> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Config and Auto Remediation

> Overview of AWS Config, compliance evaluation and automated remediation across single and multi account environments using SSM, Lambda, EventBridge, and Security Hub.

Welcome back. This lesson explains AWS Config and automated remediation across single- and multi-account environments. We cover the governance lifecycle—monitor, assess, detect, remediate—plus rule types, remediation targets (SSM and Lambda), parameter mapping, multi-account deployment patterns, Security Hub integration, and common troubleshooting.

We’ll follow the standard cycle: monitor → assess → detect → remediate. The diagram below shows the stages and the AWS services commonly used at each step.

![A diagram titled "Automating Security Controls and Governance in AWS" showing a workflow of Assess, Detect, Monitor, and Remediate. It links AWS services like AWS Config, EventBridge, CloudWatch, AWS Security Hub, and AWS Systems Manager.](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/AWS-Config-and-Auto-Remediation/aws-security-controls-governance-workflow.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=d78a0d5ae7255c82d3c85c5ceece75dc)

Manual security checks don’t scale. As your cloud estate grows to hundreds or thousands of resources you need automated inventory, continuous evaluation, centralized dashboards, and automatic remediation. The screenshot below illustrates a typical compliance summary that motivates automation.

![A screenshot titled "Scenario: The Cloud Governance Challenge" showing an AWS Compliance Dashboard with a compliance summary gauge reading 24.75% resources in violation (199 resources) and other metrics like 804 resources monitored and counts of critical recommendations. The dashboard highlights account and resource compliance details.](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/AWS-Config-and-Auto-Remediation/cloud-governance-aws-compliance-dashboard-24-75.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=c872a3faa4928ebd3927ef179d1ee560)

## What AWS Config provides

AWS Config is the inventory and configuration-tracking service. It:

* Records configuration items (point-in-time snapshots) and configuration history.
* Produces configuration streams and snapshots that can be delivered to Amazon S3, Amazon SNS, or aggregated across an Organization.
* Evaluates resources using Config rules and initiates notifications or remediation when non-compliance is detected.

![A diagram titled "AWS Config Fundamentals" showing the AWS Config workflow. It shows AWS CloudTrail feeding AWS Config's configuration recorder (items → history → configuration streams) which outputs to Amazon S3, Amazon SNS, and AWS Organizations.](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/AWS-Config-and-Auto-Remediation/aws-config-fundamentals-workflow.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=263d65f05e148a9e31a226e6e588d0ce)

A configuration item is a point-in-time capture of a resource’s configuration and relationships. Example YAML for a Config configuration item:

```yaml theme={null}
resourceType: AWS::EC2::Instance
resourceId: i-0abcd1234efgh5678
configuration:
  instanceType: t3.medium
  availabilityZone: us-east-1a
  tags:
    - key: Environment
      value: Prod
    - key: Dept
      value: Finance
  securityGroups:
    - sg-1234abcd
captureTime: 2025-05-04T14:30:00Z
relationships:
  vpc: vpc-0a1b2c3d4e5f6g7h
  elasticIp: eipalloc-12345678
```

* Snapshots are useful for point-in-time inventory.
* Streams deliver near-real-time notifications to other systems for event-driven workflows.

## Config rules: managed vs custom

Config rules evaluate configuration items and return compliant/non-compliant results. They can trigger notifications and remediation.

![A slide titled "AWS Config Rules" showing a side-by-side comparison table of AWS Managed Rules versus Custom Rules. It lists features (Definition, Customization, Maintenance, Use Case Examples, Deployment, Evaluation Speed, Conformance Packs) with brief descriptions for each.](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/AWS-Config-and-Auto-Remediation/aws-config-rules-managed-vs-custom.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=0cbbc73bca9828031e572018cfd8e81d)

Key differences:

| Rule Type | When to use | Pros | Cons |
| - | - | - | - |
| AWS Managed Rules | Standard best-practice checks (e.g., encryption, MFA, logging) | Ready-made, maintained by AWS, quick to deploy | Less flexible for organization-specific policies |
| Custom Rules (Lambda) | Business-specific policies or checks not covered by managed rules | Fully customizable logic and parameters | You must implement, maintain, and secure the Lambda function |

Conformance packs are collections of rules and remediation actions packaged as templates for deployment across accounts and OUs—useful for enforcing regulatory or organizational policies.

