Hey everyone, welcome to another episode of 'Back To Basics',
I'm Chloe, a Partner Solutions Architect at AWS.
Today we're going to talk about some of the architectural best practices
when using AWS Config and Conformance Packs
to help you manage your resource configurations.
To get started, let's just talk about what AWS Config is
and what Conformance Packs are.
Config is a service that lets you assess and audit your AWS infrastructure
by monitoring and recording your resource configurations.
This service lets you create managed rules, which are predefined, customizable rules,
that AWS uses
to evaluate whether your resources comply with common best practices.
These rules can encompass a lot of use cases
around security, audit, or even cost optimization.
For example, there's a Config rule to check your Amazon S3 buckets
to make sure that there isn't any public access on an account level.
Config will take a look at your S3 buckets
and make sure that they're in a desired configuration state
to keep them in compliance.
If you have an S3 bucket that meets these requirements,
it will be marked as compliant.
Otherwise, your resource will be marked as non-compliant.
As you can see, in this example,
Config will look at the S3 buckets in your environment
anytime they're created or modified.
Here, one bucket has public access and the other one doesn't.
As a result, one will be marked as compliant, and the other one as non-compliant.
With Config, there's actually a lot of flexibility that comes with the service,
which is awesome,
because you can use it to cater to your specific workloads.
For example, let's say you have a rule in mind
that isn't created by AWS.
You can create a custom Config rule.
These are backed by AWS Lambda functions.
When you actually create the custom rule, you're going to point it to a Lambda function.
With custom rules, you can really customize Config,
so that you can mark any resource as compliant or non-compliant.
For example, let's say I want to build an author my own rule
that ensures that all of my EBS volumes
are next generation gp3 volumes.
Right now, that rule isn't managed or created by AWS,
so I would need to build a custom Config rule for that.
Another really great feature of Config
is the ability to remediate non-compliant resources.
So I showed you what it looks like when there is a non-compliant resource type,
but what can we actually do about that.
Config is going to let you perform remediation actions
in response to your non-compliant items.
These are done using Systems Manager Automation Documents.
So we can trigger some type of mechanism
to put the resource back into its desired state.
In our last example, the automation document
would modify the S3 bucket
from non-compliant with public access
to compliant with no public access.
The last feature I want to discuss is conformance packs.
With Config, you have the ability to bundle numerous rules together as a pack
that can be deployed as a single entity, known as Conformance Packs.
These are defined as YAML templates,
and they're a group of Config rules that are immutable.
Users cannot make changes to the rules
unless there's an update to the Conformance Packs.
AWS provides sample templates
for various compliance standards and industry benchmarks.
For example, there are templates around HIPAA security and FedRAMP.
There are also Conformance Packs with Config rules
that help with cost management or operational best practices,
such as the best practices for Amazon EC2 or for database resiliency.
With Conformance Packs,
you can incorporate custom rules and managed rules.
Can also incorporate remediations
if you want to remediate non-compliant resources.
Now let's take a look at our end-to-end architecture,
that leverages Config and Conformance Packs.
Our setup consists of a workload
with various resources in AWS.
Here, you can see there are resources
like Amazon EC2 and S3 bucket,
and a database on Amazon RDS.
To manage this environment,
we can use Config and Conformance Packs.
Because we have a lot of flexibility,
with how we want to build this Conformance Pack.
We can include AWS Manage Rules and custom Config rules.
There you can see the custom config rules in this Conformance Pack,
which I mentioned are backed by Lambda functions.
These custom Config rules
would first be deployed into your account,
and then you could refer to them within the YAML template
that you create for your Conformance Pack.
In addition to your Config rules,
your Conformance Pack would also include
Systems Manager Automation Documents.
As a result, you'd be able to trigger API calls or scripts
to actually execute actions on your AWS resources.
This way you can modify your non-compliant resource types
to move into a desired state.
As you can see here,
you now have an AWS environment
that is effectively govern and optimized
by using AWS Config and Conformance Pack.
To summarize, in this episode,
you learned some of the best practices
for using AWS Config and Conformance Packs,
to make sure your resource configurations remain in compliance.
Please check out the links below for more details.
Thank you for watching 'Back To Basics',
and see you next time.