Audit AWS Resources using AWS Config | Fit-DevOps
By: Rahul K
Tags: AWS, Aws Config, Compliance, Security, Cis Benchmarks

This Blog was originally published at https://fitdevops.in

All the Latest updates and Contents will be published there.

Don’t forget to check as I will post content everyday…

In my previous blog, I have explained on How you can set up monitoring systems for tracking IAM users activity and the API usage in the AWS services, Check here.

In this guide, We will learn how to set up an auditing system for the AWS resources using AWS Config.

What is AWS Config?

The public cloud providers such as AWS offers a variety of features such as High availability, Scaling, Serverless and much more.

But the most important thing is to ensure that the services we use are secure enough, that’s where AWS config has come in.

AWS Config is used for assessing, auditing and monitoring configuration changes in the AWS cloud.

It gives a detailed view of all the configurations of the AWS resources such as EBS , EC2 , VPC , security group and so on.

What AWS Config can do?

It helps us to provide the configurations of one or more services in the aws account.

Helps us to evaluate AWS resource configurations for desired settings.

Provides the backup of the current settings applied to the AWS resources.

Provides historical configurations of one or more resources.

Send out a notification whenever a change happens such as create , delete and modify.

Provide information about the relationship between AWS services.

Different Ways to Use AWS Config

Resource Administration

Managing and troubleshooting configuration changes

Auditing and Compliance

Security Analysis

How does AWS Config Work?

When the AWS config is enabled for the first time , It scans all the supported existing AWS resources and creates a configuration item for each resource.

When there is a change in the existing resources or new resources are created, AWS config will also record the same and maintains a historical record for the configuration items.

We can either allow the AWS config to create configuration items for all the supported AWS resources or we can enable only for the particular AWS services.

Setting Up AWS Config using Console

To set up AWS config, Login to AWS Config console.

and then click Get started

Lists of Supported Resource Types : API Gateway , Cloudwatch , Cloudfront , Dynamo DB , EBS , EC2 , Elasticsearch , Redshift , RDS , Quantum Ledger database , S3 , SQS , SNS , VPC , Auto scaling , ACM , Cloudformation , Cloudtrail , CodeBuild , CodePipeline , Elastic Beanstalk , IAM , KMS , Lambda , Secrets Manager , Shield , Service Catalog , Systems Manager , WAF , X-Ray and Elastic Load Balancing.

Under Settings , You can enable AWS config to record configurations for all the supported AWS resources or you can enable only for the particular AWS resources.

To enable for all resources , Choose All resources and to track global services such as IAM , Enable it.

I would suggest you enable IAM to keep track of changes in the IAM users , groups , Roles and Policies.

To enable for particular resources , Under Specific types , Select the services

You can select multiple AWS services.

Under Amazon S3 bucket , The S3 bucket will be used to store the snapshot of all the configuration items and the configuration history which is recorded by the AWS config.

You can create a bucket from here on the go , Or you can use the existing S3 bucket. Check here for more detail

You can also store the AWS config snapshot in the S3 bucket which is in another AWS account. But Make sure the permission to store the configuration item is provided for the AWS config.

We can also use the folder/prefix within the bucket to store the configs.

Under Amazon SNS Topic, We can use SNS topic to alert us for the following cases such as Configuration history delivery, compliance, configuration snapshot delivery.

You can use an existing topic or you can create an SNS topic with subscribers in your account.

We can also choose an SNS topic from another AWS account, But make sure the SNS topic has granted permission for the AWS config.

Under AWS Config role , we need to grant read-only permission for the AWS config for all the supported AWS services.

Also we should grant permission to put config items to S3 and SNS access to sent notifications.

We can use the existing service-linked role, already created by AWS or you can create a role and assign the same to the AWS config.

and then click Next

For AWS Config rules , We can apply existing one or more rules against the AWS resources.

We can either apply the existing rule while creating the AWS config , or we can apply the existing rules after the AWS config is created.

We can also create our own custom rules and we can apply the same.

It will be highlighted If you select the rules.

and then Click Next

Review the Settings of the AWS config and then click Confirm.

It will take some time to set up the AWS config.

Once the AWS config is created , From the Dashboard , Click Status

You will get the status of the configurations.

Configuration Snapshot : It is the collection of configuration items for the supported AWS resources that exist in your account.

Configuration History : A collection of configuration items over a given period of time for the provided AWS resources.

Configuration Stream : It’s an automatically updated list of all the configuration items for the resources that AWS config is recording.

This is how the AWS config dashboard represents all the details.

It will take some time to discover all the resources.

Conclusion

We have successfully implemented an auditing system for the AWS resources using AWS config.

Hope you find it helpful. Please check out my other publications.