Amazon Config
AWS Config is a service on Amazon Web Services that determines the quality of a resource’s configuration in an AWS account, tracking configuration changes and compliance over time. It is a region-specific service and must be configured separately in every region where it should watch resources. AWS Config uses Amazon Cloudtrail to capture API calls as events, helping identify and troubleshoot issues, and it can invoke AWS Lambda functions to check AWS Identity and Access Management (IAM) roles for compliance.
AI Practitioner focus
- Config records resource configuration history, evaluates Config rules/conformance packs, and can initiate remediation for noncompliant infrastructure around AI workloads.
- It supports governance evidence but does not evaluate model accuracy, bias, hallucinations, or prompt safety. Pair it with application/model-specific evaluation and logging.
Key points
- Region-specific service — must be configured in every AWS region where resources should be tracked.
- Resource Inventory — maintains a detailed inventory of AWS resources and their configurations.
- Configuration History — records historical configurations of AWS resources over time.
- Configuration Snapshots — capture a point-in-time view of resource configurations.
- Configuration Item — captures a resource’s configuration changes and metadata at a point in time.
- Change Tracking — monitors changes to resource configurations and tracks relationships between resources before changes are made.
- AWS Config Rules — evaluate the configuration settings of AWS resources against pre-built or custom rules for compliance.
- Conformance Packs — groups of rules packaged together to audit against a compliance standard (e.g. PCI).
- Aggregators — aggregate configuration and compliance data across multiple accounts and regions.
- Remediation — automatically or manually corrects non-compliant resources.
- Integration with AWS Organizations — enables centralized compliance management across multiple accounts.
- Compliance Dashboard — offers a visual overview of compliant vs. non-compliant resources for an account across regions.
- “AWS Config in action”: Config checks resources against specified Config Rules → invokes an AWS Lambda function → the function checks IAM roles for compliance → the function updates the compliance state back in Config.
- Accessible via the AWS Config console and the AWS Command Line Interface (CLI), and works with Amazon Cloudtrail to capture API calls as events.
- Distinct from Amazon Cloudtrail, which is the audit log of who called which API and when; Config instead records the resulting configuration state of a resource as a Configuration Item, not the caller’s identity.
- Distinct from Amazon Cloudwatch, which monitors real-time performance metrics, logs, and alarms rather than resource configuration state.
- Not a threat-detection service — Amazon GuardDuty analyzes CloudTrail, DNS (Domain Name System), and VPC Flow Logs for malicious activity, while Config only evaluates configuration compliance against rules.