> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration Management in AWS

> Overview of AWS configuration management tools and practices for evolving auditing patching and maintaining running infrastructure using Systems Manager CloudFormation and AWS Config

Welcome. This lesson explains configuration management in AWS: the tools and approaches used to evolve and maintain running infrastructure. You’ll learn how teams tune, patch, install software, inspect and audit systems, upgrade components, and remediate drift after resources are provisioned.

A practical analogy: think of a car factory. The chassis and body are built first (provisioning). Post-production steps—installing infotainment, setting tire pressure, performing safety checks, fixing issues—prepare the car for delivery. In AWS terms, some services define the infrastructure blueprint, while others evolve and maintain running systems.

![An infographic titled "AWS Parallel" that maps car factory steps (building the car body, installing infotainment, setting tire pressure, performing safety checks, fixing post-production issues) to equivalent AWS Cloud tasks. It uses colorful icons and dashed boxes to show corresponding tools like CloudFormation, Systems Manager, and AWS Config.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/Configuration-Management-in-AWS/aws-parallel-car-factory-cloud-map.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=7f5bc24a095699578b7453c4e0b87b79)

## What we mean by configuration management

Configuration management focuses on keeping running systems in a desired state. Unlike immutable infrastructure (where you bake a new image and replace instances), this is mutable infrastructure—applying changes directly to live instances. Effective configuration management helps you:

* Ensure consistency across fleets
* Scale operations efficiently
* Automate repetitive and error-prone tasks
* Detect and remediate configuration drift
* Audit and enforce security and compliance

![A presentation slide titled "Need for Configuration Management Tools" showing a vertical list of benefits. Each item—Ensure consistency; Scale efficiently; Automate repetitive tasks; Detect and fix drift; Enhance security—is paired with a colorful circular icon.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/Configuration-Management-in-AWS/configuration-management-benefits-slide.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=cce485ff8e2d842cb72b9440da4c546a)

## Key services and concepts

Below is a concise mapping of the primary AWS services used for configuration management, provisioning, and compliance.

| Service | Primary role | Notes |
| - | - | - |
| AWS Systems Manager (SSM) | Manage and evolve running infrastructure | Centralized modern tool for patching, ad-hoc commands, state enforcement, parameter storage, and secure sessions. Works for EC2, on-prem, other-cloud VMs, IoT devices where the SSM Agent can run. |
| AWS CloudFormation | Infrastructure as Code (IaC) / provisioning | Template-based provisioning (YAML/JSON). Can run configuration scripts during stack creation/updates and integrate with SSM or third-party tools. |
| AWS Config | Auditing, drift detection, and continuous compliance | Records configuration snapshots, evaluates resources against rules, and can trigger automated remediation (e.g., Systems Manager Automation). |
| AWS OpsWorks | Legacy configuration-management option | Supported Chef/Puppet lifecycle hooks; largely superseded by Systems Manager. Not emphasized for modern workflows. |

## Systems Manager — the core configuration-management tool

AWS Systems Manager is a broad collection of capabilities for operating and maintaining fleets of instances and devices. It’s the primary service to learn for evolving running infrastructure.

Focus your study on these Systems Manager components: Patch Manager, State Manager, Run Command, Parameter Store, and Session Manager — they form the basis of configuration and operational control across fleets.

Important Systems Manager subservices:

| Feature | Purpose |
| - | - |
| Patch Manager | Automate OS and application patching across instances and windows. |
| State Manager | Define and enforce desired configuration states (configuration drift remediation). |
| Run Command | Execute ad-hoc scripts or commands across multiple instances safely and audibly. |
| Parameter Store | Centralized storage for configuration data and secure strings (distinct from Secrets Manager). |
| Session Manager | Secure, auditable shell or command access to instances without SSH or open inbound ports. |

Systems Manager also includes Inventory, Automation, Maintenance Windows, OpsCenter, Incident Manager, Application Manager, Change Manager, and more. These features allow you to manage infrastructure wherever the SSM Agent can run and reach AWS.

![An infographic titled "Systems Manager" showing icons for features like Inventory, Patch Manager, Parameter Store, OpsCenter, State Manager, Run Command, Incident Manager, Maintenance Windows, Change Calendar, Application Manager, Session Manager, and Change Manager. Arrows from the manager box point to targets on the right labeled Other Cloud Provider, AWS, Data Centers, and IoT Fleets.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/Configuration-Management-in-AWS/systems-manager-features-targets-infographic.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=bf556d27277d7984382adf128183b61e)

## Note on OpsWorks

AWS OpsWorks is a legacy option that provided Chef and Puppet integration. It’s useful as historical context, but Systems Manager has replaced most of its use cases and is the recommended path for current projects and exams.

