- Home
- Cloud Governance Software
- AWS Config
AWS Config
What it is
AWS Config assesses, audits, and evaluates configurations of AWS resources. It records configuration changes so users can review earlier states through the console, API, or CLI, and it can also record configurations for some third-party resources, including on-premises servers, SaaS monitoring tools, and version control systems. Prebuilt rules and custom rules implemented with AWS Lambda assess configurations against policies. Conformance packs group rules and remediation actions for deployment and aggregated compliance reporting. Aggregators provide a central view of resource metadata and rule compliance across accounts and Regions, while advanced queries use a subset of SQL SELECT syntax to search current configuration state. The service describes integrations with AWS services and with ServiceNow and Jira Service Desk through AWS Service Management Connector. AWS Config is available through web and API access. Its pay-as-you-go charges depend on configuration items recorded and rule and conformance pack evaluations; S3, SNS, and Lambda charges may also apply. Config rules report compliance status but do not guarantee continued compliance or prevent noncompliant changes.
For and against
For
- Records configuration history through console, API, or CLI
- Supports prebuilt and Lambda-based custom rules
- Aggregates compliance across accounts and Regions
- Advanced queries search current configuration state
Against
- Rules do not guarantee continued compliance
- Rules do not prevent noncompliant changes
- Default limit is 150 Config rules per account
- Additional S3, SNS, and Lambda charges may apply
The verdict
AWS Config offers configuration history, policy evaluation, and centralized compliance views for AWS resources. Its rules report status rather than enforcing continuous compliance, and charges vary with usage.
Who it suits
It suits AWS security and governance teams, administrators, compliance users, and infrastructure operators who need configuration history and policy evaluation. Teams should account for its usage-based billing and its limits as a compliance safeguard.
Plans and prices
Pay as you go
No minimums or upfront commitments · S3, SNS, and Lambda charges may also apply
Read 4 Oct 2026 · aws.amazon.com
On the record
- Compliance packs
- Conformance packs bundle Config rules and remediation actions for deployment and aggregated compliance reporting across an organization.aws.amazon.com · read 4 Oct 2026
- Configuration history
- It records resource configuration changes and lets users view past configurations through the console, API, or CLI.aws.amazon.com · read 4 Oct 2026
- Important limitation
- Config rules report compliance status but do not guarantee resources remain compliant or prevent users from making noncompliant changes.aws.amazon.com · read 4 Oct 2026
- Integrations
- The feature page describes integrations with AWS Organizations, CloudTrail, Security Hub CSPM, Audit Manager, Systems Manager, Firewall Manager, EC2 Dedicated Hosts, and Application Load Balancers.aws.amazon.com · read 4 Oct 2026
- Intended users
- AWS identifies security and governance teams, administrators in larger organizations, information security experts, compliance users, and infrastructure operators as beneficiaries.aws.amazon.com · read 4 Oct 2026
- ITSM integrations
- The AWS Service Management Connector supports tracking AWS resources through ServiceNow and Jira Service Desk.aws.amazon.com · read 4 Oct 2026
- Maker
- AWS says Amazon Web Services launched in 2006 and is part of Amazon.aws.amazon.com · read 4 Oct 2026
- Multi-account aggregation
- Aggregators provide a centralized view of resource configuration metadata and rule compliance across accounts and Regions.aws.amazon.com · read 4 Oct 2026
- Purpose
- AWS Config assesses, audits, and evaluates the configurations of AWS resources.aws.amazon.com · read 4 Oct 2026
- Querying
- Advanced queries use a subset of SQL SELECT syntax to search current resource configuration state, including across aggregated accounts and Regions.aws.amazon.com · read 4 Oct 2026
- Resource coverage
- It can record configurations for third-party resources such as on-premises servers, SaaS monitoring tools, and version control systems.aws.amazon.com · read 4 Oct 2026
- Rule limit
- The FAQ states that an AWS account can create up to 150 Config rules by default, with limit increases available by request.aws.amazon.com · read 4 Oct 2026
- Rules
- AWS Config offers prebuilt rules and supports custom rules implemented with AWS Lambda to assess resource configurations against policies.aws.amazon.com · read 4 Oct 2026
- Security certifications
- The features page lists ISO 9001, ISO 27018, PCI DSS, ISO 27001, ISO 27017, and HIPAA under certifications.aws.amazon.com · read 4 Oct 2026
