Config Rules, Patching, Backup, and Regulatory Controls
Key Takeaways
- AWS Config conformance packs bundle managed or custom rules with Systems Manager Automation remediation and can deploy across an organization; auto-remediation uses a periodic compliance snapshot, so start manual in production.
- Patch Manager compliance is defined by your patch baseline, not by AWS or CVSS; patch policies in Quick Setup are the documented way to scan and install across accounts and Regions.
- AWS Backup legal holds do not expire until released and delay lifecycle deletes; Vault Lock compliance mode becomes immutable after a grace time of at least 3 days and is a different control from a legal hold.
- AWS Shield Standard is automatic at no additional charge; AWS WAF associates a web ACL with an existing ALB or CloudFront distribution, and you should test rules in count mode before Block.
- Amazon GuardDuty and AWS Security Hub CSPM are enable-and-delegate controls on running accounts; Security Hub does not backfill findings from before you turned it on.
Improve compliance on workloads that are already in production
Quick Answer: Turn on AWS Config rules and conformance packs with Systems Manager Automation remediation, patch existing fleets with Patch Manager, protect recovery points with AWS Backup plans, vaults, Vault Lock, and legal holds, then attach AWS WAF, confirm AWS Shield Standard, and enable Amazon GuardDuty plus AWS Security Hub CSPM on accounts that already serve checkout traffic.
HarborPay's landing zone already records some resources, but S3 buckets still drift public, Amazon Linux nodes miss security patches, and backup retention was set by whoever launched the first RDS instance. SAP-C02 Task 3.2 is the improvement process for that deployed environment. Deeper organization-trail construction lives in the data-protection chapter. Task 2.3 (new large-scale web applications) would have placed WAF and Shield in the original design; here you bolt those controls onto the ALB and accounts that already exist.
Config: managed rules, custom rules, packs, and remediation
AWS Config evaluates resource configuration against rules. Managed rules are AWS-authored checks (public S3 access, unused IAM credentials, required tags, and many others). Custom policy rules use the Guard policy-as-code language and do not require a Lambda function; they evaluate on configuration changes. Custom Lambda rules run your Java or Python function when Config invokes it.
A conformance pack is a YAML collection of managed or custom rules plus remediation actions, deployable to one account and Region or across the organization. Sample packs that mention CIS or PCI are starting templates. AWS states they are not designed to ensure compliance with a specific governance standard and cannot replace HarborPay's own PCI assessment. Organizational packs need Config recording. Packs with remediation need an Automation assume-role ARN; AWS Config does not support CloudFormation intrinsic functions for that role ARN or for ConfigRuleName.
Remediation uses AWS Systems Manager Automation documents (managed or custom). You can also invoke AWS Lambda from an Automation document. Start with manual remediation in production. Automatic remediation can be attached to a rule; AWS documents that auto-remediation uses a periodic compliance snapshot, so a resource that became noncompliant between snapshots can be remediated from stale state, and auto-remediation can even start for resources that later look compliant. Retry count and interval are configurable. You cannot manage remediations for service-linked Config rules.
Recorders and a delivery channel must already be on before a pack does useful work. Security Hub CSPM (later in this section) depends on Config resource recording for most of its controls.
Patch Manager on existing fleets
Patch Manager automates operating-system patching and, on Windows Server, updates for applications released by Microsoft. It covers Amazon EC2, on-premises servers, and edge devices that run the Systems Manager Agent. AWS does not test patches before they appear in Patch Manager, and Patch Manager does not perform major OS upgrades (for example Windows Server 2016 to 2019, or RHEL 7 to RHEL 8).
Compliance is not defined by AWS, by CVSS, or by NVD. You define it in a patch baseline: classifications, severity, wait-days after release, and optional approved or rejected patch lists. Predefined baselines are examples; AWS recommends custom baselines so HarborPay controls what PCI fleets must install.
Operation methods, from broadest to most tactical:
- Patch policies in Quick Setup (recommended) — one policy for the organization, selected organizational units, or a single account-Region pair, with separate scan versus install schedules.
- Host Management Quick Setup — scan-only using the current default baseline; it does not install.
- Maintenance Windows — a
ScanorScan and installtask in one account-Region pair. - Patch now — on-demand, also one account-Region pair.
Use Scan first on the PCI fleet, then Scan and install inside a change window with concurrency and error thresholds. Send compliance to Security Hub CSPM. Lifecycle hooks can run SSM documents before and after patching. Rate control exists so a bad baseline does not reboot every node at once.
Backup plans, vaults, locks, and legal holds
AWS Backup organizes backup plans (schedules, lifecycle to cold storage, cross-Region or cross-account copy) and backup vaults (containers; you choose a KMS key when you create a vault). Existing RDS databases and EBS volumes should be assigned to a plan rather than left as one-off snapshots with accidental seven-day retention.
AWS Backup Vault Lock has no additional lock charge (standard backup storage still bills). Governance mode can be removed by principals with enough IAM. Compliance mode becomes immutable after grace time, which AWS requires to be at least 3 days (72 hours) and, for ChangeableForDays, no greater than 36,500 days. After grace time, no user—including the account root user—can shorten retention or delete recovery points until the backup lifecycle ends. Minimum and maximum retention on the lock apply to new backup and copy jobs, not to recovery points already in the vault. AWS Backup publishes a Cohasset Associates assessment discussing SEC 17a-4, CFTC, and FINRA; that assessment is not HarborPay's PCI Report on Compliance.
