Hello and welcome to this Cloud Academy demonstration. A little bit about myself, I’m Jorge Negrón and I’m part of the AWS Content development team here at Cloud Academy. In this segment, We will demonstrate how to setup and operate AWS Config.

To get the most out of this demonstration, please refer to the course titled Introduction to AWS Config Behavior and setup. Otherwise, let’s get started.

We’re going to be walking through the setup and some use cases for AWS Config. In this case, I am logged in with a user that belongs to the administrator group so I have access to all services with the exception of billing services. That’s not unusual when initially setting up a new account in AWS.

The idea here is that AWS Config is one of the first services you need to enable as you build your AWS implementations. It will provide you visibility into existing and future resources created and by using rules you can make sure all configurations are provisioned as you need them for compliance. Also, AWS Config recorder needs to be enabled before you setting up AWS Security Hub which is a best practice step in setting up a new account. Let’s take a quick look.

As you see security hub depends on the AWS Config resource recording to be enabled before you can use it. For details about using security hub please refer to our course: Automating and Centralizing Security Checks with AWS Security Hub.

Let’s get back to the AWS Config landing page and set up the recorder.

In order to setup the recorder in the AWS config landing page we select settings and that sends us to the Recorder configuration page.

We need to select the check box “enable recording.

The next decision is about the recording strategy. We can record all current and future resource types in the region and specify to include global resources like IAM users groups, roles, and customer-managed policies. This is the most general and comprehensive and this is the one we will use.

As a second option, we can record all resource types and define exclusions. When this option is selected a “resource category” panel appears to allow you to define which resource types to exclude from the recordings.

Finally, for the third option, you can focus the recorder to specific resource types. In this option, you also get a Resource type panel to define which resources you want to record specifically.

As a quick example, we can select that option and see how to define a recording for only security groups. We will not save the configuration but it will allows us to see how to use the Resource category and resource type selection drop-downs.

On the resource category dropdown we select “AWS resources” and on the resource types dropdown we get a full list to select the AWS resource we want to record.

In our case, we can search for EC2 Security Groups as an example and this resource type appears as a selection. This means the config recorder will only focus on keeping track of security groups which is a bit limited.

In this demo, we will use the first option to record everything including global resources. So we delete the AWS EC2 security group selection and go back and select “Record all current and future resource types in the region”. We also include Global resources. We want to capture everything.

The next step is the data retention. Config by default uses a data retention of 7 years. You can define a custom retention period for items recorded in days. Let’s select it and we can setup rendition for 30 days if needed. In our case, we’re happy with the default value of 7 years.

The next decision enabling the Config recorder is to have a role or use an existing service-linked role for config to use in order to communicate with other services. In our case, we will use an existing service-linked role.

Next step is to configure the delivery method.

We need to designate an S3 bucket for configuration history and configuration snapshots to be stored. This can be created automatically when you enable the recorder. You can also choose an existing bucket in your account or another account. We will have the bucket created.

In the bucket name we will use config-bucket-datetime so as of this recording that will be: config-bucket-06092023936

We can leave the prefix panel empty but notice how there is a suffix which starts with AWSLogs followed by account number config and and region.

As an optional item you can use an SNS Topic to receive notifications when AWS config perform a task.

AWS Config sends notifications when the configuration item for a resource changes along with their compliance state.

It also send notifications when the configuration history for a resource or a configuration snapshot is delivered to your designated S3 bucket.

Finally, it sends a notification when a rule evaluation is triggered.

As such, you want to create a dedicated mailbox to receive these notifications because depending in your setup you may get notifications multiple times a day.

For good measure let’s have an SNS Topic setup to receive AWS Config notifications. In the topic setup, you want to have a subscription to the email address or endpoint you want to use to receive notifications from AWS Config. In our case let’s call the topic

aws-config-topic. If you choose the option don’t forget to define a subscription to the topic with the email or endpoint to receive notifications.

As a final option in setting up the Config Recorder, we can use CloudWatch events rules. We will skip this option for the sake of brevity. This concludes the AWS config recorder setup. We click on save and the recording will be enabled.

AWS Config Demonstrated

Learning Objectives

Intended Audience

Prerequisites