AWS Config and Auto Remediation

Welcome back. This lesson explains AWS Config and automated remediation across single- and multi-account environments. We cover the governance lifecycle—monitor, assess, detect, remediate—plus rule types, remediation targets (SSM and Lambda), parameter mapping, multi-account deployment patterns, Security Hub integration, and common troubleshooting. We’ll follow the standard cycle: monitor → assess → detect → remediate. The diagram below shows the stages and the AWS services commonly used at each step.

A diagram titled "Automating Security Controls and Governance in AWS" showing a workflow of Assess, Detect, Monitor, and Remediate. It links AWS services like AWS Config, EventBridge, CloudWatch, AWS Security Hub, and AWS Systems Manager.

Manual security checks don’t scale. As your cloud estate grows to hundreds or thousands of resources you need automated inventory, continuous evaluation, centralized dashboards, and automatic remediation. The screenshot below illustrates a typical compliance summary that motivates automation.

A screenshot titled "Scenario: The Cloud Governance Challenge" showing an AWS Compliance Dashboard with a compliance summary gauge reading 24.75% resources in violation (199 resources) and other metrics like 804 resources monitored and counts of critical recommendations. The dashboard highlights account and resource compliance details.

What AWS Config provides

AWS Config is the inventory and configuration-tracking service. It:

Records configuration items (point-in-time snapshots) and configuration history.
Produces configuration streams and snapshots that can be delivered to Amazon S3, Amazon SNS, or aggregated across an Organization.
Evaluates resources using Config rules and initiates notifications or remediation when non-compliance is detected.

A diagram titled "AWS Config Fundamentals" showing the AWS Config workflow. It shows AWS CloudTrail feeding AWS Config's configuration recorder (items → history → configuration streams) which outputs to Amazon S3, Amazon SNS, and AWS Organizations.

A configuration item is a point-in-time capture of a resource’s configuration and relationships. Example YAML for a Config configuration item:

resourceType: AWS::EC2::Instance
resourceId: i-0abcd1234efgh5678
configuration:
  instanceType: t3.medium
  availabilityZone: us-east-1a
  tags:
    - key: Environment
      value: Prod
    - key: Dept
      value: Finance
  securityGroups:
    - sg-1234abcd
captureTime: 2025-05-04T14:30:00Z
relationships:
  vpc: vpc-0a1b2c3d4e5f6g7h
  elasticIp: eipalloc-12345678

Snapshots are useful for point-in-time inventory.
Streams deliver near-real-time notifications to other systems for event-driven workflows.

Config rules: managed vs custom

Config rules evaluate configuration items and return compliant/non-compliant results. They can trigger notifications and remediation.

A slide titled "AWS Config Rules" showing a side-by-side comparison table of AWS Managed Rules versus Custom Rules. It lists features (Definition, Customization, Maintenance, Use Case Examples, Deployment, Evaluation Speed, Conformance Packs) with brief descriptions for each.

Key differences:

Rule Type	When to use	Pros	Cons
AWS Managed Rules	Standard best-practice checks (e.g., encryption, MFA, logging)	Ready-made, maintained by AWS, quick to deploy	Less flexible for organization-specific policies
Custom Rules (Lambda)	Business-specific policies or checks not covered by managed rules	Fully customizable logic and parameters	You must implement, maintain, and secure the Lambda function

Conformance packs are collections of rules and remediation actions packaged as templates for deployment across accounts and OUs—useful for enforcing regulatory or organizational policies.

A slide titled "Managed Rules and Conformance Packs" showing an AWS Config conformance pack structure. A central "Conformance Pack" box branches into four colored boxes: Operational Best Practices, Security Best Practices, Service‑Specific Rules, and Regulatory Compliance.

Rule evaluations can be triggered by:

Configuration changes (real-time),
Periodic schedules,
Manual invocation.

Evaluation produces a compliant or non-compliant result and can optionally trigger automated remediation.

A simple flow diagram titled "AWS Config Rule Evaluation Rules" showing boxes for "Evaluation Trigger" (configuration changes, periodic, manual) leading to "Rule Evaluation" (scope, parameters, logic, remediation) and then to an "Evaluation Result" (compliant/non-compliant), with an optional remediation action.

