Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

How Amazon Config Works

When you turn on Amazon Config, it first discovers the supported Amazon resources that exist in your account and generates a configuration item for each resource.

Amazon Config also generates configuration items when the configuration of a resource changes, and it maintains historical records of the configuration items of your resources from the time you start the configuration recorder. By default, Amazon Config creates configuration items for every supported resource in the region. If you don't want Amazon Config to create configuration items for all supported resources, you can specify the resource types that you want it to track.

Before specifying a resource type for Amazon Config to track, check Resource Coverage by Region Availability to see if the resource type is supported in the Amazon Region where you are setting up Amazon Config. If a resource type is supported by Amazon Config in at least one Region, you can enable the recording of that resource type in all Regions supported by Amazon Config, even if the specified resource type is not supported the Amazon Region where you are setting up Amazon Config.

Amazon Config keeps track of all changes to your resources by invoking the Describe or the List API call for each resource in your account. The service uses those same API calls to capture configuration details for all related resources.

For example, removing an egress rule from a VPC security group causes Amazon Config to invoke a Describe API call on the security group. Amazon Config then invokes a Describe API call on all of the instances associated with the security group. The updated configurations of the security group (the resource) and of each instance (the related resources) are recorded as configuration items and delivered in a configuration stream to an Amazon Simple Storage Service (Amazon S3) bucket.

Amazon Config also tracks the configuration changes that were not initiated by the API. Amazon Config examines the resource configurations periodically and generates configuration items for the configurations that have changed.

If you are using Amazon Config rules, Amazon Config continuously evaluates your Amazon resource configurations for desired settings. Depending on the rule, Amazon Config will evaluate your resources either in response to configuration changes or periodically. Each rule is associated with an Amazon Lambda function, which contains the evaluation logic for the rule. When Amazon Config evaluates your resources, it invokes the rule's Amazon Lambda function. The function returns the compliance status of the evaluated resources. If a resource violates the conditions of a rule, Amazon Config flags the resource and the rule as noncompliant. When the compliance status of a resource changes, Amazon Config sends a notification to your Amazon SNS topic. The following image displays an overview of how Amazon Config works.

Deliver Configuration Items

Amazon Config can deliver configuration items through one of the following channels:

Amazon S3 Bucket

Amazon Config tracks changes in the configuration of your Amazon resources, and it regularly sends updated configuration details to an Amazon S3 bucket that you specify. For each resource type that Amazon Config records, it sends a configuration history file every six hours. Each configuration history file contains details about the resources that changed in that six-hour period. Each file includes resources of one type, such as Amazon EC2 instances or Amazon EBS volumes. If no configuration changes occur, Amazon Config does not send a file.

Amazon Config sends a configuration snapshot to your Amazon S3 bucket when you use the deliver-config-snapshot command with the Amazon CLI, or when you use the DeliverConfigSnapshot action with the Amazon Config API. A configuration snapshot contains configuration details for all resources that Amazon Config records in your Amazon account. The configuration history file and configuration snapshot are in JSON format.

Amazon SNS Topic

An Amazon Simple Notification Service (Amazon SNS) topic is a communication channel that Amazon SNS uses to deliver messages (or notifications) to subscribing endpoints such as an email address or clients. Other types of Amazon SNS notifications include push notification messages to apps on mobile phones, Short Message Service (SMS) notifications to SMS-enabled mobile phones and smart phones, and HTTP POST requests. For best results, use Amazon SQS as the notification endpoint for the SNS topic and then process the information in the notification programmatically.

Amazon Config uses the Amazon SNS topic that you specify to send you notifications. The type of notification that you are receiving is indicated by the value for the messageType key in the message body, as in the following example:

"messageType": "ConfigurationHistoryDeliveryCompleted"

The notifications can be any of the following message types:

For example notifications, see Notifications that Amazon Config Sends to an Amazon SNS topic.

For more information about Amazon SNS, see the Amazon Simple Notification Service Developer Guide.