![A slide titled "Managed Rules and Conformance Packs" showing an AWS Config conformance pack structure. A central "Conformance Pack" box branches into four colored boxes: Operational Best Practices, Security Best Practices, Service‑Specific Rules, and Regulatory Compliance.](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/AWS-Config-and-Auto-Remediation/aws-config-conformance-pack-managed-rules.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=6ebd949cd6f1d0825ab308aaf197faab)

Rule evaluations can be triggered by:

* Configuration changes (real-time),
* Periodic schedules,
* Manual invocation.

Evaluation produces a compliant or non-compliant result and can optionally trigger automated remediation.

![A simple flow diagram titled "AWS Config Rule Evaluation Rules" showing boxes for "Evaluation Trigger" (configuration changes, periodic, manual) leading to "Rule Evaluation" (scope, parameters, logic, remediation) and then to an "Evaluation Result" (compliant/non-compliant), with an optional remediation action.](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/AWS-Config-and-Auto-Remediation/aws-config-rule-evaluation-flow.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=2cce450f4ee5de83ee301642d4c8aac4)

## Writing custom Config rule logic (Lambda example)

Custom rules are commonly implemented with a Lambda function that receives the configuration item and rule parameters, evaluates compliance, and returns an annotation and compliance type.

Example Python Lambda function that enforces a required tag on EC2 instances:

```python theme={null}
# python
import json

def evaluate_compliance(configuration_item, rule_parameters):
    """
    Evaluate compliance for the given resource configuration.
    """
    tags = configuration_item.get('tags', [])
    required_tag_key = rule_parameters.get('RequiredTagKey', 'Environment')
    required_tag_value = rule_parameters.get('RequiredTagValue', 'Production')

    for tag in tags:
        if tag.get('key') == required_tag_key and tag.get('value') == required_tag_value:
            return {
                'compliance_type': 'COMPLIANT',
                'annotation': f"Resource has tag {required_tag_key}={required_tag_value}"
            }

    return {
        'compliance_type': 'NON_COMPLIANT',
        'annotation': f"Resource missing required tag {required_tag_key}={required_tag_value}"
    }

def lambda_handler(event, context):
    """
    Entry point for Lambda invoked by AWS Config.
    """
    invoking_event = json.loads(event.get('invokingEvent', '{}'))
    rule_parameters = json.loads(event.get('ruleParameters', '{}'))

    configuration_item = invoking_event.get('configurationItem', {})
    result = evaluate_compliance(configuration_item, rule_parameters)

    evaluation = {
        'ComplianceResourceType': configuration_item.get('resourceType'),
        'ComplianceResourceId': configuration_item.get('resourceId'),
        'ComplianceType': result['compliance_type'],
        'Annotation': result['annotation']
    }

    # In production, call boto3.configservice.put_evaluations(...) to report the evaluation
    print("Evaluation result:", evaluation)
    return evaluation
```

## Remediation framework and parameter mapping

When a rule is non-compliant, the remediation framework maps resource attributes (e.g., ResourceId, SecurityGroupId, Region) into parameters for automation documents or Lambda code so the action operates on the correct resource.

