AWS Config
- What it is
- Records the configuration of your AWS resources over time and evaluates them against desired-state rules.
- Answers “what did this resource look like last Tuesday, and what changed since?”
- Capabilities
- Configuration history and a relationship graph between resources.
- Config rules — managed or custom (Lambda) checks: “all EBS volumes must be encrypted”, “no security group open to 0.0.0.0/0 on port 22”.
- Conformance packs — bundles of rules mapped to a compliance standard, deployable org-wide.
- Remediation actions — automatically fix non-compliant resources via AWS Systems Manager Automation.
- Not to be confused with
- AWS CloudTrail — records the API call that made the change. Config records the resulting state. You often need both: CloudTrail says who, Config says what it became.
- AWS Trusted Advisor — fixed set of best-practice checks. Config lets you define your own rules.