> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo Config Rules for Compliance

> Guide demonstrating AWS Config managed rules for S3 compliance, enabling the recorder and delivery channel, creating and evaluating rules, and remediating noncompliant S3 buckets

In this lesson we revisit AWS Config and focus on Config rules for compliance. A Config rule is a policy that defines the requirements AWS resources must meet. AWS Config evaluates resource configurations against these rules and returns compliance results: resources that meet the requirement are COMPLIANT; those that do not are NON\_COMPLIANT.

AWS provides many AWS Managed Rules that cover common compliance patterns. This demo walks through creating and evaluating managed rules for S3 buckets so you can quickly enforce security and governance controls.

## Prepare AWS Config to record changes

Before creating rules, ensure AWS Config can capture configuration changes and deliver snapshots.

* Enable the Config recorder so Config records configuration changes across supported resource types.
* Configure a delivery channel (an S3 bucket, and optionally an SNS topic) so Config can store configuration snapshots and history.
* Attach the required IAM role that grants AWS Config permission to write to the delivery channel and to read resource metadata.

Make sure the recorder is running and the delivery channel (S3 bucket) plus the Config service IAM role are configured; without these, Config cannot capture resource state and will not evaluate rules correctly.

![A screenshot of the AWS Config settings page with a "Start recording" confirmation dialog explaining that AWS Config will begin recording resource configuration changes. The dialog shows "Cancel" and an orange "Confirm" button.](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/Demo-Config-Rules-for-Compliance/aws-config-start-recording-dialog.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=2fedcf4067252619989ed385bc1f5874)

## View your resource inventory

After recording is enabled, the Config dashboard shows the Resource inventory for the selected region. This inventory lists the resources Config is tracking — for example, the S3 buckets in the account and region. Before you add rules, resource entries will not yet have compliance results.

![A screenshot of the AWS Config console Resources page displaying a list of S3 buckets, with left-hand navigation, filter controls, and bucket names in the main list.](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/Demo-Config-Rules-for-Compliance/aws-config-resources-s3-buckets-list.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=dddd4b2496cbefa1c05b7bb123164d94)

## Create managed rules for S3

Managed rules are the fastest way to start checking common security controls. Below are the steps to add two common S3 checks.

Steps common to both rules:

1. In the AWS Config console, open **Rules** → **Add rule**.
2. Choose **AWS managed rule** and search using the rule name (examples below).
3. Select the rule, click **Next**, accept the default parameters (or scope by tag, resource ID, or resource type if needed), and **Save**.

| Rule purpose | Managed rule name | What it checks |
| - | - | - |
| Ensure bucket versioning is enabled | `s3-bucket-versioning-enabled` | Confirms S3 buckets have object versioning turned on to protect against accidental deletes/overwrites. |
| Prevent public read access to buckets | `s3-bucket-public-read-prohibited` | Checks that buckets do not allow public read via block public access settings, bucket policies, or ACLs. |

Creating the "S3 bucket versioning enabled" rule

1. Rules → Add rule.
2. Search for and select `s3-bucket-versioning-enabled`.
3. Click Next, accept default parameters (or scope to specific buckets/tags), then Save.

After the rule is created, AWS Config evaluates all tracked S3 buckets. Buckets without versioning enabled will be marked NON\_COMPLIANT for this rule.

Creating the "S3 bucket public read prohibited" rule

1. Rules → Add rule → AWS managed rule.
2. Search for and select `s3-bucket-public-read-prohibited`.
3. Click Next, accept the defaults, and Save.

This rule evaluates block public access settings, bucket policies, and ACLs to determine whether objects in the bucket could be publicly readable.

Rule evaluations can take several minutes depending on the number of resources and when they were last recorded. Refresh the Rules or Resources view after a short wait to see updated compliance results.

## Check compliance status

Use these console areas to inspect results and drill down into noncompliant resources:

* Dashboard: Provides a high-level summary of compliant and noncompliant rules and resources. In this demo, the dashboard shows one noncompliant rule and one compliant rule, and three noncompliant resources.
* Resources view: Filter by resource type (for example, S3 Bucket) and compliance status to see which specific buckets are COMPLIANT or NON\_COMPLIANT for each rule.
* Rules view: Inspect individual rules for evaluation history and the lists of compliant / noncompliant resources.

![A screenshot of the AWS Config dashboard in a web browser showing compliance status. It lists 1 noncompliant rule and 1 compliant rule, and 3 noncompliant resources (0 compliant resources).](https://mintcdn.com/kodekloud-c4ac6d9a/pbGljLCZ83hel575/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/Demo-Config-Rules-for-Compliance/aws-config-1-noncompliant-3-resources.jpg?fit=max\&auto=format\&n=pbGljLCZ83hel575\&q=85\&s=7a0f9fc2b39d7510ea6d76d9cf227159)

## Important observations

* A rule can show a successful evaluation while individual resources remain NON\_COMPLIANT. Successful evaluation means the rule ran; noncompliance indicates the resource configuration does not meet the rule’s requirement.
* Example: the `s3-bucket-public-read-prohibited` rule may evaluate successfully if bucket-level block public access prevents public access, while `s3-bucket-versioning-enabled` reports NON\_COMPLIANT for buckets that still lack versioning.
* Remediation requires changing the resource configuration (for example, enabling versioning on an S3 bucket) and then allowing AWS Config to re-evaluate or initiating a reevaluation where supported.

Example ARN shown in the console (for reference):

```text theme={null}
arn:aws:controlcatalog::control/8sw3pbid15t9cbww8d2w2qwgf
```

## Wrap-up and best practices

* Use AWS Managed Rules to rapidly validate common security and compliance controls across your account and regions.
* Always enable the recorder and configure the delivery channel (S3) and IAM role before adding rules so Config can capture the required state data.
* Scope rules where appropriate (by resource type, tags, or resource IDs) to reduce noise and focus on critical resources.
* Triage noncompliant resources using the Rules and Resources views, remediate the configuration drift (for example, enable bucket versioning), and allow AWS Config to re-evaluate.

Quick checklist:

* [ ] Enable AWS Config recorder
* [ ] Configure delivery channel (S3) and IAM role
* [ ] Add managed rules such as `s3-bucket-versioning-enabled` and `s3-bucket-public-read-prohibited`
* [ ] Review noncompliant resources and remediate configurations
* [ ] Re-evaluate and verify compliance

References:

* [AWS Config Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/what-is-aws-config.html)
* [AWS Managed Rules reference](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html)

> **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/d51f4260-d612-4dcb-9a91-4eeb6540c6c7/lesson/45349892-ce96-4901-971f-1000977d5558)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.