Config compliance

AWS Config turns compliance from an annual evidence exercise into a continuous measurement. The recorder captures what changed; the rules say whether the result is acceptable.

Enabling Config

Setting	Value
Recorder	All supported resource types, in every governed region
Delivery channel	Centralised S3 bucket in the log archive account
Snapshot frequency	Daily, plus configuration history continuously
Aggregation	Organisation aggregator in the security account
Retention	Per compliance requirement; history retained for audit

resource "aws_config_configuration_recorder" "main" {
  name     = "organisation-recorder"
  role_arn = aws_iam_role.config.arn

  recording_group {
    all_supported                 = true
    include_global_resource_types = true
  }
}

resource "aws_config_delivery_channel" "main" {
  name           = "organisation-delivery"
  s3_bucket_name = var.log_archive_bucket
  s3_key_prefix  = "config"

  snapshot_delivery_properties {
    delivery_frequency = "TwentyFour_Hours"
  }
}

Baseline rules

Identity and access management

Rule	Checks
`iam-user-mfa-enabled`	MFA enabled for IAM users
`iam-root-access-key-check`	Root has no access keys
`iam-password-policy`	Password policy meets the standard
`root-account-mfa-enabled`	Hardware MFA on root
`iam-policy-no-statements-with-admin-access`	No admin-equivalent policy
`access-keys-rotated`	Keys rotated within 90 days

Encryption and data protection

Rule	Checks
`encrypted-volumes`	EBS volumes encrypted
`s3-bucket-server-side-encryption-enabled`	S3 encryption enabled
`s3-default-encryption-kms`	S3 uses KMS
`rds-storage-encrypted`	RDS storage encrypted
`efs-encrypted`	EFS encrypted
`dynamodb-table-encrypted-kms`	DynamoDB encrypted with KMS

Network security

Rule	Checks
`vpc-default-security-group-closed`	Default SG blocks all traffic
`restricted-common-ports`	No unrestricted access to 22, 3389, 3306, 5432
`vpc-flow-logs-enabled`	Flow logs on
`s3-account-level-public-access-blocks`	S3 public access blocked at account level
`s3-bucket-public-read-prohibited`	No public-read buckets
`s3-bucket-public-write-prohibited`	No public-write buckets

Logging and monitoring

Rule	Checks
`cloudtrail-enabled`	CloudTrail on
`multi-region-cloud-trail-enabled`	Trail covers all regions
`cloud-trail-encryption-enabled`	Trail encrypted
`cloudwatch-alarm-action-check`	Alarms have actions
`guardduty-enabled-centralized`	GuardDuty enabled and centralised

Backup and recovery

Rule	Checks
`backup-recovery-point-encrypted`	Recovery points encrypted
`db-instance-backup-enabled`	RDS backups on
`dynamodb-pitr-enabled`	DynamoDB PITR on
`ebs-snapshot-public-restorable-check`	Snapshots not publicly restorable

Tagging

Rule	Checks
`required-tags`	`Project`, `Environment`, `Owner`, `CostCenter` present

A custom rule is added where the managed rule cannot express the requirement — for example, "all production resources must carry a DataClassification tag from an approved list."

Remediation

Remediation is either automatic or notified, chosen by consequence.

Class	Mechanism	Example
Safe and unambiguous	SSM Automation, automatic	Enable S3 encryption; add a missing tag
Potentially disruptive	SSM Automation, manual approval	Replace a public security group rule
Requires judgement	Notification and runbook	Unused credentials that may still be in use

Resources:
  EnableS3Encryption:
    Type: AWS::Config::RemediationConfiguration
    Properties:
      ConfigRuleName: s3-bucket-server-side-encryption-enabled
      TargetType: SSM_DOCUMENT
      TargetId: AWSConfigRemediation-EnableS3BucketEncryption
      Automatic: true
      MaximumAutomaticAttempts: 3
      RetryAttemptSeconds: 120
      Parameters:
        AutomationAssumeRole:
          StaticValue: !GetAtt RemediationRole.Arn

A remediation that changes customer-visible behaviour is never automatic. The finding routes to a person with a documented action, and the change follows the normal change process.

Mapping to standards

Standard	Rule set
AWS Foundational Security Best Practices	Security Hub managed set
CIS AWS Foundations	`cis_1.5_aws` conformance pack
PCI DSS	Encryption, network and logging rules plus the audit trail
ISO 27001 / SOC 2	Control mapping documented per rule
HIPAA	Encryption, access control, audit logging

Evidence

Recorder and delivery channel configuration.
Rule inventory with compliance status.
Remediation configuration per rule.
Config history export for a sample resource.
Aggregator view across accounts.
A non-compliance event with its remediation record.

Operating rhythm

Frequency	Activity
Continuous	Rules evaluate on every configuration change
Daily	Non-compliant resource digest to owning teams
Weekly	Compliance trend review; remediation backlog
Monthly	Rule coverage review — are we measuring the right things?
Quarterly	Conformance pack review against the customer's obligations

Enabling Config​

Baseline rules​

Identity and access management​

Encryption and data protection​

Network security​

Logging and monitoring​

Backup and recovery​

Tagging​

Remediation​

Mapping to standards​

Evidence​

Operating rhythm​

Related standards​