AWS Config automatically audits resource configurations and stores change history, supporting the implementation of guardrails. This article introduces its features and examples of how TIS’s AWS security services can be used.
AWS Config is an event-driven auditing and evaluation service that automatically evaluates the configurations of EC2, VPC and other resources and can detect rule violations and notify administrators. A resource is evaluated as NON_COMPLIANT when its configuration changes, enabling the required actions to be taken. A key feature is that histories of resource creation, modification and deletion are also stored as snapshots.
One example of using Config is to record and track resource change history. Change history is stored in S3 and can be viewed and retrieved through the GUI or API/CLI. Software change history can also be recorded together with OS settings, updates and installation status.
The article explains that rules can be used to implement guardrails and automate the remediation of non-compliant resources. This includes evaluating compliance with managed rules, customising proprietary rules and using AWS Lambda to assess compliance with best practices.
TIS services supporting the use of AWS Config include AWS security presets and examples of cloud migration using AXION. The article also notes that TIS has obtained certifications recognising its advanced technical capabilities relating to AWS.