Intermediate LevelCloud Computing (AWS/GCP/Azure)
How does AWS Config track resource configuration history and audit compliance rules?
❓ Interview Prompt: Explain AWS Config resource timeline recording, managed compliance rules, non-compliant resource alerts, and remediation.
AWS Config is a service that continuously monitors, records, and audits configuration changes across your AWS resource inventory.
Key Features:
1
Configuration History: Records historical snapshots of resource settings over time (creating a timeline of changes).
2
AWS Config Rules: Evaluates resource settings against security best practices (e.g. 's3-bucket-ssl-requests-only', 'encrypted-volumes').
3
Automated Remediation: Triggers Systems Manager Automation documents or Lambda functions to automatically fix non-compliant resources (e.g. closing an open Security Group port).
Code Implementation Example
hcl
# AWS Config Rule enforcing S3 bucket encryption
resource "aws_config_config_rule" "s3_encryption" {
name = "s3-bucket-server-side-encryption-enabled"
source {
owner = "AWS"
source_identifier = "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"
}
}💡Terraform AWS Config rule auditing S3 server-side encryption compliance.
🎯 Interview Key Takeaway
AWS Config records resource configuration history and continuously evaluates resources against security compliance rules.
#AWS Config#Compliance#Audit#Governance#Intermediate
Back to all Cloud Computing (AWS/GCP/Azure) Questions→