Compliance Monitoring With AWS Config and Conformance Packs
Explore how AWS Config tracks configuration changes on resources and uses rules to determine compliance over time. Understand the importance of evidence-driven workflows in identifying and resolving compliance violations. Learn to interpret evaluation results, use conformance packs for consistent control baselines, and implement remediation loops to restore compliance effectively.
A badge flipping from green to red is easy to notice and easy to misread. The badge itself isn't the story; the story is the trail of evidence underneath it that explains exactly what changed and when the violation started. A Config rule that had been COMPLIANT flips to NON_COMPLIANT right after a change lands on an AWS resource, and the useful view is that evidence trail, not the badge.
Closing the finding means writing down three closure facts from the evaluation details. The specific resource reported as noncompliant gets identified, the specific configuration attribute that is wrong gets identified, and the compliant target state for that attribute gets identified. This works best as an evidence-driven workflow, because an auditor or incident reviewer will ask for proof that the resource moved from a failing state to a passing state at a known time.
What Config is measuring
AWS Config produces a time-ordered record of resource ...