Amazon Config

AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This includes how the resources are related to one another and how they were configured in the past, enabling assessment, auditing, and evaluation of configurations for compliance and security governance. It records configuration changes continuously, evaluates compliance against rules, and supports automated remediation of noncompliant resources.

1 APIs 8 Features

AuditingComplianceConfiguration ManagementGovernanceSecurity

APIs

Amazon Config API

The AWS Config API provides 92 operations for managing configuration recording, evaluating resource compliance against rules, querying resource configurations, tracking configur...

MCP Servers

amazon-config-mcp.yml

MCP SERVER

Features

Configuration Recording

Continuously record configuration changes to all supported AWS resources in your account with detailed configuration items.

Config Rules

Evaluate AWS resource configurations against desired settings using AWS-managed or custom Lambda-based rules.

Conformance Packs

Deploy collections of Config rules and remediation actions as a single unit across an AWS Organization.

Configuration History

View detailed configuration history for any AWS resource including who changed what and when.

Resource Inventory

Maintain a complete inventory of all AWS resources in your account with current and past configurations.

Automated Remediation

Automatically remediate noncompliant resources using SSM Automation documents triggered by Config rules.

Multi-Account Aggregation

Aggregate configuration and compliance data from multiple accounts and regions into a single view.

Advanced Query

Use SQL-like queries to search across resource configurations and compliance states.

Use Cases

Security and Compliance Auditing

Continuously audit AWS resource configurations against security benchmarks like CIS, PCI DSS, and HIPAA.

Change Management

Track who changed what configuration on which resource and when for change management and troubleshooting.

Resource Inventory

Maintain an always-current inventory of all AWS resources for asset management and CMDB purposes.

Drift Detection

Detect configuration drift from approved baselines and trigger alerts or automated remediation.

Incident Investigation

Reconstruct the configuration state of resources at any point in time to aid incident investigation.

Governance at Scale

Enforce organization-wide governance policies using conformance packs deployed across all accounts.

Integrations

AWS CloudTrail

Correlate Config configuration items with CloudTrail API activity to understand who made changes.

AWS Security Hub

Send Config compliance findings to Security Hub for centralized security posture management.

Amazon S3

Deliver configuration snapshots and history to S3 for long-term storage and analysis.

Amazon SNS

Send notifications for compliance changes and configuration changes via SNS topics.

AWS Systems Manager

Use SSM Automation documents as remediation targets for Config rules.

AWS Organizations

Deploy Config rules and conformance packs across entire AWS Organizations for governance at scale.

AWS Lambda

Create custom Config rules using Lambda functions for organization-specific compliance requirements.

