AWS Config: Resource History & Compliance

AWS Config records resource configuration state, not user activity

AWS Config tracks the configuration of supported AWS resources and the relationships between them. A configuration recorder observes the selected resource types and creates configuration items when relevant state is recorded. These configuration items provide evidence of what a resource's configuration looked like, making Config useful for inventory, change history, governance queries and compliance evaluation.

This is different from CloudTrail. CloudTrail focuses on activity—an API call and the identity or service behind it. AWS Config focuses on resource state—what configuration exists and how it changes over time. In a real investigation the two often complement each other: Config can show that a security group changed, while CloudTrail can help identify the API activity that caused the change.

Config rules turn desired configuration into compliance evaluations

AWS Config rules describe desired configuration conditions and evaluate resources against them. AWS provides managed rules for common controls, and organizations can create custom rules when their governance requirement is more specific. Depending on the rule and configuration, evaluations can be driven by configuration changes, periodic evaluation or supported proactive evaluation. A compliance result tells you whether the resource meets the rule; it does not itself prove that the workload is secure in every other respect.

Conformance packs group multiple Config rules and remediation actions into a deployable governance unit. They are useful when an organization wants a reusable baseline—such as a set of security or operational checks—rather than deploying and tracking individual rules one by one. Remediation can connect noncompliance to automated corrective actions, frequently through Systems Manager Automation, but automated remediation should be designed carefully because changing a live resource can have application impact.

• Managed rules provide predefined checks; custom rules cover organization-specific requirements.
• A conformance pack bundles rules and remediation actions so a baseline can be deployed consistently.
• Recording scope should include the resource types that a rule needs in order to evaluate the intended configuration evidence.

Aggregators provide centralized read-only governance visibility

A configuration aggregator collects Config configuration and compliance data from authorized accounts and Regions into a central account and Region. This is valuable in a multi-account environment because central governance teams can query and review compliance without signing in to every workload account. Organization aggregators integrate with AWS Organizations, while individual-account aggregation requires the appropriate source authorizations.

An aggregator is a visibility mechanism, not a remote configuration channel. AWS documents the aggregated view as read-only with respect to the source accounts and Regions. It does not mean that creating a rule or changing a resource in the aggregator automatically changes the source environment. Central enforcement instead uses mechanisms designed for deployment or policy—such as organization Config rules/conformance packs, CloudFormation StackSets or Organizations controls.