10.4 Compliance Enforcement with AWS Config & Conformance Packs

10.4 Compliance Enforcement with AWS Config & Conformance Packs

CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests your ability to continuously audit resource configuration drift with AWS Config, deploy managed and custom rules, automate configuration remediation using Systems Manager Automation runbooks, enforce immutable compliance frameworks using Organization Conformance Packs, and remediate high-severity findings from AWS Trusted Advisor.

AWS Config Architecture: Recorders, Configuration Items & Snapshots

While AWS CloudTrail records API calls, AWS Config tracks point-in-time resource configurations, historical relationships, and compliance against desired baselines.

The Core Engine

• Configuration Recorder: Detects configuration changes in supported AWS resources within a region. It can record all supported resource types (including global resources like IAM) or specific resource categories.
• Configuration Items (CIs): A CI is a standardized JSON representation of resource state generated whenever a resource is created, modified, or deleted. It captures:
  • Metadata: Resource ID, ARN, and creation timestamp.
  • Attributes: The complete configuration dictionary (e.g., instance type, VPC ID, tags).
  • Relationships: Linkages to other resources (e.g., an EC2 instance linked to a security group and subnet).
  • Related Events: The CloudTrail event ID that triggered the state change.
• Configuration History: A continuous timeline of CIs for any resource, showing exactly what changed, when, and by whom.
• Configuration Snapshots: Scheduled point-in-time exports of all CIs in an account/region delivered to an Amazon S3 bucket.

---

Config Rules: Managed vs. Custom & Evaluation Triggers

An AWS Config Rule evaluates resource configurations against desired compliance criteria, marking resources as COMPLIANT or NON_COMPLIANT.

Managed vs. Custom Rules

• Managed Rules: Over 300 pre-built, AWS-maintained rules implementing best practices:
  • s3-bucket-public-read-prohibited: Verifies S3 buckets prohibit public read access.
  • s3-bucket-server-side-encryption-enabled: Verifies default server-side encryption is active.
  • encrypted-volumes: Ensures attached EBS volumes are encrypted at rest.
  • restricted-ssh: Flags security groups allowing incoming port 22 traffic from 0.0.0.0/0.
  • root-account-mfa-enabled: Verifies the root account has active MFA.
  • iam-password-policy: Enforces account password complexity and rotation.
• Custom Rules: Lambda-backed rules for proprietary compliance logic (e.g., validating EC2 instances use approved golden AMIs). Config passes the CI to the Lambda function, which returns an evaluation via PutEvaluations.

Evaluation Trigger Types

• Configuration Change Triggers: Evaluated in near real-time whenever a monitored resource changes state (e.g., catching an engineer modifying a security group).
• Periodic Evaluation Triggers: Evaluated on a recurring frequency (1, 3, 6, 12, or 24 hours). Used for rules checking temporal conditions (e.g., certificate expiration within 30 days).

---

Automatic Remediation via Systems Manager (SSM) Automation Runbooks

Detecting violations is insufficient; non-compliant resources must be corrected automatically without human latency. AWS Config integrates directly with AWS Systems Manager (SSM) Automation Runbooks.

Remediation Workflow

1. Rule Evaluation: Config identifies a non-compliant resource (e.g., an unencrypted S3 bucket).
2. SSM Document Selection: The rule links to an AWS-managed runbook (e.g., AWS-EnableS3BucketEncryption or AWS-DisablePublicAccessForS3Bucket).
3. Parameter Mapping: Config dynamically maps the non-compliant resource attribute ResourceId into the runbook's target parameter (e.g., BucketName or GroupId).
4. Execution Role: Config invokes the runbook using an AutomationAssumeRole granted permissions to modify the target resource.
5. Execution Mode & Retries: Can run in Automatic mode (triggering immediately upon non-compliance) or Manual mode. Configurable retry controls (e.g., 3 retries with 60-second backoff) handle eventual consistency delays.

---

Config Conformance Packs & Organization Conformance Packs

Managing individual Config rules across dozens of accounts leads to severe configuration drift. An AWS Config Conformance Pack packages rules and automated remediations into a single declarative YAML template.

Standard Compliance Frameworks

AWS provides pre-architected conformance pack templates for major regulatory standards including CIS AWS Foundations Benchmark, NIST SP 800-53, PCI-DSS, and HIPAA.

Organization Conformance Packs

Deployed from the AWS Organizations management account or delegated administrator account:

• Enterprise-Wide Deployment: Rolls out rules and remediations simultaneously across all member accounts or targeted OUs.
• Automatic Account Onboarding: Newly provisioned accounts joining an OU automatically inherit the conformance pack.
• Immutable Guardrails: Member account administrators cannot modify, disable, or delete organization conformance packs or their rules.
• Config Aggregators: Multi-account multi-Region data aggregators consolidate inventory and compliance metrics into a single centralized dashboard.

---

Remediating Findings from AWS Trusted Advisor Security Checks

AWS Trusted Advisor continuously monitors account security posture across critical operational checks:

Event-Driven Trusted Advisor Remediation

Trusted Advisor publishes status change events to Amazon EventBridge when a check transitions to WARN or ERROR. An EventBridge rule captures the event and triggers automated containment:

1. When an "Exposed Access Keys" error is emitted, EventBridge triggers an AWS Lambda function or SSM runbook.
2. The automation extracts the compromised Access Key ID from the event detail.
3. The function calls iam:UpdateAccessKey with Status=Inactive within seconds, revoking credentials before exploitation.
4. An urgent alert is published to an Amazon SNS topic for security incident response.