Management Tools | AWS Config

Question 1

What is AWS Config?

General

AWS Config | Management Tools

Answer 1

AWS Config is a fully managed service that provides you with an AWS resource inventory, configuration history, and configuration change notifications to enable security and governance. With AWS Config you can discover existing AWS resources, export a complete inventory of your AWS resources with all configuration details, and determine how a resource was configured at any point in time. These capabilities enable compliance auditing, security analysis, resource change tracking, and troubleshooting.

Question 2

What is a Config Rule?

General

AWS Config | Management Tools

Answer 2

A Config Rule represents desired configurations for a resource and is evaluated against configuration changes on the relevant resources, as recorded by AWS Config. The results of evaluating a rule against the configuration of a resource are available on a dashboard. Using Config Rules, you can assess your overall compliance and risk status from a configuration perspective, view compliance trends over time and pinpoint which configuration change caused a resource to drift out of compliance with a rule.

Question 3

What are the benefits of AWS Config?

General

AWS Config | Management Tools

Answer 3

AWS Config makes it easy to track your resource’s configuration without the need for up-front investments and avoiding the complexity of installing and updating agents for data collection or maintaining large databases. Once you enable AWS Config, you can view continuously updated details of all configuration attributes associated with AWS resources. You are notified via Amazon Simple Notification Service (SNS) of every configuration change.

Question 4

How can AWS Config help with audits?

General

AWS Config | Management Tools

Answer 4

AWS Config gives you access to resource configuration history. You can relate configuration changes with AWS CloudTrail events that possibly contributed to the change in configuration. This information provides you full visibility, right from details, such as “Who made the change?”, “From what IP address?” to the effect of this change on AWS resources and related resources. You can use this information to generate reports to aid auditing and assessing compliance over a period of time.

Question 5

Who should use AWS Config and Config Rules?

General

AWS Config | Management Tools

Answer 5

Any AWS customer looking to improve their security and governance posture on AWS by continuously evaluating the configuration of their resources would benefit from this capability. Administrators within larger organizations who recommend best practices for configuring resources can codify these rules as Config Rules, and enable self-governance among users. Information Security experts who monitor usage activity and configurations to detect vulnerabilities can benefit from Config Rules. Customers with workloads that need to comply with specific standards (e.g. PCI-DSS or HIPAA) can use this capability to assess compliance of their AWS infrastructure configurations, and generate reports for their auditors. Operators who manage large AWS infrastructure or components that change frequently can also benefit from Config Rules for troubleshooting.Customers who want to track changes to resources configuration, answer questions about resource configurations, demonstrate compliance, troubleshoot or perform security analysis should turn on AWS Config.

Question 6

Does the service guarantee that my configurations are never out of compliance?

General

AWS Config | Management Tools

Answer 6

Config Rules provides information about whether your resources are compliant with configuration rules you specify. It will evaluate rules as soon as updated Configuration Items (CIs) for the resource are available within AWS Config. It does not guarantee that resources will be compliant or prevent users from taking non-compliant actions. Further, Config Rules does not automatically snap non-compliant resources back into compliance.

Question 7

Does the service prevent users from taking non-compliant actions?

General

AWS Config | Management Tools

Answer 7

Config Rules does not directly affect how end-users consume AWS. It evaluates resource configurations only after a configuration change has been completed and recorded by AWS Config. Config Rules does not prevent the user from making changes that could be non-compliant. To control what a user can provision on AWS and configuration parameters allowed during provisioning, please use AWS Identity and Access Management (IAM) Policies and AWS Service Catalog respectively.

Question 8

Can rules be evaluated prior to provisioning a resource?

General

AWS Config | Management Tools

Answer 8

Config Rules evaluates rules after the Configuration Item (CI) for the resource is captured by AWS Config. It does not evaluate rules prior to provisioning a resource or prior to making configuration changes on the resource.

Question 9

How does AWS Config work with AWS CloudTrail?

Getting Started

AWS Config | Management Tools

Answer 9

AWS CloudTrail records user API activity on your account and allows you to access information about this activity. You get full details about API actions, such as identity of the caller, the time of the API call, the request parameters, and the response elements returned by the AWS service. AWS Config records point-in-time configuration details for your AWS resources as Configuration Items (CIs). You can use a CI to answer “What did my AWS resource look like?” at a point in time. You can use AWS CloudTrail to answer “Who made an API call to modify this resource?” For example, you can use the AWS Management Console for AWS Config to detect security group “Production-DB” was incorrectly configured in the past. Using the integrated AWS CloudTrail information, you can pinpoint which user misconfigured “Production-DB” security group.

