Study Guides/AWS Cybersecurity Notes/AWS Config - Revision history

Mflavell at 16:06, 21 May 2026

2026-05-21T16:06:21Z

← Older revision		Revision as of 16:06, 21 May 2026
Line 409:		Line 409:

	:* Enables a one click setup.		:* Enables a one click setup.


			= Configuration History =

			As you may expect, this lists all the changes made to a resource.

			:: This is done by comparing the configuration items saved in the S3 bucket.

			:: Use case: Determine the history of events that resulted in an incident.


			= Fixing no compliant resources =

			This is possible out of the box though the use of ''System Manager Automation Runbooks''

			:: Contain predefined automated remediations.

			:: Custom remediations can also be created.


			= Using Multiple accounts =

			This is done using aggregator, the use cases are:

			:* Single account / Multi region

			:* Multi account / Multi region

			The aggregator makes finding trends in multiple regions or accounts easier by consolidating the data.

2026-05-21T15:50:03Z

← Older revision		Revision as of 15:50, 21 May 2026
(No difference)

2026-05-21T15:47:02Z

← Older revision		Revision as of 15:47, 21 May 2026
Line 1:		Line 1:
	~~[[Study Guides]] > [[AWS Cybersecurity Notes]] > AWS Config~~


	= What is AWS Config =		= What is AWS Config =

2026-05-20T00:46:31Z

AWS Config Rules

← Older revision		Revision as of 00:46, 20 May 2026
Line 395:		Line 395:

	:* A Guard policy		:* A Guard policy


			== Rule Evaluation ==

			:* Proactive mode - Immimdate evaluation

			:* Detective mode - Evaulated against resources that are already depoyed.


			== Conformance packs ==

			:* These make it easy to implement best practices.

			:* Can be run in a region or over multiple regions via aggregator.

			:* Enables a one click setup.

2026-05-20T00:36:12Z

AWS Config Rules

← Older revision		Revision as of 00:36, 20 May 2026
Line 362:		Line 362:

	: This is independent of who deployed them or when they where deployed.		: This is independent of who deployed them or when they where deployed.


			== Rules can apply to ==

			:* A single or a set of resouce ID's

			:* Types of resources

			:* Resources with a specified tag



			Rules help enforce compliance.

			: Labmba functions can also be used to add logic to the rules.


			== AWS Config Managed Rules ==

			These are preconfigured to ensure your systems comply to industry best practices.

			For custom rules their is no need for write an action - it is performed automatically.

			Over 150 managed rules exist today.


			== Custom Rules ==

			Custom rules can be created using two methods:

			:* AWS Lambda

			:* A Guard policy

2026-05-20T00:17:56Z

← Older revision		Revision as of 00:17, 20 May 2026
Line 346:		Line 346:

	::* It will take a few minutes for the data to be posted.		::* It will take a few minutes for the data to be posted.


			= AWS Config Rules =

			Rules enable you to automatically evaluate the configuration of monitored resources.

			A rule can be triggered in two ways:

			:* When a resource changes

			:* On a schedule


			These rules allow you to enfore a consistant approach to AWS resources.

			: This is independent of who deployed them or when they where deployed.

2026-05-19T16:51:29Z

← Older revision		Revision as of 16:51, 19 May 2026
Line 1:		Line 1:
			[[Study Guides]] > [[AWS Cybersecurity Notes]] > AWS Config


	= What is AWS Config =		= What is AWS Config =

2026-05-19T02:00:39Z

Basic Setup

@@ Line 164: / Line 164: @@
 = Basic Setup =
 * Create an S3 bucket to store the configuration items
@@ Line 311: / Line 315: @@
 ::* EC2 Volue status.

2026-05-19T01:46:48Z

Basic Setup

← Older revision		Revision as of 01:46, 19 May 2026
Line 291:		Line 291:

	:* Decide what is right for your system.		:* Decide what is right for your system.


			Here is an example of the JSON file:


			{
			"allSupported": false,
			"includeGlobalResourceTypes": false,
			"resourceTypes": [
			"AWS::EC2::SecurityGroup",
			"AWS::EC2::Volume"
			]
			}


			This will monitor:

			::* EC2 security groups.

			::* EC2 Volue status.

2026-05-18T15:23:12Z

Basic Setup

← Older revision		Revision as of 15:23, 18 May 2026
Line 276:		Line 276:

	: Describe > Transmit (SNS) > Save (s3)		: Describe > Transmit (SNS) > Save (s3)

			With this done we can attach the policy to the role:

			This can be done in the AWS CLI with the following command:

			aws iam attach-role-policy --role-name '''role name''' --policy-arn '''policy arn'''


			Next and very importantly we need to determine what resources to capture.

			:* Keep in mind you will pay a nominal free for these / but this is AWS - resources add up $$$

			:* If you monitor too little you won't get the data you need to make decisions or protect the system.

			:* Decide what is right for your system.