Writing custom Config rule logic (Lambda example)

Custom rules are commonly implemented with a Lambda function that receives the configuration item and rule parameters, evaluates compliance, and returns an annotation and compliance type. Example Python Lambda function that enforces a required tag on EC2 instances:

# python
import json

def evaluate_compliance(configuration_item, rule_parameters):
    """
    Evaluate compliance for the given resource configuration.
    """
    tags = configuration_item.get('tags', [])
    required_tag_key = rule_parameters.get('RequiredTagKey', 'Environment')
    required_tag_value = rule_parameters.get('RequiredTagValue', 'Production')

    for tag in tags:
        if tag.get('key') == required_tag_key and tag.get('value') == required_tag_value:
            return {
                'compliance_type': 'COMPLIANT',
                'annotation': f"Resource has tag {required_tag_key}={required_tag_value}"
            }

    return {
        'compliance_type': 'NON_COMPLIANT',
        'annotation': f"Resource missing required tag {required_tag_key}={required_tag_value}"
    }

def lambda_handler(event, context):
    """
    Entry point for Lambda invoked by AWS Config.
    """
    invoking_event = json.loads(event.get('invokingEvent', '{}'))
    rule_parameters = json.loads(event.get('ruleParameters', '{}'))

    configuration_item = invoking_event.get('configurationItem', {})
    result = evaluate_compliance(configuration_item, rule_parameters)

    evaluation = {
        'ComplianceResourceType': configuration_item.get('resourceType'),
        'ComplianceResourceId': configuration_item.get('resourceId'),
        'ComplianceType': result['compliance_type'],
        'Annotation': result['annotation']
    }

    # In production, call boto3.configservice.put_evaluations(...) to report the evaluation
    print("Evaluation result:", evaluation)
    return evaluation

Remediation framework and parameter mapping

When a rule is non-compliant, the remediation framework maps resource attributes (e.g., ResourceId, SecurityGroupId, Region) into parameters for automation documents or Lambda code so the action operates on the correct resource.

A presentation slide titled "Remediations Framework" showing an AWS Config remediation process flow with boxes for Rule Evaluation (detect non-compliance), Remediation Action Triggered, Parameters Mapped from Resource, Remediation Action Execution and Validation, and Status Reporting. Arrows indicate the steps flow and a loop from status reporting back to rule evaluation.

Example parameter mapping (how Config maps resource details to Automation parameters):

A presentation slide titled "Remediations Framework" showing "AWS Config Remediation: Parameter Mapping Example." It displays a boxed list mapping ResourceId → AutomationParameter:InstanceId, SecurityGroupId → AutomationParameter:GroupID, and Region → AutomationParameter:Region.

Common remediation targets:

Target	Use cases
Systems Manager Automation (SSM)	Long-running remediation runbooks, patching, cross-account execution, pre-built SSM docs
Lambda	Custom quick actions that complete within Lambda timeout (max 15 minutes)
SNS / SQS	Notifications, human-in-the-loop workflows

A presentation slide titled "Systems Manager Automation for Remediation" with "Automation Document (SSM Doc)" at the top. The SSM Doc branches to four colored boxes: Pre-Built Remediation Docs, Custom Automation Docs, Approved Patch Management, and Cross-Account Execution.

SSM runbooks are preferred for long-running or multi-step workflows. Lambda is a good choice for simple, short-lived remediations. Lambda execution is logged to CloudWatch Logs and CloudTrail.

A diagram titled "Lambda-Based Custom Remediation" showing AWS Config, EventBridge, a Lambda function, and CloudWatch Logs. It illustrates AWS Config (and optional EventBridge) triggering a Lambda remediation function that updates target AWS resources and sends logs to CloudWatch.

Note: Lambda has execution limits (default timeout can be short; configurable up to 15 minutes). For remediations that might exceed the Lambda runtime, favor SSM Automation.

Multi-account governance and deployment

Multi-account governance usually uses AWS Organizations plus a Config Aggregator in a delegated admin account to consolidate configuration and compliance data from member accounts and regions. You must:

Enable AWS Organizations,
Designate a delegated admin aggregator account,
Configure a central S3 bucket with appropriate access for the aggregator,
Deploy recorders, delivery channels, and roles across accounts and regions (StackSets are commonly used).

A diagram titled "Multi-Account Governance" showing an AWS Organization at the top connected to three Member Accounts. Each member runs multi-region AWS Config and forwards configuration data to a central Aggregator Account (delegated admin/management).

Deployment pattern (common steps):

A slide titled "Multi-Account Governance" showing a vertical flowchart for organization-wide AWS Config deployment. It lists steps and prerequisites like creating a CloudFormation StackSet, selecting deployment targets, setting deployment options, and reviewing/deploying.

StackSets are frequently used to provision Config recorders, delivery channels, IAM roles, and SSM documents across many accounts and regions.