Question 10

How do I get started with this service?

Getting Started

AWS Config | Management Tools

Answer 10

The quickest way to get started with AWS Config is to use the AWS Management Console. You can turn on AWS Config in a few clicks. For additional details, see the Getting Started documentation.

Question 11

How do I access my resources’ configuration?

Getting Started

AWS Config | Management Tools

Answer 11

You can lookup current and historical resource configuration using the AWS Management Console, AWS Command Line Interface or SDKs.

For additional details, please refer to AWS Config documentation.

Question 12

Do I turn on AWS Config regionally or globally?

Getting Started

AWS Config | Management Tools

Answer 12

You turn on AWS Config on a per-region basis for your account.

Question 13

Can AWS Config aggregate data across different AWS accounts?

Getting Started

AWS Config | Management Tools

Answer 13

Yes, you can set up AWS Config to deliver configuration updates from different accounts to one S3 bucket, once the appropriate IAM policies are applied to the S3 bucket. You can also publish notifications to the one SNS Topic, within the same region, once appropriate IAM policies are applied to the SNS Topic.

Question 14

Is API activity on AWS Config itself logged by AWS CloudTrail?

Getting Started

AWS Config | Management Tools

Answer 14

Yes. All AWS Config API activity, including use of AWS Config APIs to read configuration data, is logged by AWS CloudTrail.

Question 15

What time and timezones are displayed in the timeline view of a resource? What about daylight savings?

Config Rules

AWS Config | Management Tools

Answer 15

AWS Config displays the time at which Configuration Items (CIs) were recorded for a resource on a timeline. All times are captured in Coordinated Universal Time (UTC). When the timeline is visualized on the management console, the services uses the current time zone (adjusted for daylight savings, if relevant) to display all times in the timeline view.

Question 16

What is a resource’s configuration?

Config Rules

AWS Config | Management Tools

Answer 16

Configuration of a resource is defined by the data included in the Configuration Item (CI) of AWS Config. The initial release of Config Rules makes the CI for a resource available to relevant rules. Config Rules can use this information along with any other relevant information such as other attached resource, business hours, etc. to evaluate compliance of a resource’s configuration.

Question 17

What is a rule?

Config Rules

AWS Config | Management Tools

Answer 17

A rule represents desired Configuration Item (CI) attribute values for resources and are evaluated by comparing those attribute values with CIs recorded by AWS Config. There are two types of rules:

AWS managed rules: AWS managed rules are pre-built and managed by AWS. You simply choose the rule you want to enable, then supply a few configuration parameters to get started. Learn more »

Customer managed rules: Customer managed rules are custom rules, defined and built by you. You can create a function in AWS Lambda that can be invoked as part of a custom rule and these functions execute in your account. Learn more »

The quickest way to get started with AWS Config is to use the AWS Management Console. You can turn on AWS Config in a few clicks. For additional details, see the Getting Started documentation.

Question 18

How are rules created?

Config Rules

AWS Config | Management Tools

Answer 18

Rules are typically set up by the AWS account administrator. They can be created by leveraging AWS managed rules – a predefined set of rules provided by AWS or through customer managed rules. With AWS managed rules updates to the rule are automatically applied to any account using that rule. In the customer-managed model, the customer has a full copy of the rule, and executes the rule within his/her own account. These rules are maintained by the customer.

Question 19

How many rules can I create?

Config Rules

AWS Config | Management Tools

Answer 19

You can create up to 50 rules in your AWS account by default. Additionally, you can request an increase for the limit on the number of rules in your account by visiting the AWS Service Limits page.

Question 20

How are rules evaluated?

Config Rules

AWS Config | Management Tools

Answer 20

Any rule can be setup as a change-triggered rule or as a periodic rule. A change-triggered rule is executed when AWS Config records a configuration change for any of the resources specified. Additionally, one of the following must be specified:

Tag Key:(optional Value): A tag key:value implies any configuration changes recorded for resources with the specified tag key:value will trigger an evaluation of the rule.

Resource type(s): Any configuration changes recorded for any resource within the specified resource type(s) will trigger an evaluation the rule.

Resource ID: Any changes recorded to the resource specified by the resource type and resource ID will trigger an evaluation of the rule.

