AWS Config
A service that records and evaluates the configuration of AWS resources for compliance.
AWS Config continuously records the configuration state of AWS resources and evaluates those states against rules you define or select from a managed library. When a resource drifts out of compliance — for example, an S3 bucket becomes publicly accessible or a security group opens port 22 — Config flags the violation and can trigger automatic remediation through Systems Manager Automation. The key exam distinction is that Config answers “what does my resource look like, and was it ever different?” while CloudTrail answers “who made a change, and when?” Both support compliance, but Config focuses on resource state and rule evaluation, not API call logging.
PlayPrepHQ study notes are written and reviewed against primary exam sources. How we create & review content →