> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Config and Detective Work

> Explains AWS Config usage for continuous configuration monitoring, compliance automation, forensic change tracking, remediation patterns, aggregators, conformance packs, and integrations with CloudTrail, EventBridge, and Security Hub.

Welcome — this lesson explains AWS Config for configuration monitoring, compliance automation, and forensic-style detective work in monitoring and logging. You will learn what Config records, how it complements CloudTrail, and common integration and operational patterns for detection, remediation, and aggregated reporting.

CloudTrail tells you who did what (API activity and user identity). AWS Config answers what the current resource state is, how it changed over time, and whether it meets your compliance expectations. In short: AWS Config provides continuous configuration monitoring, automated compliance tracking, a change timeline, relationship mapping, and hooks for automated remediation.

![The slide titled "AWS Config and Detective Work" shows an AWS Certified DevOps Engineer badge and three use cases: Configuration Tracking, Compliance Automation, and Forensic Investigation. On the right it displays the AWS Config icon and lists capabilities like Continuous Monitoring, Automated Compliance Checks, Relationship Mapping, and Change Tracking.](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/AWS-Config-and-Detective-Work/aws-config-detective-use-cases.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=1c46870fada18ea12dff9ba38c46cb71)

Key distinction: think of Config as operational visibility and state tracking, and CloudTrail as accountability and activity auditing. Config keeps point-in-time snapshots and a timeline of resource configurations; CloudTrail records API calls (who, what, when). The services integrate tightly: CloudTrail can identify the IAM principal that made a change, and Config shows the before-and-after configuration for affected resources — enabling fast root-cause and impact analysis.

![A slide comparing AWS Config (configuration timeline) with AWS CloudTrail (activity logging). It lists each service’s features and examples—Config shows resource configuration history and compliance state, while CloudTrail records API/user actions and timestamps (e.g., open port 22 before deletion vs. user deleted security group at 2:15 AM).](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/AWS-Config-and-Detective-Work/aws-config-cloudtrail-comparison.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=f8089576a682bb9ff14b6b651a83b04b)

Feature comparison (quick reference)

| Feature | AWS Config | AWS CloudTrail |
| - | -: | -: |
| Primary function | Continuous configuration snapshots, timeline, and relationship mapping | Audit trail of API activity, who invoked what and when |
| Use cases | Compliance checks, change history, impact analysis, drift detection | Forensics, identity accountability, API-level audit records |
| Integration value | Shows resource before/after and resource relationships | Identifies IAM principal that executed the API action |
| Example output | `ConfigurationItem` with attributes, relationships, and snapshots | Event records with `eventName`, `userIdentity`, and timestamps |

For more, see the AWS docs: [AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/), [AWS CloudTrail](https://docs.aws.amazon.com/cloudtrail/latest/userguide/).

## Config Rules: automated compliance monitoring

Config Rules are the core mechanism for automated compliance checks. AWS offers many managed rules; you can also author custom rules (commonly implemented as Lambda functions or with AWS Lambda-backed custom checks). Rules support two evaluation modes:

* Change-triggered: evaluated when a tracked resource changes (fast detection; may cost more).
* Periodic: run on a schedule (lower cost; useful for stable resources).

Rule evaluation produces states such as COMPLIANT, NON\_COMPLIANT, NOT\_APPLICABLE, and INSUFFICIENT\_DATA. Select evaluation frequency and targets based on risk, detection latency requirements, and cost.

| Evaluation state | Meaning |
| - | - |
| COMPLIANT | Resource matches the rule's expected configuration |
| NON\_COMPLIANT | Resource deviates from the rule’s requirement |
| NOT\_APPLICABLE | Rule does not apply to the resource type or scope |
| INSUFFICIENT\_DATA | Not enough data to determine compliance |

![A slide titled "AWS Config Rules – Compliance Automation" showing four colored sections: Managed Rules, Custom Rules, Evaluation Triggers, and Compliance States. It notes 200+ pre-built rules, Lambda-based custom rules, change-triggered or periodic evaluations, and statuses like COMPLIANT, NON\_COMPLIANT, NOT\_APPLICABLE, and INSUFFICIENT\_DATA.](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/AWS-Config-and-Detective-Work/aws-config-rules-compliance-automation.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=6648cfa39f20059080297a0744774655)

## Conformance packs: multi-rule, shareable compliance

Conformance packs bundle multiple Config rules and remediation actions into a single, shareable package (CloudFormation-style templates). AWS provides pre-built packs for standards like HIPAA and FedRAMP. Deploy conformance packs across accounts in an AWS Organization from a central account to get aggregated scoring, centralized reporting, and exception management.