A periodic rule is triggered at a specified frequency. Available frequencies are 1hr, 3hr, 6hr, 12hr or 24hrs. A periodic rule has a full snapshot of current Configuration Items (CIs) for all resources available to the rule.

Question 21

What is an evaluation?

Config Rules

AWS Config | Management Tools

Answer 21

Evaluation of a rule determines whether a rule is compliant with a resource at a particular point in time. It is the result of evaluating a rule against the configuration of a resource. Config Rules will capture and store the result of each evaluation. This result will include the resource, rule, time of evaluation and a link to Configuration Item (CI) that caused non-compliance.

Question 22

What does compliance mean?

Config Rules

AWS Config | Management Tools

Answer 22

A resource is compliant if complies with all rules that apply to it. Otherwise it is noncompliant. Similarly, a rule is compliant if all resources evaluated by the rule comply with the rule. Otherwise it is noncompliant. In some cases, such as when inadequate permissions are available to the rule, an evaluation may not exist for the resource, leading to a state of insufficient data. This state is excluded from determining the compliance status of a resource or rule.

Question 23

What information does the Config Rules dashboard provide?

Services and Region Support

AWS Config | Management Tools

Answer 23

The Config Rules dashboard gives you an overview of resources tracked by AWS Config, and a summary of current compliance by resource and by rule. When you view compliance by resource, you can determine if any rule that applies to the resource is currently not compliant. You can view compliance by rule, which tells you if any resource under the purview of the rule is currently non-compliant. Using these summary views, you can dive deeper into the Config timeline view of resources, to determine which configuration parameters changed. Using this dashboard, you can start with an overview and drill into fine-grained views that give you full information about changes in compliance status, and which changes caused non-compliance.

Question 24

What AWS resources types are covered by AWS Config?

Services and Region Support

AWS Config | Management Tools

Answer 24

Review our documentation for a complete list of supported resource types.

Question 25

What regions is AWS Config available in?

Resource Configuration

AWS Config | Management Tools

Answer 25

For details on the regions where AWS Config is available, please visit this page:

http://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/

Question 26

What is a configuration item?

Resource Configuration

AWS Config | Management Tools

Answer 26

A Configuration Item (CI) is the configuration of a resource at a given point-in-time. A CI consists of 5 sections:

Basic information about the resource that is common across different resource types (e.g., Amazon Resource Names, tags),

Configuration data specific to the resource (e.g., EC2 instance type),

Map of relationships with other resources (e.g., EC2::Volume vol-3434df43 is “attached to instance” EC2 Instance i-3432ee3a),

AWS CloudTrail event IDs that are related to this state,

Metadata that helps you identify information about the CI, such as the version of this CI, and when this CI was captured.

Learn more about configuration items

Question 27

What are AWS Config relationships and how are they used?

Resource Configuration

AWS Config | Management Tools

Answer 27

AWS Config takes the relationships among resources into account when recording changes. For example, if a new Amazon EC2 Security Group is associated with an Amazon EC2 Instance, AWS Config records the updated configurations of both the primary resource, the Amazon EC2 Security Group, and related resources, such as the Amazon EC2 Instance, if these resources actually changed.

Question 28

Does AWS Config record every state a resource has been in?

Resource Configuration

AWS Config | Management Tools

Answer 28

AWS Config detects change to resource’s configuration and records the configuration state that resulted from that change. In cases where several configuration changes are made to a resource in quick succession (e.g. within a span of few minutes), Config will only record the latest configuration of that resource that represents cumulative impact of the set of changes. In these situations, Config will only list the latest change in the relatedEvents field of the Configuration Item.This allows users and programs to continue to change infrastructure configurations without having to wait for Config to record intermediate transient states.

Question 29

Does AWS Config record configuration changes that did not result from API activity on that resource?

Resource Configuration

AWS Config | Management Tools

Answer 29

Yes, AWS Config will regularly scan configuration of resources for changes that haven’t yet been recorded and record these changes. CIs recorded from these scans will not have a relatedEvent field in the payload, and only the latest state that is different from state already recorded is picked up.

Question 30

Does AWS Config record configuration changes to software within EC2 instances?

Resource Configuration

AWS Config | Management Tools

Answer 30

Yes. AWS Config enables you to record configuration changes to software within EC2 instances in your AWS account and also virtual machines (VMs), or servers in your on-premises environment. The configuration information recorded by AWS Config includes Operating System updates, network configuration, installed applications, etc. You can evaluate whether your instances, VMs, and servers are in compliance with your guidelines using AWS Config Rules. The deep visibility and continuous monitoring capabilities provided by AWS Config allow you to assess compliance and troubleshoot operational issues.