Semantic Vocabularies

Amazon Config Context

227 classes · 326 properties

JSON-LD

API Governance Rules

Amazon Config API Rules

22 rules · 8 errors 10 warnings 4 info

Config Delete Delivery Channel Request Example

1 fields

EXAMPLE

Config Delete Evaluation Results Request Example

1 fields

EXAMPLE

Config Delete Evaluation Results Response Example

EXAMPLE

Config Delete Organization Config Rule Request Example

1 fields

EXAMPLE

Config Delete Organization Conformance Pack Request Example

1 fields

EXAMPLE

Config Delete Pending Aggregation Request Request Example

2 fields

EXAMPLE

Config Delete Remediation Configuration Request Example

2 fields

EXAMPLE

Config Delete Remediation Configuration Response Example

EXAMPLE

Config Delete Resource Config Request Example

2 fields

EXAMPLE

Config Delete Retention Configuration Request Example

1 fields

EXAMPLE

Config Delete Stored Query Request Example

1 fields

EXAMPLE

EXAMPLE

Config Put External Evaluation Request Example

2 fields

EXAMPLE

4 fields

EXAMPLE

Config Supplementary Configuration Example

EXAMPLE

Config Tag Example

2 fields

EXAMPLE

Config Tag Resource Request Example

2 fields

EXAMPLE

Config Tags Example

EXAMPLE

Config Template Ssm Document Details Example

2 fields

EXAMPLE

Config Time Window Example

2 fields

EXAMPLE

Config Untag Resource Request Example

2 fields

EXAMPLE

Resources

VulnerabilityDisclosure

VulnerabilityDisclosure

GitHubOrganization

Sources

aid: amazon-config
url: https://raw.githubusercontent.com/api-evangelist/amazon-config/refs/heads/main/apis.yml
name: Amazon Config
type: Index
image: https://kinlane-productions.s3.amazonaws.com/apis-json/apis-json-logo.jpg
specificationVersion: '0.19'
description: AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This includes
  how the resources are related to one another and how they were configured in the past, enabling assessment, auditing, and
  evaluation of configurations for compliance and security governance. It records configuration changes continuously, evaluates
  compliance against rules, and supports automated remediation of noncompliant resources.
created: '2024-01-15'
modified: '2026-06-20'
tags:
- Auditing
- AWS
- Compliance
- Configuration Management
- Governance
- Security
apis:
- name: Amazon Config API
  description: The AWS Config API provides 92 operations for managing configuration recording, evaluating resource compliance
    against rules, querying resource configurations, tracking configuration history, managing conformance packs, configuring
    remediation, and aggregating configuration data across accounts and regions for comprehensive governance.
  image: https://a0.awsstatic.com/libra-css/images/logos/aws_logo_smile_1200x630.png
  humanURL: https://aws.amazon.com/config/
  baseURL: https://config.amazonaws.com
  tags:
  - Auditing
  - AWS
  - Compliance
  - Configuration Management
  - Governance
  properties:
  - type: Documentation
    url: https://docs.aws.amazon.com/config/latest/developerguide/
  - type: OpenAPI
    url: openapi/amazon-config-openapi.yml
  - type: APIReference
    url: https://docs.aws.amazon.com/config/latest/APIReference/
  - type: Pricing
    url: https://aws.amazon.com/config/pricing/
  - type: GettingStarted
    url: https://aws.amazon.com/config/getting-started/
  - type: FAQ
    url: https://aws.amazon.com/config/faq/
  - type: JSONSchema
    url: json-schema/config-config-rule-schema.json
  - type: JSONStructure
    url: json-structure/config-config-rule-structure.json
  - type: JSON-LD
    url: json-ld/amazon-config-context.jsonld
  - type: Overlay
    url: overlays/amazon-config-openapi-overlay.yaml
  - type: ErrorCatalog
    url: errors/amazon-config-problem-types.yml
common:
- type: TrustCenter
  url: security/amazon-config-trust-center.yml
- type: VulnerabilityDisclosure
  url: security/amazon-config-vulnerability-disclosure.yml
- type: DomainSecurity
  url: security/amazon-config-domain-security.yml
- type: Authentication
  url: authentication/amazon-config-authentication.yml
- type: Portal
  url: https://aws.amazon.com/
- type: Website
  url: https://aws.amazon.com/config/
- type: Documentation
  url: https://docs.aws.amazon.com/config/
- type: TermsOfService
  url: https://aws.amazon.com/service-terms/
- type: PrivacyPolicy
  url: https://aws.amazon.com/privacy/
- type: Support
  url: https://aws.amazon.com/support/
- type: Blog
  url: https://aws.amazon.com/blogs/mt/
- type: GitHubOrganization
  url: https://github.com/aws
- type: Console
  url: https://console.aws.amazon.com/config/
- type: SignUp
  url: https://portal.aws.amazon.com/billing/signup
- type: Login
  url: https://signin.aws.amazon.com/
- type: StatusPage
  url: https://health.aws.amazon.com/health/status
- type: YouTube
  url: https://www.youtube.com/user/AmazonWebServices
- type: StackOverflow
  url: https://stackoverflow.com/questions/tagged/aws-config
- type: Contact
  url: https://aws.amazon.com/contact-us/
- type: SpectralRules
  url: rules/amazon-config-spectral-rules.yml
- type: Vocabulary
  url: vocabulary/amazon-config-vocabulary.yaml
- type: Packages
  url: packages/amazon-config-packages.yml
- type: WellKnown
  url: well-known/amazon-config-well-known.yml
- type: SecurityTxt
  url: well-known/amazon-config-security.txt
- type: MCPServer
  url: mcp/amazon-config-mcp.yml
- type: LLMsTxt
  url: llms/amazon-config-llms.txt
- type: Conformance
  url: conformance/amazon-config-conformance.yml
- type: Lifecycle
  url: lifecycle/amazon-config-lifecycle.yml
- type: Features
  data:
  - name: Configuration Recording
    description: Continuously record configuration changes to all supported AWS resources in your account with detailed configuration
      items.
  - name: Config Rules
    description: Evaluate AWS resource configurations against desired settings using AWS-managed or custom Lambda-based rules.
  - name: Conformance Packs
    description: Deploy collections of Config rules and remediation actions as a single unit across an AWS Organization.
  - name: Configuration History
    description: View detailed configuration history for any AWS resource including who changed what and when.
  - name: Resource Inventory
    description: Maintain a complete inventory of all AWS resources in your account with current and past configurations.
  - name: Automated Remediation
    description: Automatically remediate noncompliant resources using SSM Automation documents triggered by Config rules.
  - name: Multi-Account Aggregation
    description: Aggregate configuration and compliance data from multiple accounts and regions into a single view.
  - name: Advanced Query
    description: Use SQL-like queries to search across resource configurations and compliance states.
- type: UseCases
  data:
  - name: Security and Compliance Auditing
    description: Continuously audit AWS resource configurations against security benchmarks like CIS, PCI DSS, and HIPAA.
  - name: Change Management
    description: Track who changed what configuration on which resource and when for change management and troubleshooting.
  - name: Resource Inventory
    description: Maintain an always-current inventory of all AWS resources for asset management and CMDB purposes.
  - name: Drift Detection
    description: Detect configuration drift from approved baselines and trigger alerts or automated remediation.
  - name: Incident Investigation
    description: Reconstruct the configuration state of resources at any point in time to aid incident investigation.
  - name: Governance at Scale
    description: Enforce organization-wide governance policies using conformance packs deployed across all accounts.
- type: Integrations
  data:
  - name: AWS CloudTrail
    description: Correlate Config configuration items with CloudTrail API activity to understand who made changes.
  - name: AWS Security Hub
    description: Send Config compliance findings to Security Hub for centralized security posture management.
  - name: Amazon S3
    description: Deliver configuration snapshots and history to S3 for long-term storage and analysis.
  - name: Amazon SNS
    description: Send notifications for compliance changes and configuration changes via SNS topics.
  - name: AWS Systems Manager
    description: Use SSM Automation documents as remediation targets for Config rules.
  - name: AWS Organizations
    description: Deploy Config rules and conformance packs across entire AWS Organizations for governance at scale.
  - name: AWS Lambda
    description: Create custom Config rules using Lambda functions for organization-specific compliance requirements.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
  url: https://apievangelist.com