Amazon Web Service (AWS)

Config

Security

Config is a service that provides a comprehensive view of your AWS resource inventory, configuration history, and change notifications to enable security and governance. With AWS Config, you can assess, audit, and evaluate the configurations of your AWS resources. You can continuously monitor the configuration changes of your resources and receive notifications when changes occur, helping you to ensure compliance with internal policies and regulatory standards. AWS Config also provides a complete history of changes to your resources, so you can trace back the source of a change and understand how it impacted your environment. AWS Config supports multiple resource types, including EC2 instances, RDS databases, Lambda functions, and others, and it integrates with other AWS services such as Amazon S3, Amazon CloudWatch, and Amazon SNS to provide a centralized view of your AWS environment.

Costs

The cost of using Config depends on the number and type of AWS resources you are monitoring, the number of configuration items recorded, and the amount of data stored. For configuration recording, you are charged for the number of configuration items recorded and the number of configuration changes recorded. For data storage, you are charged for the amount of data stored in the AWS Config service.

Direct Cost

per Configuration Item recorded in a region

for the first 100,000 evaluations in a region

Indirect Cost

No items found.

Terraform Name

aws_config_configuration_recorder

Config

attributes:

The following arguments are supported:

name - (Optional) The name of the recorder. Defaults to default. Changing it recreates the resource.
role_arn - (Required) Amazon Resource Name (ARN) of the IAM role. Used to make read or write requests to the delivery channel and to describe the AWS resources associated with the account. See AWS Docs for more details.
recording_group - (Optional) Recording group - see below.

recording_group

all_supported - (Optional) Specifies whether AWS Config records configuration changes for every supported type of regional resource (which includes any new type that will become supported in the future). Conflicts with resource_types. Defaults to true.
include_global_resource_types - (Optional) Specifies whether AWS Config includes all supported types of global resources with the resources that it records. Requires all_supported = true. Conflicts with resource_types.
resource_types - (Optional) A list that specifies the types of AWS resources for which AWS Config records configuration changes (for example, AWS::EC2::Instance or AWS::CloudTrail::Trail). See relevant part of AWS Docs for available types. In order to use this attribute, all_supported must be set to false.

‍

Associating resources with a

Config

Resources do not "belong" to a

Config

Rather, one or more Security Groups are associated to a resource.

Create

Config

via Terraform:

The following HCL creates an AWS Config Configuration Recorder. Please note that this resource does not start the created recorder automatically.

Syntax:

resource "aws_config_configuration_recorder" "foo" {
name = "example"
role_arn = aws_iam_role.r.arn
}

resource "aws_iam_role" "r" {
name = "awsconfig-example"

assume_role_policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "config.amazonaws.com"
},
"Effect": "Allow",
"Sid": ""
}
]
}
POLICY
}

Create

Config

via CLI:

Parametres:

put-configuration-recorder
--configuration-recorder <value>
[--recording-group <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]

Example:

awsconfigservice put-configuration-recorder --configuration-recorder name=default,roleARN=arn:aws:iam::123456789012:role/config-role --recording-group allSupported=true,includeGlobalResourceTypes=true

‍

Best Practices for

Config

Categorized by Availability, Security & Compliance and Cost

No items found.

Explore all the rules our platform covers