AWS Config Rules
Monitoring & DetectionAWS Config Rules continuously evaluate your AWS resource configurations. When a resource violates a rule, Config flags it as non-compliant and can trigger automatic remediation.
Rule Types
- AWS Managed Rules:350+ pre-built rules (e.g.,
s3-bucket-public-read-prohibited,iam-root-access-key-check,encrypted-volumes) - Custom Rules: Lambda-backed rules for organization-specific policies
- CloudFormation Guard Rules: declarative policy-as-code rules
Evaluation Triggers
- Configuration Change: evaluate when a resource is created, modified, or deleted
- Periodic: evaluate on a schedule (1h, 3h, 6h, 12h, 24h)
Remediation
- Auto Remediation: SSM Automation documents execute corrective actions
- Manual Remediation: one-click fix from the Config console
- Conformance Packs: collections of Config rules mapped to compliance frameworks (PCI DSS, HIPAA, NIST)
Related Content
Related Terms
Meeting regulatory requirements and industry standards (SOC 2, HIPAA, GDPR, PCI DSS, CIS) for data protection, access control, and security practices in the cloud.
A preventive or detective control that enforces security boundaries across AWS accounts, implemented through SCPs, AWS Config rules, or Security Hub standards.
A prescriptive security configuration checklist from the Center for Internet Security that defines best practices for securing AWS accounts.
AWS service that aggregates security findings from GuardDuty, Inspector, Macie, and third-party tools into a single dashboard with compliance scoring.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.