![A presentation slide titled "AWS OpsWorks – Overview" with the AWS OpsWorks icon on the left. It lists features like configuration management using Chef and Puppet, automated server configuration/deployment, lifecycle hooks, and OS-level package/application management.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/Configuration-Management-in-AWS/aws-opsworks-overview-chef-puppet.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=68fbe94d123c7cdde6119c02ba587b75)

## CloudFormation and configuration tasks

AWS CloudFormation is the standard IaC/provisioning service. Use CloudFormation templates (YAML or JSON) to keep infrastructure definitions in version control and automate stack lifecycle. While primarily used for provisioning, CloudFormation can run configuration tasks during stack creation or updates by:

* Executing shell or PowerShell scripts via UserData or CloudInit
* Calling Systems Manager documents or Automation during/after provisioning
* Integrating third-party config tools (Chef, Puppet, Ansible)

CloudFormation typically lags by a short period when new AWS features are released, but once supported it reliably represents service capabilities.

![A diagram showing AWS CloudFormation on the left automating deployment into the AWS Cloud on the right. The AWS infrastructure box highlights services like AWS Lambda, Amazon S3, and Amazon EC2.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/Configuration-Management-in-AWS/cloudformation-deploy-aws-lambda-s3-ec2.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=0ad3bb2955af383d355e274a85567f32)

## AWS Config — detection, inventory, and compliance

AWS Config continuously records resource configurations, takes snapshots, and evaluates resources against managed or custom rules. Config is a detection and auditing service — it detects drift and non-compliance and can trigger automated remediation workflows (for example, invoking Systems Manager Automation documents).

Use AWS Config to:

* Maintain an inventory of AWS resources
* Continuously monitor configuration changes
* Receive notifications for configuration changes or rule violations
* Enforce and automate compliance with remediation actions

![A presentation slide for AWS Config with the AWS Config logo on the left. On the right are four colored icons listing features: keeps inventory of AWS resources, continuous monitoring of resource configuration, automatic notifications on resource changes, and enforces/evaluates compliance.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/Configuration-Management-in-AWS/aws-config-inventory-monitoring-notifications-compliance.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=e1b1d234f81f06d6e4a70a34d97e62be)

## Best practices for configuration management in AWS

* Use Infrastructure as Code (IaC) for provisioning and store templates in version control.
* Keep non-secret configuration data in source control or Parameter Store; use AWS Secrets Manager or Parameter Store SecureString for secrets.
* Automate provisioning, patching, compliance checks, and remediation wherever possible.
* Implement drift detection and automated remediation (AWS Config + Systems Manager Automation).
* Enforce least privilege with IAM for management actions and SSM access.
* Monitor and audit changes using AWS Config, AWS CloudTrail, and centralized logging/observability.

Systems Manager handles evolving running infrastructure. CloudFormation handles provisioning. AWS Config and CloudTrail provide the monitoring and auditing backbone to detect and investigate changes.

![A slide titled "Configuration Management Best Practices." It lists six practices: Use Infrastructure as Code (IaC); Keep configuration in source control; Automate everything; Implement drift detection; Enforce least privilege; and Monitor and audit changes.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/Configuration-Management-in-AWS/configuration-management-best-practices.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=2aa3603cc6773f743a6842669d498db2)

## Closing remarks

Configuration management ensures consistency, security, and compliance for running systems. For practical study and real-world work, focus on:

* Systems Manager (Patch Manager, State Manager, Run Command, Parameter Store, Session Manager)
* CloudFormation (templates and provisioning workflows)
* AWS Config (continuous monitoring, recording, and remediation triggers)

Remember: AWS services evolve. Concepts—provisioning with IaC, maintaining running systems, detecting drift, and automating remediation—remain stable, but specific service names and exam coverage may change over time.

## Links and references

* [AWS Systems Manager](https://docs.aws.amazon.com/systems-manager/)
* [AWS CloudFormation](https://docs.aws.amazon.com/cloudformation/)
* [AWS Config](https://docs.aws.amazon.com/config/)
* [AWS Best Practices for Security, Identity, & Compliance](https://aws.amazon.com/solutions/security/)

> **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/42510d3c-bacc-4a37-adb8-2cfea86f1a36/lesson/7ce320cd-96ce-4c22-b521-f5bc7951d166)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.