Config rules and remediation
Lesson 1 of 3 in Compliance and Audit Evidence.
AWS Config is the only service in the catalogue that can answer what did this resource look like at 14:30 on Tuesday, and does it satisfy our policy right now. It earns that by writing a configuration item every time a recorded resource changes — a point-in-time snapshot of the resource's attributes, its relationships, and the CloudTrail event that caused the change — and keeping the series as a configuration history, with periodic snapshots delivered to S3.
The configuration recorder is the switch that makes any of this happen, and it is per account and per Region. This is the most common cause of a compliance dashboard that is clean for the wrong reason: no recorder means no configuration items, which means rules never evaluate, which renders as silence rather than as an error. "Is the recorder on, in this Region, for this resource type?" is the first question whenever compliance data looks too good.
Rules sit on top. A rule takes configuration items and returns COMPLIANT or NON_COMPLIANT per resource — and, if you attach one, a remediation action. That last step is the one the exam names explicitly — rules that detect and remediate — because detection that fixes nothing is a report, not a control.
| Mechanism | What you write | Reach for it when |
|---|---|---|
AWS managed rule | Nothing — you set parameters on a rule AWS maintains | The check already exists: |
Custom policy rule (Guard) | A CloudFormation Guard rule, evaluated by Config with no function to host | The check is declarative but not in the catalogue — and you want the same rule usable in the pipeline and as a proactive control |
Custom Lambda rule | A Lambda function returning an evaluation per resource | The logic needs to call other APIs, cross-reference an external system, or do something a declarative rule cannot express |
A YAML bundle of rules, parameters and remediation deployed as one artifact | A whole framework at once — CIS, PCI DSS, NIST, HIPAA, operational best practices — ideally as an organization pack covering every account |
Scale and plumbing, briefly, because each piece is a plausible distractor in a question.
Triggers. Change-triggered rules evaluate when a matching configuration item arrives; periodic rules run on an interval (1 hour to 24 hours). Periodic matters more than it sounds: some checks are about the absence of something, and absence never emits a configuration change.
Aggregation. A Config aggregator in the security account collects compliance results and resource inventory from source accounts and Regions — including advanced queries in SQL across the aggregated inventory, which is the quickest route to "every unencrypted volume in the company". Aggregation is strictly read-only; it enables nothing. The partner piece is the organization rule or organization conformance pack, which is what actually switches evaluation on in members.
Remediation configuration. The action is an SSM Automation runbook plus parameters and an assumed role. Automatic remediation retries up to a configured number of attempts within a retry period and then stops — it does not hammer forever. The alternative is manual remediation, which Config surfaces as a button, and the deliberately conservative option of routing the verdict to a human instead.
Notification. Compliance-change events go to EventBridge (and the delivery channel can publish to SNS), so SNS topics, Lambda enrichment, Security Hub and ticket systems all hang off the same event. AWS User Notifications is the newer front door for the same signals if you want them in one place per account.
The recorder scope decisions that quietly create holes
A recorder is configured with which resource types to record: all supported types, all including global types, or an explicit list. Three traps follow.
An explicit list that omits a resource type leaves a gap that looks identical to compliance — rules for that type simply never evaluate. Global resource types (IAM users, roles, policies) are recorded per Region, so recording them in every Region duplicates configuration items and cost for no extra coverage; record them in one Region. And a recorder switched off in a Region you forgot about means Security Hub controls there report NO_DATA rather than failing, which is easy to read as a pass.
Advanced queries: the fastest answer to “where is it?”
An aggregator exposes SQL-like advanced queries over the aggregated resource inventory, which beats clicking through accounts:
SELECT accountId, awsRegion, resourceId
WHERE resourceType = 'AWS::EC2::Volume'
AND configuration.encrypted = FALSE
Illustrative syntax — the point is the capability. For an incident or an audit request, "every unencrypted volume in the company, by account and Region" becomes one query against data you were already collecting, rather than a project.
Organization rule, conformance pack, or Security Hub standard?
All three deploy "a set of checks everywhere", and the exam picks between them on intent.
An organization Config rule is one check deployed org-wide — right when you need a specific, possibly custom, evaluation. A conformance pack bundles many rules plus parameters and remediation as one versioned artifact with its own compliance score — right when you are deploying a framework. A Security Hub standard is a curated, AWS-maintained control set with findings, workflow states and a security score — right when the requirement is posture measurement and aggregation rather than remediation.
They overlap because many Security Hub controls are implemented as Config rules underneath. That is not redundancy to eliminate; it is why Security Hub depends on your recorders being on.
The remediation role is the part to review
An SSM Automation runbook acts under an assumed role, and that role is the whole security story. A remediation role scoped to s3:PutBucketEncryption on the buckets in question is a control. A remediation role with broad write access is a privilege-escalation path wearing the costume of housekeeping — anyone who can influence which runbook runs, or with what parameters, inherits those permissions.
Review remediation roles with the same suspicion you would apply to a CI/CD deployment role, and prefer one narrow role per remediation over one role that can fix anything.
Key terms: AWS Config, AWS Config rule, Conformance pack, Config aggregator, Config remediation action, Systems Manager Automation document (runbook)
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.