{
     "source": ["aws.config"],
     "detail-type": ["Config Rules Compliance Change"],
     "detail": { "newEvaluationResult": { "complianceType": ["NON_COMPLIANT"] } } }'
   
   aws events put-targets --rule config-noncompliant \
     --targets Id=sec-team,Arn=arn:aws:sns:ap-southeast-1:111122223333:security-alerts
   

   The SNS topic’s access policy must allow events.amazonaws.com to publish (lesson 19.5).

7. 7. Aggregate the organization (from the audit account)

   aws configservice put-configuration-aggregator --configuration-aggregator-name org-all \
     --organization-aggregation-source RoleArn=arn:aws:iam::444455556666:role/config-aggregator,AllAwsRegions=true
   
   aws configservice get-aggregate-compliance-details-by-config-rule \
     --configuration-aggregator-name org-all --config-rule-name restricted-ssh \
     --account-id 777788889999 --aws-region ap-south-1 --compliance-type NON_COMPLIANT
   

8. 8. Clean up

   aws configservice delete-remediation-configuration --config-rule-name restricted-ssh
   aws configservice delete-config-rule --config-rule-name restricted-ssh
   aws configservice delete-config-rule --config-rule-name iam-password-policy
   aws configservice stop-configuration-recorder --configuration-recorder-name default
   aws events remove-targets --rule config-noncompliant --ids sec-team
   aws events delete-rule --name config-noncompliant
   

#Summary

Key takeaways

• AWS Config = the resources’ time machine (configuration history) + compliance checker (rules). Regional; nothing happens unless the configuration recorder is on in that Region. Delivery channel: S3 (history files, snapshots; query with Athena) and optional SNS.
• A configuration item is a resource’s full configuration at one moment, with relationships, tags and related CloudTrail events. The resource timeline shows configuration, compliance and CloudTrail calls over time. Record global IAM types in one Region; continuous or daily recording.
• Rules: managed (now 800+; the slide’s “over 75” is old) or custom (Lambda or Guard). Triggers: configuration change, periodic (1, 3, 6, 12, 24 h), hybrid. Results COMPLIANT, NON_COMPLIANT, NOT_APPLICABLE. Proactive mode evaluates before deployment but blocks nothing.
• Detective, not preventive: Config never denies. Prevent with SCPs, IAM, S3 Block Public Access, EBS encryption by default.
• Remediation = SSM Automation documents (AWS-managed or custom, can call Lambda), manual or automatic, retries (default 5 in 60 s, up to 25), then a remediation exception. Needs an automation role.
• Notifications: EventBridge compliance-change events (filtered, precise) or SNS on the delivery channel (all events, filter it).
• Scale: aggregators (read-only, multi-account multi-Region), organization rules, conformance packs (YAML: rules + remediation). Cost: USD 0.003 per item (continuous), USD 0.001 per rule evaluation, no free tier.
• Three lenses: CloudWatch = performance and health (metrics, logs, alarms); CloudTrail = who called which API; Config = what the resource looks like and whether it is compliant; EventBridge = react and route. Malware in S3 → GuardDuty, not Config. Audit Manager closed to new customers (April 2026).

Self-check: AWS Config and the three lenses30 questions