CloudWiki
Resource
Detect, troubleshoot & optimize AWS environments in real-time ->

Amazon Web Service (AWS)

Config

Security
Config is a service that provides a comprehensive view of your AWS resource inventory, configuration history, and change notifications to enable security and governance. With AWS Config, you can assess, audit, and evaluate the configurations of your AWS resources. You can continuously monitor the configuration changes of your resources and receive notifications when changes occur, helping you to ensure compliance with internal policies and regulatory standards. AWS Config also provides a complete history of changes to your resources, so you can trace back the source of a change and understand how it impacted your environment. AWS Config supports multiple resource types, including EC2 instances, RDS databases, Lambda functions, and others, and it integrates with other AWS services such as Amazon S3, Amazon CloudWatch, and Amazon SNS to provide a centralized view of your AWS environment.
Costs
The cost of using Config depends on the number and type of AWS resources you are monitoring, the number of configuration items recorded, and the amount of data stored. For configuration recording, you are charged for the number of configuration items recorded and the number of configuration changes recorded. For data storage, you are charged for the amount of data stored in the AWS Config service.
Direct Cost

per Configuration Item recorded in a region

for the first 100,000 evaluations in a region

Indirect Cost
No items found.
Terraform Name
aws_config_configuration_recorder
Config
attributes:

The following arguments are supported:

  • name - (Optional) The name of the recorder. Defaults to default. Changing it recreates the resource.
  • role_arn - (Required) Amazon Resource Name (ARN) of the IAM role. Used to make read or write requests to the delivery channel and to describe the AWS resources associated with the account. See AWS Docs for more details.
  • recording_group - (Optional) Recording group - see below.

recording_group

  • all_supported - (Optional) Specifies whether AWS Config records configuration changes for every supported type of regional resource (which includes any new type that will become supported in the future). Conflicts with resource_types. Defaults to true.
  • include_global_resource_types - (Optional) Specifies whether AWS Config includes all supported types of global resources with the resources that it records. Requires all_supported = true. Conflicts with resource_types.
  • resource_types - (Optional) A list that specifies the types of AWS resources for which AWS Config records configuration changes (for example, AWS::EC2::Instance or AWS::CloudTrail::Trail). See relevant part of AWS Docs for available types. In order to use this attribute, all_supported must be set to false.

Associating resources with a
Config
Resources do not "belong" to a
Config
Rather, one or more Security Groups are associated to a resource.
Create
Config
via Terraform:
The following HCL creates an AWS Config Configuration Recorder. Please note that this resource does not start the created recorder automatically.
Syntax:

resource "aws_config_configuration_recorder" "foo" {
 name     = "example"
 role_arn = aws_iam_role.r.arn
}

resource "aws_iam_role" "r" {
 name = "awsconfig-example"

 assume_role_policy = <<POLICY
{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Action": "sts:AssumeRole",
     "Principal": {
       "Service": "config.amazonaws.com"
     },
     "Effect": "Allow",
     "Sid": ""
   }
 ]
}
POLICY
}

Create
Config
via CLI:
Parametres:

put-configuration-recorder
--configuration-recorder <value>
[--recording-group <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]

Example:

awsconfigservice put-configuration-recorder --configuration-recorder name=default,roleARN=arn:aws:iam::123456789012:role/config-role --recording-group allSupported=true,includeGlobalResourceTypes=true

Best Practices for
Config

Categorized by Availability, Security & Compliance and Cost

No items found.
Explore all the rules our platform covers
Related blog posts
All Resources