Overview
Configuration auditing in AWS focuses on monitoring resource configuration, enforcing policies, and detecting drift across accounts and regions. AWS Config records configuration changes, evaluates rules, and integrates with other security services.
Key AWS Services for Configuration Auditing
- AWS Config – Records resource configuration and evaluates rules.
- AWS CloudTrail – Logs API activity and configuration changes.
- AWS Security Hub – Aggregates findings and compliance status.
- AWS IAM Access Analyzer – Detects overly permissive access policies.
- Amazon GuardDuty – Detects threats related to configuration and activity.
AWS Config Rules
AWS Config Rules evaluate resource configuration against desired policies. Rules can be:
- Managed rules provided by AWS
- Custom rules using Lambda
- Rules mapped to CIS Benchmarks or internal standards
| Rule | Purpose |
|---|---|
| s3-bucket-public-read-prohibited | Ensures S3 buckets are not publicly readable. |
| restricted-ssh | Ensures security groups do not allow 0.0.0.0/0 on port 22. |
| cloudtrail-enabled | Ensures CloudTrail is enabled in all regions. |
| iam-password-policy | Ensures IAM password policy meets complexity requirements. |
Configuration Auditing Workflow in AWS
- Enable AWS Config – Record resource configuration across accounts and regions.
- Define Config Rules – Use managed or custom rules aligned with policies.
- Integrate CloudTrail – Capture API activity and configuration changes.
- Aggregate in Security Hub – View findings and compliance status.
- Automate Remediation – Use Lambda or Systems Manager to fix misconfigurations.
- Collect Evidence – Export reports and snapshots for audits.
Resource Changes → AWS Config Records → Rules Evaluate → Findings to Security Hub → Alerts & Remediation → Evidence for Audits
Common Use Cases
- Ensuring S3 buckets are not publicly accessible
- Verifying encryption at rest for EBS, RDS, and S3
- Checking security group rules for least privilege
- Monitoring IAM roles and policies for excessive permissions
- Enforcing CloudTrail and Config across all accounts
Evidence Collection in AWS
Evidence for audits can include:
- AWS Config snapshots and timelines
- CloudTrail logs
- Security Hub compliance reports
- GuardDuty findings
- Remediation runbooks and Lambda logs
Frequently Asked Questions
How does configuration auditing work in AWS?
Configuration auditing in AWS uses AWS Config, CloudTrail, Security Hub, and custom rules to track resource configuration, detect drift, and enforce compliance.
Which AWS services are used for configuration auditing?
Key services include AWS Config, AWS CloudTrail, AWS Security Hub, AWS IAM Access Analyzer, and Amazon GuardDuty.
Can AWS Config be used for compliance frameworks?
Yes. AWS Config rules can be mapped to CIS Benchmarks, NIST 800-53, PCI DSS, and internal policies.