AWS Config
Resource configuration recorder — tracks what your resources looked like, when they changed, and whether they comply with your rules.
Verified against AWS documentation · 2026-08-26
Key facts
- 01Records every configuration change as a configuration item — a point-in-time snapshot with full history and resource relationships
- 02Config = *what* changed and what it changed to; CloudTrail = *who* made the API call. Exams love this pairing
- 03Rules (AWS managed, or custom via Lambda/Guard) mark resources compliant/non-compliant continuously; auto-remediation via SSM Automation documents
- 04Aggregators roll up compliance across accounts and Regions; conformance packs bundle rules for frameworks like CIS or PCI-DSS
- 05Regional service — you enable the recorder per Region; limit of 1,000 rules per Region per account
Exam triggers
Phrases and scenarios that point here.
- "Track/audit configuration changes over time", "configuration history", "what did this resource look like last Tuesday" → Config
- "Ensure all buckets are encrypted" / "no security groups open to 0.0.0.0/0" as a continuous check → Config rules
- "Automatically fix non-compliant resources" → Config rule + SSM Automation remediation
- "Single compliance view across the whole organization" → Config aggregator
Not this service
- Who called which API, from where → CloudTrail
- Performance metrics, logs, alarms → CloudWatch
- Cost/security best-practice suggestions → Trusted Advisor
Use cases
- 01Post-incident forensics: a security group suddenly allows 0.0.0.0/0 — Config shows the exact before/after state and the timestamp, then CloudTrail tells you who did it
- 02Continuous compliance instead of quarterly audits: an encryption rule flags any new unencrypted EBS volume within minutes of creation
- 03Self-healing guardrails: someone disables S3 Block Public Access, the rule goes non-compliant, SSM Automation flips it back before anyone notices
- 04One dashboard for the auditor: aggregator pulls compliance status from 40 accounts across 3 Regions into a single pane
- 05Drift detection: resources modified by hand in the console stand out against the state your IaC pipeline actually deployed
How it's charged
- 01Per configuration item recorded — continuous recording is cheaper per item than periodic; high-churn resources (Auto Scaling, Lambda versions) can flood you with billable items
- 02Per rule evaluation, on a tiered rate per Region; conformance pack evaluations are billed the same way on their own tier
- 03Custom Lambda rules add standard Lambda invocation charges on top of the evaluation charge
- 04Snapshots and history files land in your S3 bucket, change notifications go via SNS — both billed at standard S3/SNS rates
- 05Enabling the recorder is free; cost scales purely with change volume, so excluding noisy resource types from recording is the main cost lever