A legal hold is a different control. It is an administrative hold that does not expire until a permitted user releases it. Lifecycle policies that would delete a recovery point are delayed. Holds and backups have a many-to-many relationship. Use a legal hold when counsel freezes checkout backups during a dispute. Use Vault Lock when the vault must enforce write-once retention. Do not delete recovery points to make a vault smaller while a hold is in force, and do not use Patch Manager to freeze database snapshots.
WAF, Shield, GuardDuty, and Security Hub on running apps
Associate an AWS WAF protection pack (web ACL) with the existing ALB, Amazon CloudFront distribution, Amazon API Gateway stage, or other supported resource. Rules can match IP, country, strings, size, SQL injection, and cross-site scripting; rate-based rules count requests in a one-minute window. Test in count mode on production before you switch to Block. Using more than 1,500 web ACL capacity units (WCUs) incurs cost beyond the basic web ACL price. Rule updates can take seconds to minutes to propagate.
AWS Shield Standard is automatic and at no additional charge for every AWS customer. Amazon Route 53 hosted zones, CloudFront distributions, and Global Accelerator standard accelerators receive comprehensive network and transport-layer availability protection. Shield Advanced is a paid subscription for application-layer detection, automatic layer-7 mitigation, Shield Response Team engagement, and cost-protection capabilities AWS documents for Advanced. The Advanced subscription covers standard WAF fees for resources you protect with Advanced, with documented exceptions such as Bot Control, CAPTCHA, more than 1,500 WCUs, and oversized body inspection. Advanced includes the Layer 7 Anti-DDoS managed rule group and documents 50 billion WAF requests per calendar month on protected resources, with additional requests billed. Do not invent a dollar price; read current Shield and WAF pricing pages when a scenario mentions cost.
Amazon GuardDuty begins ingesting CloudTrail management events, VPC flow logs, and DNS query logs when you enable it. Extended Threat Detection is included at no extra GuardDuty feature charge. Protection plans (S3, EKS, RDS, malware, Lambda, Runtime Monitoring, AI) add sources; AWS documents 30-day trial behavior for new enablement. Use AWS Organizations with a delegated administrator so production member accounts are not left dark.
AWS Security Hub CSPM aggregates findings in AWS Security Finding Format (ASFF) and runs standards such as AWS Foundational Security Best Practices (FSBP), CIS, PCI DSS, and NIST. It does not backfill findings generated before you enabled it, and it processes findings only in Regions where it is on. Most controls need Config recording. First enablement includes a 30-day Security Hub CSPM free trial; you can still incur Config item charges. Use automation rules and Amazon EventBridge to ticket or remediate. For CIS-style coverage AWS tells you to enable Security Hub CSPM in all supported Regions.
| Control | What you add to the running stack | What it is not |
|---|---|---|
| Config plus a conformance pack | Continuous drift detection and optional SSM remediation | A PCI certification |
| Patch Manager | Fleet-defined patch compliance with scan then install | A vendor-tested patch oracle or a major OS upgrade |
| AWS Backup legal hold versus Vault Lock | Indefinite litigation freeze versus WORM vault retention | Interchangeable features |
| WAF plus Shield Standard | HTTP filtering plus always-on layer-3/4 DDoS | A greenfield AWS Network Firewall rebuild |
| GuardDuty plus Security Hub CSPM | Threat findings plus posture checks | Retroactive history from last year |
Run this improvement process:
- Confirm Config recorders in every account that owns PCI data, then deploy a pack with S3 public-access and encryption rules.
- Remediate the first noncompliant buckets manually; enable auto-remediation only for low-risk rules after you trust the Automation document.
- Roll a Quick Setup patch policy: weekly scan, install in the maintenance window, custom baselines for Amazon Linux and Windows Server.
- Assign data stores to an AWS Backup plan; start Vault Lock in governance mode; place a legal hold only when counsel requests it.
- Associate WAF in count mode, verify Shield Standard, decide on Shield Advanced for the public hostname, and enable GuardDuty and Security Hub CSPM with a delegated administrator.
Traps: auto-remediating every Config rule on day one; treating sample conformance packs as an auditor's sign-off; compliance-mode Vault Lock while recovery points are set to keep forever; skipping WAF count mode; expecting Security Hub CSPM to display last year's GuardDuty findings.
Official resources
HarborPay's AWS Config recorder is already on in the PCI accounts, but Amazon S3 buckets keep drifting to public access control lists after application teams ship hotfixes. Leadership wants organization-wide detection and a repeatable fix without rebuilding buckets in a new account. Which approach matches Task 3.2 improvement of the running environment?
Counsel issues a hold on HarborPay checkout database backups after a cardholder dispute. Separately, Amazon Linux 2023 fleets show missing security patches. Which pair of actions improves the existing environment without mixing the two controls?
HarborPay's public checkout API already sits behind an Application Load Balancer in two Regions. A PCI assessor wants application-layer HTTP filtering and a clear DDoS posture without a greenfield network redesign. Which design improves the running application?