AWS Config For Compliance

Compliance Requirements

Depending on your organization, you as a DevOps engineer have to ensure that your team is adhering the compliance standards your organization has standardaized. For example, your organization might have setup these standards for whatever reason:

• Each EC2 instance should have detailed monitoring enabled
• S3 buckets should have versioning enabled
• Any resources creted in region X should have tag “Environment=testing”

The compliance might be related to sometimes pricing, security, etc. Generally, you team manager or higher level personnel provides you list of these requirements and you are responsible to maintain it throught AWS infrasturucture.

Where Does AWSConfig Fit

AWSConfig helps with defining rules (custom with AWSLambda or AWS provided) to maintain the compliance requirements. This is managed service.

If you were to build what AWS Config does yourself, you would need to ensure:

• A mechanism detects changes to resources and/or evaluates them at regular intervals.
• Detected changes trigger a Lambda function or another evaluation mechanism.
• The Lambda function evaluates the resource against the defined compliance rules.
• The compliance result is stored and updated so the current compliance state can be tracked.
• Compliance violations or status changes are sent to the appropriate destinations, such as email, notifications, dashboards, or ticketing systems.
• Configuration changes and compliance evaluations are retained as history for auditing and troubleshooting.

Those are rough requiremnt (not exact but similar) and hence it might be better to use AWSConfig when it comes to config.

For demonstration, see -> this project.