Enterprise sized organizations regularly allocate multiple AWS accounts to their various teams. In such an environment it can be a big challenge to keep track of all the accounts and ensure they meet different compliances. AWS Config service is indispensable in helping organizations check, and assess configurations of all these diverse AWS resources. By enabling continuous monitoring&recording of the different configurations AWS Config facilitates evaluations, helping organizations confirm to accepted governance norms.

Non-Compliance Problems

Without continuous compliance, an organization can experience problems such as inability to scale, or conduct thorough assessments, exhaust compliance events, and receive sub-optimal feedback.

Scaling Failure

Rapid, real-time changes demand rapid scaling. This is one of the prime benefits of a cloud environment. Lack of compliance, or manual compliance approach sabotages ability to scale rapidly.

Inaccurate Assessments

Changes are another regular feature of cloud-based infrastructures. If these go unnoticed, they could cause violations of policy. If there is no automated and continuous compliance approach, difficulty in assessments is further exacerbated when APIs are used to deploy changes.

Wastage of Resources

Without continuous compliance process, Organizations expend time and use up significant resources to conduct audits— external and internal—when proving compliance.

Incomplete Feedback

Without complete feedback, product teams will not be able to ensure change management to updated products. This feedback needs continuous and complete compliance, which manual approaches cannot deliver, as they can only perform partial compliance on individual events during a release lifecycle.

AWS Config to the Rescue

AWS Config tracks changes and resource inventory and provides assurance that new and existing AWS resources conform to the organization’s operational practice and security policy.

AWS Config offers total visibility of all resources related to the various allocated, configurations made different accounts, and subsequent changes. Organizations that allocate multiple AWS accounts to their in-house teams will benefit from using AWS Config in several ways, as follows:

Compliance-As-Code

AWS Config can be used to automate a rule or enforce policy. Config Rules enables reports on specific controls in a chosen framework. Controls can include encryption, controlled access to resource, usage, and sharing.

Config Rules come bundled as standard out-of-the-box functionalities, but allow simple customization. They clearly show a resource’s pass/fail status with regard to a specific compliance. 

Transparent Reporting

Distribution of  AWS accounts to various teams could hinder reporting of compliance state.

AWS Config offers a comprehensive and customizable record of all changes that havebeen deployed providing a record of how well the organization’s resources have met compliances.

This programmatic-log provides vital data that can be used as a reference during compliance audits. For companies moving to microservices based on CI/CD (Continuous Integration and Continuous Deployment), AWS Config provides a trail of all continuous actions. This enables accurate reporting on internal processes at each CI/CD deployment.

Automating problem mitigations

With AWS Config enterprises can automate mitigations or fix noncompliant resources automatically, by adding rules via API or console. AWS documents provide instructions in the documents to provide guidelines to different actions as per the state of AWS resources.

AWS Config Rules AWS Config Rules provide the settings for desired configurations for AWS resources/accounts. An account that violates the rules is flagged by AWS Config as noncompliant, and it triggers a notification through the Amazon SNS (Simple Notification Service). Config Rules can be customized or used as perdetermined. Customizable rules help an org get up and running on the continuous compliance process. New rules are added regularly to cover new practices, technologies, and/or security protocols. Organizations can also create their own customized Config rules specific to the compliance needs of their distributed accounts. Such customized rules allow organizational teams to address compliance deficiencies  in AWS accounts and ensure ongoing compliance.