AWS Config — is the AWS service used to monitor compliance.
Definition
AWS Config is a configuration and compliance monitoring service that:
• Continuously tracks the configuration changes of your AWS resources, and
• Checks whether those resources meet your organization’s compliance rules or policies.
🔍 What AWS Config Does:
1. Monitors configuration changes — e.g., if someone opens an S3 bucket to the public, or changes a security group.
2. Evaluates compliance — compares resource settings with predefined rules (like “S3 buckets must not be public”).
3. Generates compliance reports — showing which resources are compliant or non-compliant.
🧠 Example Use Cases:
• Ensuring all EC2 instances are using encrypted EBS volumes.
• Checking if IAM users have MFA enabled.
• Making sure security groups do not allow port 22 (SSH) from 0.0.0.0/0.
• Tracking configuration history for auditing.