Events, EventBridge rules and automation

When Config detects compliance state changes it can publish events (SNS or EventBridge). Use EventBridge rules to route non-compliance events to remediation targets (Lambda, SSM, SNS, SQS, Step Functions). Example simplified Config event that can be a source to EventBridge:

{
  "source": "aws.config",
  "detail-type": "Config Rules Compliance Change",
  "detail": {
    "configRuleName": "example-config-rule",
    "complianceType": "NON_COMPLIANT"
  }
}

EventBridge rule example that matches NON_COMPLIANT detail and forwards to targets:

{
  "source": ["aws.config"],
  "detail-type": ["Config Rules Compliance Change"],
  "detail": {
    "complianceType": ["NON_COMPLIANT"]
  }
}

Security Hub integration

AWS Security Hub aggregates findings from GuardDuty, Inspector, Macie, Config, and other sources. It centralizes triage and enables automation via custom actions and EventBridge workflows.

Config can push findings into Security Hub.
Security Hub findings can be evaluated by Config rules or used to trigger remediations.
Use Security Hub to view aggregated compliance posture and prioritize remediation.

A Security Hub dashboard titled "Security Hub and Config Integration" showing a 75% compliance score, donut charts for findings by severity and resource type, a bar chart of top failing controls, and a list of recent config-based findings (e.g., MFA disabled, open security group).

Troubleshooting checklist

Common areas to verify when remediations fail:

Area	What to check
Permissions	Ensure Config and remediation roles have necessary IAM permissions (S3 access, `ssm:StartAutomationExecution`, `lambda:InvokeFunction`, `iam:PassRole`, etc.)
Recording settings	Confirm the recorder includes the expected resource types and regions
Remediation failures	Inspect CloudWatch Logs and CloudTrail for timeouts or AccessDenied errors
Aggregator configuration	Verify Aggregator includes all accounts and regions you expect
Cost and frequency	Continuous recording/evaluation increases cost—tune evaluation frequency to match risk tolerance

Example CloudWatch log showing a remediation permission error:

{
  "timestamp": "2025-05-09T12:34:56Z",
  "level": "ERROR",
  "message": "Remediation action failed",
  "configRuleName": "ec2-instance-managed-by-ssm",
  "resourceId": "i-0abcd1234efgh5678",
  "remediationAction": "AWS-ConfigureSSMAgent",
  "executionStep": "RunAutomationDocument",
  "errorType": "AccessDeniedException",
  "errorMessage": "User: arn:aws:iam::123456789012:role/ConfigRemediationRole is not authorized to perform: ssm:StartAutomationExecution"
}

Ensure remediation roles have the precise permissions required for each action (for example, ssm:StartAutomationExecution for SSM runbooks and iam:PassRole where needed). Follow least-privilege principles and test the role actions in a sandbox account first.

Be cautious with remediation frequency and continuous evaluations—overly aggressive automation can cause operational churn and cost. Use periodic evaluations or approval gates for higher-risk actions.

Summary and references

This covers the core concepts and architecture patterns for AWS Config and automated remediation across single-account and multi-account environments. For deeper configuration examples and automation documents, consult the official docs and use the patterns shown here to design safe, least-privilege remediations. Links and references

AWS Config documentation: https://docs.aws.amazon.com/config/
AWS Systems Manager Automation: https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-automation.html
AWS Lambda: https://docs.aws.amazon.com/lambda/
AWS Security Hub: https://docs.aws.amazon.com/securityhub/
AWS Organizations and Config Aggregator: https://docs.aws.amazon.com/organizations/ and https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html

Thanks for reading.

Introduction

Domain 1 - SDLC Automation

Domain 2 - Configuration Management and IaC

Domain 3 - Resilient Cloud Solutions

Domain 4 - Monitoring and Logging

Domain 5 - Incident and Event Response

Domain 6 - Security and Compliance

AWS Config and Auto Remediation

What AWS Config provides

Config rules: managed vs custom

Writing custom Config rule logic (Lambda example)

Remediation framework and parameter mapping

Multi-account governance and deployment

Events, EventBridge rules and automation

Security Hub integration

Troubleshooting checklist

Summary and references

Watch Video

​What AWS Config provides

​Config rules: managed vs custom

​Writing custom Config rule logic (Lambda example)

​Remediation framework and parameter mapping

​Multi-account governance and deployment

​Events, EventBridge rules and automation

​Security Hub integration

​Troubleshooting checklist

​Summary and references

Watch Video

What AWS Config provides

Config rules: managed vs custom

Writing custom Config rule logic (Lambda example)

Remediation framework and parameter mapping

Multi-account governance and deployment

Events, EventBridge rules and automation

Security Hub integration

Troubleshooting checklist

Summary and references