AWS Config
AWS Config keeps a history of how every resource in an account is configured and checks that configuration against rules. The platform records everything in every account, gathers the results in core-audit, and evaluates a SOC 2 baseline pack across the organization.
What it does
A configuration recorder watches supported resource types and writes a configuration item every time one changes: a security group rule added, a bucket policy edited, a volume created. A delivery channel sends snapshots of that history to an S3 bucket. A rule evaluates resources for a property, such as "EBS volumes are encrypted", and marks each one compliant or not. A conformance pack is a bundle of rules deployed as one unit; an organization conformance pack deploys the bundle to every account. An aggregator collects configuration and compliance data from many accounts and regions into one view.
How BuiltForProd uses it
Three pieces, in three accounts:
- Recorder in every account.
modules/account-baseline, applied in all 14 accounts, creates the recorder for all supported resource types including global ones, and a delivery channel that writes snapshots every six hours toacme-usw2-audit-logsunder theconfig/prefix. Member accounts use anacme-<stage>-config-role; the management account uses the Config service-linked role. - Aggregator in
core-audit. Theaws-config-aggregatorunit (modulemodules/aws-config) creates the organization aggregator, so compliance across all accounts and regions is read from one place.core-auditis the delegated administrator for Config. - Conformance packs from
core-root. Theaws-config-conformanceunit deploys organization conformance packs. It runs in the management account because a delegated administrator cannot assume the service-linked role there; deploying fromcore-rootcovers every account with no exclusions needed.plat-sandboxis excluded on purpose.
The BuiltForProd-soc2-baseline pack, 13 rules, is on by default: encrypted volumes, multi-region CloudTrail, S3 SSL-only, MFA for the console, no root access keys, VPC Flow Logs and similar. Twenty-eight further packs are shipped and switched off until a compliance need arrives: HIPAA, PCI DSS v4, NIST CSF, CMMC 2.0, CIS Controls v8, the Well-Architected Security and Reliability pillars, and service packs for S3, IAM, EKS, RDS, Lambda, WAF and others. Each is one enabled flag in the unit.
Two protections keep the record trustworthy. The acme-audit-protection SCP denies stopping or deleting the recorder and delivery channel to everyone but root, and the snapshots land in the same versioned, KMS-encrypted bucket as CloudTrail. Non-compliant results for the encrypted-volumes and access-keys-rotated rules are routed by EventBridge in core-security to the security alerts topic; the rules are matched by name prefix because organization packs suffix rule names.
Terms you will see
| Term | Meaning |
|---|---|
| Configuration recorder | The per-account component that captures resource changes. |
| Configuration item | One recorded state of one resource at one time. |
| Delivery channel | Where snapshots go; the audit bucket every six hours here. |
| Rule | A check that marks resources compliant or non-compliant. |
| Conformance pack | A set of rules deployed together; organization packs cover every account. |
| Aggregator | The cross-account, cross-region view of configuration and compliance. |
| Service-linked role | The Config role that only the management account can use for organization packs. |
Where to read more
- AWS Baseline overview for the audit account and its bucket.
- Security Hub for where Config findings are aggregated with other services.
- EventBridge for the rules that turn non-compliance into alerts.