Having outlined in Part 1 how instances in AWS can be managed using AWS System Manager, in this article we will examine how the deployed instances and services can be checked for compliance – that is, to ensure that the configuration of the systems adheres to company policies.
AWS Config is a tool that continuously monitors an account’s AWS environment and records when new resources are provisioned or the configuration of one or more resources is changed. This enables various actions to be taken, ranging from simply triggering an alert to ‘restoring the system to a compliant state’. Although AWS Config operates as a pure reporting tool independently of System Manager, it is advisable to add resources to System Manager before they are checked by AWS Config.
Setting up AWS Config
AWS Config can be launched via the Services menu or directly via the search bar. If no Config environment has yet been configured, one can be created very easily. In the first setup step, there are three options to choose from regarding which resources should be included in AWS Config:
- All resources (no exceptions, ‘wildcard’)
- All resources, but with defined exceptions, or
- Only specific resources.
To start with, it is advisable to select all resources (which is also a good way to get an overview of the resources deployed).
The required IAM roles can be created automatically – as is standard practice with AWS. Finally, an S3 bucket is selected or created, in which the reports generated by AWS Config will be stored.
The second installation step already offers a glimpse into the capabilities of AWS Config. Here, you can now (though you do not have to) specify which compliance rules should be applied to the production environment. Given the sheer number of rules, it is advisable to start by defining a manageable set of rules, the effects of which can be checked immediately.
In the example, four rules were defined for EC2 instances:
- Checking whether enhanced monitoring has been enabled for an EC2 instance (this setting incurs a charge for EC2 instances)
- Checking whether an EC2 instance is managed by Systems Manager (important for patches, updates, configuration changes, etc.)
- Check whether an EC2 instance is using multiple Elastic Network Interfaces (ENIs) (usually only one is required here)
- Checking whether an EC2 instance has a public IP address (and is therefore potentially accessible from outside the network)
Naturally, these rules can be configured in greater detail at a later stage. Once the configuration is complete, the first notifications should appear in the dashboard within a short time.
Checking and restoring resource compliance
To check the compliance status, it is worth taking a look at the dashboard. Here, AWS Config provides a quick overview of the status and any potential violations.
In the following example, AWS Config has detected violations of three rules, whilst the fourth rule (multiple ENIs) is considered compliant (see ‘Compliance Status’). The non-compliant rules and the relevant resources are listed in the box below. Clicking on the respective rule then displays the affected resources.
To restore compliance, the configuration of the affected resources can be adjusted, for example, via System Manager.
A valuable feature of AWS Config is that it provides a very comprehensive catalogue of rules covering ‘Operational Best Practices’ and ‘Security Best Practices’, which serves as a good starting point for further compliance considerations. Even certification requirements can be specified here as compliance aspects. Sets of rules from this catalogue can in turn be grouped into ‘compliance packages’ to map different compliance requirements for systems where necessary.
If you find that the existing rules do not cover the required compliance requirements, you have the option to design your own rules. For example, to trigger a Lambda function or to define a custom policy from AWS Guard as a rule.
Conclusion
: AWS Config is another easy-to-use tool that makes it very straightforward to monitor the AWS environment centrally. It is particularly, though not exclusively, suitable for organisations with high IT compliance requirements, but can also help any organisation prevent unintended configuration changes (which can sometimes prove very costly).
All posts in our blog series on AWS system management tools:
Part 1 – Managing cloud environments with AWS Systems Manager
Part 2 – Monitoring compliance in the AWS cloud with AWS Config
Part 3 – Organising accounts with AWS Organizations
Part 4 – Successfully monitoring containers with AWS CloudWatch