![A presentation slide titled "Conformance Packs – Multi-Rule Compliance" displaying three colorful panels: "AWS-Provided Packs," "Organization‑Wide Deployment," and "Aggregated Compliance." Each panel includes a brief description of the related capabilities (pre-built packs, deploy across accounts, centralized scoring/reporting).](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/AWS-Config-and-Detective-Work/conformance-packs-multi-rule-compliance.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=87c75a562593f28f4f52cccdd7a431ef)

Conformance pack findings can surface in Security Hub, enabling consolidated posture views across services and accounts. Using pre-built packs reduces operational overhead and accelerates compliance program adoption.

## Configuration history and relationship mapping

Config stores a detailed configuration history for each tracked resource: timestamps, actors, and before/after snapshots of the resource state. It records environment variables, IAM roles, VPC settings, and other supported attributes. Crucially, Config tracks resource relationships — for example, which EC2, RDS, or Lambda resources reference a security group — enabling impact analysis and blast-radius tracing during incident response.

![A slide titled "Configuration Timeline and Relationship Tracking" showing a four-step horizontal timeline numbered 1–4. Each step is labeled: Complete Configuration History, Point-in-Time History, Relationship Mapping, and Impact Analysis with brief descriptions underneath.](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/AWS-Config-and-Detective-Work/configuration-timeline-relationship-tracking.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=990194da9de0adf571c109654bf60177)

## Automated remediation patterns

When a rule detects non-compliance, Config can trigger automated remediation workflows. A common pattern:

1. Config emits a non-compliance event.
2. EventBridge routes the event to remediation targets.
3. Remediation executes via Systems Manager Automation, Lambda, or other services.
4. Notifications are sent via SNS or tickets are created in ITSM systems.

For low-risk fixes (e.g., adding tags), automatic remediation is often suitable. For destructive or high-impact fixes (e.g., resource deletion), require manual approvals or multi-step workflows.

Automatic remediation can be powerful but risky. Require approvals or manual gates for destructive actions and ensure adequate testing in non-production environments before deployment.

![A slide titled "Automated Remediation With AWS Config" showing a four-step workflow — Detection, Trigger, Remediation, Notification — with notes that a Config rule finds non‑compliant resources, EventBridge routes the event, SSM Automation applies fixes, and SNS sends alerts.](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/AWS-Config-and-Detective-Work/aws-config-automated-remediation-workflow.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=23db3ad777150292eb6dc5fd895d4d20)

AWS provides managed remediation actions for common fixes (enable S3/EBS encryption, remove overly permissive security group rules, disable unused IAM keys). When built-in actions are insufficient, build custom remediation with Lambda or Systems Manager Automation, include manual approval steps, and integrate with ticketing or third-party tools via EventBridge.

![A slide titled "Automated Remediation With AWS Config" that compares two columns: Managed Remediation Actions and Custom Remediation. Examples listed include enabling S3/EBS encryption, revoking permissive security group rules, deleting unused IAM keys, and using Lambda/SSM, manual approvals, or ticketing integration for custom workflows.](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/AWS-Config-and-Detective-Work/aws-config-managed-vs-custom-remediation.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=f09f4ae3777f8586313352041bb788a5)

## Aggregators: centralized multi-account, multi-region visibility

Config Aggregators provide centralized visibility across many accounts and regions. Deploy Config in each account/region, then create an aggregator in a central auditing or delegated account. The aggregator collects configuration and compliance data across accounts and regions and enables organization-wide dashboards, cross-account queries, and unified reporting. Cross-account IAM permissions are required so the aggregator can read data in member accounts.

![A presentation slide titled "Multi-Account and Multi-Region Aggregators" showing four colored feature boxes: Centralized Dashboard, Cross-Account Queries, Unified Compliance, and IAM Requirements. Each box includes a brief description about managing/searching across multiple accounts and regions, compliance scoring, and cross-account IAM access.](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/AWS-Config-and-Detective-Work/multi-account-multi-region-aggregators.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=eb3607824e7fb89532d937f66b7cbf74)

## Drift detection (IaC + Config)

When managing infrastructure as code, detect drift between deployed resources and the declared templates. Use CloudFormation drift detection to compare running resource state to the CloudFormation template; AWS Config complements this by recording resource configurations and surfacing historical changes. When drift is found, notify the owning team, trigger further inspection, or attempt automated reconciliation depending on policy and risk tolerance.