Question 31

Does AWS Config continue to send notifications if a resource that was previously non-compliant is still non-compliant after a periodic rule evaluation? AWS Config sends notifications only when the compliance status changes. If a resource was previously non-compliant and is still non-compliant, Config will not send a new notification. If the compliance status changes to “compliant”, you will receive a notification for the change in status.

Resource Configuration

AWS Config | Management Tools

Question 32

Can I flag or exempt resources from being evaluated by Config rules? When you configure Config rules, you can specify whether your rule runs evaluations against specified resource types or resources with a specific tag.

Pricing

AWS Config | Management Tools

Question 33

How will I be charged for this service?

Pricing

AWS Config | Management Tools

Answer 33

With AWS Config, you are charged based on the number Configuration Items (CIs) recorded for supported resources in your AWS account. You are charged only once for recording the CI. There no additional fee for retaining the CI or any up-front commitment. You can stop recording CIs at any time and continue to access the CIs previously recorded. Charges per CI are rolled up into your monthly bill. See pricing details.

If you are using AWS Config Rules, you will be charged based on active Config Rules in that month. When a rule is compared with an AWS resource, the result is recorded as an evaluation. An rule is active if it has one or more evaluations in a month.

Configuration snapshots and configuration history files are delivered to you in the Amazon S3 bucket that you choose, and configuration change notifications are delivered via Amazon Simple Notification Service (SNS). Standard rates for Amazon S3 and Amazon SNS apply. Customer managed rules are authored using AWS Lambda. Standard rates for AWS Lambda apply.

Question 34

Does the pricing for Config Rules include the costs for AWS Lambda functions?

Pricing

AWS Config | Management Tools

Answer 34

You can choose from a set of managed rules provided by AWS or you can author your own rules, written as AWS Lambda functions. Managed rules are fully managed and maintained by AWS and you do not pay any additional AWS Lambda charges to run them. Simply enable managed rules, provide any required parameters, and pay a single rate for each AWS Config rule. On the other hand, customer managed rules give you full control by executing these rules as AWS Lambda functions in your account. In addition to monthly charges for an active rule, standard AWS Lambda free tier and function execution rates apply to customer managed rules.

Question 35

What does shared quota for Config Rules mean?

Pricing

AWS Config | Management Tools

Answer 35

You receive a quota 20,000 evaluations per active rule per month. For example, if you have 3 Config Rules, you get a quota of 60,000 evaluations for the account. You can choose spread this allowance across the rules in any way.

Question 36

Do unused evaluations carry over to the next month?

Pricing

AWS Config | Management Tools

Answer 36

Unused evaluations expire and are reset every billing cycle.

Question 37

Can you provide breakdown of charges using an example?

Partner Solutions

AWS Config | Management Tools

Answer 37

Pricing example 1:

AWS Config records each AWS resource and configuration change as a Configuration Item (CI). Assume you record 7,000 CIs/month and have created 5 active rules (2 periodic and 3 change triggered), reporting a combined total of 150 evaluations per day.

AWS Config costs: 7,000 * $0.003 = $21.00

Cost for 5 active rules = 5 * $2.00 = $10.00

Quota for evaluation results = 5 * 20,000 = 100,000

Number of evaluation results used = 150 evaluations * 30 days = 4,500 evaluations/month

Additional charges from evaluation results = $0.0

Total AWS Config monthly charges = $31.00

The service charges you incur depend on the number of CIs recoded by your resources. This depends on the number of resources in your account, and the configuration changes you make to these resources. For an account with several hundred resources, and standard configuration change activity, AWS Config would capture fewer than 3,000 CIs per month, or less than $9 per month.

Pricing Example 2:

Assume you record 50,000 CIs/month and have created 2 active rules, and each of these is evaluated on every CI and report a result results each time.

AWS Config costs: 50,000 * $0.003 = $150.00

Cost for 2 active rules = 2 * $2.00 = $4.00

Quota for evaluation results = 2 * 20,000 = 40,000

Number of evaluation results used = 2 * 50,000 = 100,000

Additional charges from evaluation results = (100,000 – 40,000) = 60,000 * 0.0001 = $6.00

Total AWS Config monthly charges = $150.00 + $4.00+ $6.00 = $160.00