![A presentation slide titled "Remediations Framework" showing an AWS Config remediation process flow with boxes for Rule Evaluation (detect non-compliance), Remediation Action Triggered, Parameters Mapped from Resource, Remediation Action Execution and Validation, and Status Reporting. Arrows indicate the steps flow and a loop from status reporting back to rule evaluation.](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/AWS-Config-and-Auto-Remediation/aws-config-remediation-process-flow.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=4153875f483861a918bc8aa24c60bfc0)

Example parameter mapping (how Config maps resource details to Automation parameters):

![A presentation slide titled "Remediations Framework" showing "AWS Config Remediation: Parameter Mapping Example." It displays a boxed list mapping ResourceId → AutomationParameter:InstanceId, SecurityGroupId → AutomationParameter:GroupID, and Region → AutomationParameter:Region.](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/AWS-Config-and-Auto-Remediation/aws-config-remediation-parameter-mapping.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=faf4cad32d31a5b5e124434cf38e8da6)

Common remediation targets:

| Target | Use cases |
| - | - |
| Systems Manager Automation (SSM) | Long-running remediation runbooks, patching, cross-account execution, pre-built SSM docs |
| Lambda | Custom quick actions that complete within Lambda timeout (max 15 minutes) |
| SNS / SQS | Notifications, human-in-the-loop workflows |

![A presentation slide titled "Systems Manager Automation for Remediation" with "Automation Document (SSM Doc)" at the top. The SSM Doc branches to four colored boxes: Pre-Built Remediation Docs, Custom Automation Docs, Approved Patch Management, and Cross-Account Execution.](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/AWS-Config-and-Auto-Remediation/systems-manager-automation-remediation-ssm-doc.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=8a1258120e353fed2feaa5bf1cb6a5e8)

SSM runbooks are preferred for long-running or multi-step workflows. Lambda is a good choice for simple, short-lived remediations. Lambda execution is logged to CloudWatch Logs and CloudTrail.

![A diagram titled "Lambda-Based Custom Remediation" showing AWS Config, EventBridge, a Lambda function, and CloudWatch Logs. It illustrates AWS Config (and optional EventBridge) triggering a Lambda remediation function that updates target AWS resources and sends logs to CloudWatch.](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/AWS-Config-and-Auto-Remediation/lambda-custom-remediation-aws-config-cloudwatch.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=42426cd09d8aab16f22a658d3294c564)

Note: Lambda has execution limits (default timeout can be short; configurable up to 15 minutes). For remediations that might exceed the Lambda runtime, favor SSM Automation.

## Multi-account governance and deployment

Multi-account governance usually uses AWS Organizations plus a Config Aggregator in a delegated admin account to consolidate configuration and compliance data from member accounts and regions. You must:

* Enable AWS Organizations,
* Designate a delegated admin aggregator account,
* Configure a central S3 bucket with appropriate access for the aggregator,
* Deploy recorders, delivery channels, and roles across accounts and regions (StackSets are commonly used).

![A diagram titled "Multi-Account Governance" showing an AWS Organization at the top connected to three Member Accounts. Each member runs multi-region AWS Config and forwards configuration data to a central Aggregator Account (delegated admin/management).](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/AWS-Config-and-Auto-Remediation/multi-account-governance-aws-config-aggregator.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=13bae61cf63a5b5e0b24b0deb4b3cfb6)

Deployment pattern (common steps):

![A slide titled "Multi-Account Governance" showing a vertical flowchart for organization-wide AWS Config deployment. It lists steps and prerequisites like creating a CloudFormation StackSet, selecting deployment targets, setting deployment options, and reviewing/deploying.](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/AWS-Config-and-Auto-Remediation/multi-account-governance-aws-config-deployment.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=361fc7636d4a6547738c4febfbadc5db)

StackSets are frequently used to provision Config recorders, delivery channels, IAM roles, and SSM documents across many accounts and regions.

## Events, EventBridge rules and automation

When Config detects compliance state changes it can publish events (SNS or EventBridge). Use EventBridge rules to route non-compliance events to remediation targets (Lambda, SSM, SNS, SQS, Step Functions).