![A slide titled "Configuration Drift Detection Integration – How It Works" showing four numbered steps: Detection, Comparison, Identification, and Response. Each step has a short note explaining detecting CloudFormation changes, comparing to templates, identifying drift, and triggering automated responses.](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/AWS-Config-and-Detective-Work/cloudformation-drift-detection-workflow.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=26840aad3ad49cd58b0875196666c187)

## Common use cases

Typical scenarios where AWS Config adds value:

* Security auditing and evidence collection for regulatory compliance.
* Continuous compliance reporting and conformance-pack driven controls.
* Change tracking for change control processes and forensic investigations.
* Impact analysis via relationship mapping to understand blast radius.
* Cost optimization insights (discover unattached volumes, unused resources).

![A presentation slide titled "Common Config Detection – Use Cases" showing four colored use-case boxes: Security Audit, Compliance Reporting, Change Tracking, and Cost Optimization. Each box has a short description of the problems it addresses (e.g., exposed resources, regulatory evidence, forensic change investigation, and underutilized resources).](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/AWS-Config-and-Detective-Work/config-detection-use-cases.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=9f053a657615434a1ce18886f5ec5ae0)

## Integration patterns (exam and production relevance)

AWS Config commonly integrates with:

* CloudTrail — correlate API activity with configuration changes.
* EventBridge — route compliance events to remediation or orchestration.
* Systems Manager — execute Automation documents for remediation.
* Security Hub — aggregate posture and findings across services.
* AWS Organizations — centralize deployment and aggregators across accounts.

These patterns appear on certification exams and are practical in production environments.

![A presentation slide titled "Exam Integration Patterns" listing AWS Config integration examples (Config + CloudTrail, EventBridge, SSM, Security Hub, Organizations) with brief descriptions of each. Each row shows icons on the left, a grey label in the middle, and explanatory text on the right.](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/AWS-Config-and-Detective-Work/aws-config-integration-patterns-slide.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=6631badae35c66fcd17c41fdb6862732)

## Pricing considerations and optimization

Config pricing is based on recorded configuration items and rule evaluations. Continuous or frequent evaluations increase cost. Strategies to optimize include:

* Use conformance packs to standardize and reduce duplication.
* Tune evaluation frequency (use periodic for low-risk resources).
* Filter which resource types are recorded.
* Apply S3 lifecycle policies to archive or expire historic configuration snapshots.

Consider tracking only production-critical resources and using periodic evaluations for stable resources to reduce costs. Use S3 lifecycle policies for long-term retention of Config snapshots at lower cost.

![A presentation slide titled "Config Optimization Strategies" showing four colored boxes labeled "Use Conformance Packs," "Adjust Evaluation Frequency," "Resource Filtering," and "S3 Lifecycle Policies," each with a brief explanation beneath. It outlines ways to reduce cost and data volume by using conformance packs, tuning evaluation frequency, filtering resources, and applying S3 lifecycle policies.](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/AWS-Config-and-Detective-Work/config-optimization-conformance-frequency-filtering-s3.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=a240551538e7d3fe03d0c3ea15e5ef70)

Summary

This lesson covered AWS Config’s core capabilities, how it complements CloudTrail, common integration patterns (EventBridge, SSM, Security Hub, Organizations), remediation patterns (managed and custom), and operational considerations such as aggregation, drift detection, and cost optimization. Reinforce these concepts with hands-on demos and practice labs to prepare for certification and real-world incident response scenarios.

Further reading and references

* AWS Config Developer Guide: [https://docs.aws.amazon.com/config/latest/developerguide/](https://docs.aws.amazon.com/config/latest/developerguide/)
* AWS CloudTrail User Guide: [https://docs.aws.amazon.com/cloudtrail/latest/userguide/](https://docs.aws.amazon.com/cloudtrail/latest/userguide/)
* AWS Security Hub: [https://docs.aws.amazon.com/securityhub/latest/userguide/](https://docs.aws.amazon.com/securityhub/latest/userguide/)
* Amazon EventBridge: [https://docs.aws.amazon.com/eventbridge/latest/userguide/](https://docs.aws.amazon.com/eventbridge/latest/userguide/)
* AWS Systems Manager: [https://docs.aws.amazon.com/systems-manager/latest/userguide/](https://docs.aws.amazon.com/systems-manager/latest/userguide/)
* AWS CloudFormation drift detection: [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html)

> **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/15ed9473-60f4-466a-b7b2-3d9cb829e847/lesson/2c62aa67-0adb-4431-b1ac-1a6f008b8cff)**

> **[Practice Lab](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/15ed9473-60f4-466a-b7b2-3d9cb829e847/lesson/4825dad0-36ac-4e6a-ae7f-a6e28cc2c9a5)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.