# AWS Config

> An AWS service that records how your resources are set up and checks them against rules.

- Level: Intermediate
- Topics: AWS, Security
- URL: https://tidbit.legios.com.ar/aws-config/
- In Spanish: [AWS Config](https://tidbit.legios.com.ar/es/aws-config/)

**AWS Config** keeps an inventory of the resources in your AWS account, such as EC2 instances, S3 buckets, security groups or VPCs, and records every change to their settings over time. You can look at any resource and see what it looked like last Tuesday, who changed it (by linking to CloudTrail), and which other resources it is connected to.

On top of that history you add **rules**. A rule describes how something should be configured: "S3 buckets must not be public", "EBS volumes must be encrypted", "only approved instance types". Config evaluates your resources against the rules whenever they change and marks each one compliant or noncompliant. AWS provides many ready-made managed rules, and you can write your own. Groups of rules for a standard can be deployed together as a **conformance pack**.

It matters because cloud resources change constantly and many people can change them. Auditors ask "prove this was encrypted all year", and security teams want to know the minute someone opens a database to the internet. Config answers both. It can also trigger automatic fixes, but its main job is to record and evaluate.

## An analogy

A building inspector with a camera who photographs every room each time something is moved, keeps all the photos in order, and stamps a red mark on any room that breaks the fire code.

## Keep in mind

- Inventory plus change history of the settings of your AWS resources.
- Rules mark each resource as compliant or noncompliant.
- Conformance packs bundle rules for a standard or policy.
- Used for audits, security checks and catching risky changes fast.

## Go deeper

- [What is AWS Config? (official docs)](https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html)
- [AWS Config product page](https://aws.amazon.com/config/)

## Related terms

- [AWS account and billing](https://tidbit.legios.com.ar/aws-account-and-billing/): What an AWS account is, how you get charged, and how to avoid a surprise bill.
- [Amazon EC2](https://tidbit.legios.com.ar/amazon-ec2/): Virtual computers you rent by the hour, in any size, and switch off when done.
- [Amazon S3](https://tidbit.legios.com.ar/amazon-s3/): A giant online drawer for files, rented by the gigabyte.
- [Amazon VPC](https://tidbit.legios.com.ar/amazon-vpc/): Your own private slice of the AWS network, with walls you draw yourself.
- [AWS CloudTrail](https://tidbit.legios.com.ar/aws-cloudtrail/): The logbook of an AWS account: who did what, when, and from where.
- [Amazon EBS](https://tidbit.legios.com.ar/amazon-ebs/): The virtual hard drive of an EC2 instance, kept alive even when the instance stops.
- [Encryption](https://tidbit.legios.com.ar/encryption/): Scrambling data so that only someone with the key can read it.
- [Cloud computing](https://tidbit.legios.com.ar/cloud-computing/): Renting computers over the internet instead of buying your own.