Configuration management services (for example, AWS Config)

Can you explain what AWS Config is and how it helps with configuration management?

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With AWS Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines.

How does AWS Config differ from AWS CloudTrail?

AWS Config is focused on recording and assessing the configurations of AWS resources and maintaining a history of configuration changes over time. It primarily answers the “What is the configuration?” and “How has it changed over time?” for AWS resources. CloudTrail, on the other hand, is designed to record and enable governance, compliance, operational auditing, and risk auditing of your AWS account by logging all actions taken by a user, role, or an AWS service. CloudTrail answers the “Who did what?” and “When?”.

What is the role of AWS Config rules in configuration management?

AWS Config rules enable you to create rules that automatically check the configuration of AWS resources recorded by AWS Config. These rules help ensure that the resource configurations align with your company policies, best practices, or specific compliance requirements. Config rules can be either managed rules (predefined by AWS) or custom rules (defined by you using AWS Lambda).

In which scenario would you use AWS Config conformance packs?

AWS Config conformance packs are a collection of AWS Config rules and remediation actions that can be deployed as a single entity across an entire organization or selected accounts within an organization. They are used to manage configuration compliance of your resources at scale and are particularly useful when you need to enforce a common compliance framework across multiple accounts or regions, such as CIS AWS Foundations Benchmark or NIST compliance frameworks.

How can AWS Config help you achieve compliance with regulations such as the GDPR or HIPAA?

AWS Config helps achieve compliance with regulations like GDPR or HIPAA by providing a detailed record of the configuration of AWS resources and changes over time, along with compliance assessment results based on rules that align with regulatory requirements. AWS Config can help identify non-compliant resources, so you can take corrective action and maintain evidence of compliance for audit purposes.

How do you monitor changes to a specific resource, such as an S3 bucket, using AWS Config?

To monitor changes to a specific resource like an S3 bucket using AWS Config, you first need to ensure that AWS Config is recording changes for that resource (which is AWS Config’s default behavior). You can then create an AWS Config rule that triggers evaluations for changes to S3 buckets or subscribe to an S3 Bucket configuration change event through Amazon Simple Notification Service (SNS) or AWS Lambda to receive notifications and take action upon changes.

What permissions are needed for AWS Config to record and evaluate AWS resource configurations?

AWS Config requires permission to access resource configurations and changes. When you set up AWS Config, you must attach an IAM role with the necessary permissions for AWS Config to be able to discover resources, record their configurations, detect changes, and invoke rules for evaluation. This IAM role typically includes permissions to make describe and list API calls for all supported AWS resources.

Can you use AWS Config to track relationships between AWS resources?

Yes, AWS Config can track the relationships between AWS resources, which it refers to as resource relationships. For example, AWS Config can track that a specific EC2 instance is associated with an EBS volume or a security group. Tracking these relationships can help you assess the impact of changes across different resources and ensure that your resource configurations are in accordance with best practices.

What is the benefit of using AWS Config aggregators in a multi-account environment?

AWS Config aggregators consolidate the configuration and compliance data from multiple accounts and regions into a single account to provide a centralized view of your AWS environment. This is beneficial in a multi-account environment as it enables you to gather a comprehensive view of your resource configurations and compliance status across your entire organization, thus making governance and compliance efforts more manageable and streamlined.

Explain how AWS Config rules can be automatically remediated through the use of AWS Systems Manager Automation documents?

When AWS Config detects a resource that is non-compliant with a particular rule, it can trigger an automatic remediation action through the use of AWS Systems Manager Automation documents. These documents define remediation actions to be taken by Systems Manager to bring the resource back into compliance. You can associate these Automation documents with AWS Config rules during the rule setup or by editing them later, enabling automated corrective actions without manual intervention.

What types of resource configuration changes can AWS Config track, and are there any limitations to what it can record?

AWS Config can track changes to a wide range of AWS resource types, including instances, security groups, IAM roles, and many others. It records various configuration details like resource creation, modification, and deletion. However, there are limitations as to the extent of configuration details AWS Config captures for each resource type, and not all AWS resource types are supported. Users should consult the AWS Config documentation for details on supported resources and recorded data.

How are AWS Config snapshots different from AWS Config streams?

AWS Config snapshots are point-in-time captures of resource configurations across an AWS account. You can initiate snapshots on demand or deliver them on a periodic basis to an Amazon S3 bucket. AWS Config streams, on the other hand, deliver configuration changes as they occur, enabling near real-time awareness of changes in your AWS resources. Streams are useful for scenarios that require immediate response, while snapshots are well-suited for periodic reviews and backup purposes.