Example simplified Config event that can be a source to EventBridge:

```json theme={null}
{
  "source": "aws.config",
  "detail-type": "Config Rules Compliance Change",
  "detail": {
    "configRuleName": "example-config-rule",
    "complianceType": "NON_COMPLIANT"
  }
}
```

EventBridge rule example that matches NON\_COMPLIANT detail and forwards to targets:

```json theme={null}
{
  "source": ["aws.config"],
  "detail-type": ["Config Rules Compliance Change"],
  "detail": {
    "complianceType": ["NON_COMPLIANT"]
  }
}
```

## Security Hub integration

AWS Security Hub aggregates findings from GuardDuty, Inspector, Macie, Config, and other sources. It centralizes triage and enables automation via custom actions and EventBridge workflows.

* Config can push findings into Security Hub.
* Security Hub findings can be evaluated by Config rules or used to trigger remediations.
* Use Security Hub to view aggregated compliance posture and prioritize remediation.

![A Security Hub dashboard titled "Security Hub and Config Integration" showing a 75% compliance score, donut charts for findings by severity and resource type, a bar chart of top failing controls, and a list of recent config-based findings (e.g., MFA disabled, open security group).](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/AWS-Config-and-Auto-Remediation/security-hub-config-dashboard-75-percent.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=fda72f15132a3101c44f236153c3cc89)

## Troubleshooting checklist

Common areas to verify when remediations fail:

| Area | What to check |
| - | - |
| Permissions | Ensure Config and remediation roles have necessary IAM permissions (S3 access, `ssm:StartAutomationExecution`, `lambda:InvokeFunction`, `iam:PassRole`, etc.) |
| Recording settings | Confirm the recorder includes the expected resource types and regions |
| Remediation failures | Inspect CloudWatch Logs and CloudTrail for timeouts or AccessDenied errors |
| Aggregator configuration | Verify Aggregator includes all accounts and regions you expect |
| Cost and frequency | Continuous recording/evaluation increases cost—tune evaluation frequency to match risk tolerance |

Example CloudWatch log showing a remediation permission error:

```json theme={null}
{
  "timestamp": "2025-05-09T12:34:56Z",
  "level": "ERROR",
  "message": "Remediation action failed",
  "configRuleName": "ec2-instance-managed-by-ssm",
  "resourceId": "i-0abcd1234efgh5678",
  "remediationAction": "AWS-ConfigureSSMAgent",
  "executionStep": "RunAutomationDocument",
  "errorType": "AccessDeniedException",
  "errorMessage": "User: arn:aws:iam::123456789012:role/ConfigRemediationRole is not authorized to perform: ssm:StartAutomationExecution"
}
```

Ensure remediation roles have the precise permissions required for each action (for example, `ssm:StartAutomationExecution` for SSM runbooks and `iam:PassRole` where needed). Follow least-privilege principles and test the role actions in a sandbox account first.

Be cautious with remediation frequency and continuous evaluations—overly aggressive automation can cause operational churn and cost. Use periodic evaluations or approval gates for higher-risk actions.

## Summary and references

This covers the core concepts and architecture patterns for AWS Config and automated remediation across single-account and multi-account environments. For deeper configuration examples and automation documents, consult the official docs and use the patterns shown here to design safe, least-privilege remediations.

Links and references

* AWS Config documentation: [https://docs.aws.amazon.com/config/](https://docs.aws.amazon.com/config/)
* AWS Systems Manager Automation: [https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-automation.html](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-automation.html)
* AWS Lambda: [https://docs.aws.amazon.com/lambda/](https://docs.aws.amazon.com/lambda/)
* AWS Security Hub: [https://docs.aws.amazon.com/securityhub/](https://docs.aws.amazon.com/securityhub/)
* AWS Organizations and Config Aggregator: [https://docs.aws.amazon.com/organizations/](https://docs.aws.amazon.com/organizations/) and [https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html](https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html)

Thanks for reading.

> **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/d51f4260-d612-4dcb-9a91-4eeb6540c6c7/lesson/e3768b26-9019-4919-8913-236e46386471)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.