AWS Config

AWS Config continuously records the configuration of your AWS resources, evaluates them against rules, and emits a timestamped change history per resource. It answers two questions: "what does this resource look like right now?" and "did it ever drift from the approved configuration?"

Key Features:

Common Use Cases:

Service Limits & Quotas:

Pricing Model:

Code Example — Enable a Managed Rule:


aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "s3-public-read-prohibited",
  "Source": {
    "Owner": "AWS",
    "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"
  },
  "Scope": {"ComplianceResourceTypes": ["AWS::S3::Bucket"]}
}'

aws configservice select-resource-config --expression \
  "SELECT resourceId, configuration.encrypted FROM AWS::EC2::Volume WHERE configuration.encrypted = false"

AWS Config is the system of record for resource state and policy compliance. Pair it with CloudTrail (which records actions) for a complete audit picture: CloudTrail tells you who ran ModifyDBInstance, Config tells you what the database looked like before and after.

Amazon Inspector

Amazon Inspector is an automated vulnerability management service that continuously scans EC2 instances, container images in ECR, and Lambda functions for software vulnerabilities (CVEs) and unintended network exposure. Inspector v2 is agentless for ECR and Lambda and uses the SSM agent for EC2.

Key Features:

Common Use Cases:

Service Limits & Quotas:

Pricing Model:

Code Example — Enable Inspector and Filter Findings:


aws inspector2 enable --resource-types EC2 ECR LAMBDA

aws inspector2 list-findings --filter-criteria '{
  "severity": [{"comparison": "EQUALS", "value": "CRITICAL"}],
  "findingStatus": [{"comparison": "EQUALS", "value": "ACTIVE"}]
}' --max-results 50

Common Interview Questions:

How is AWS Config different from CloudTrail?

CloudTrail logs API calls (the verb — who called what API). Config records resource state and changes (the noun — what the resource looked like before and after). They are complementary: an investigation typically starts in Config (what changed) and pivots to CloudTrail (who did it).

What's a conformance pack?

A bundle of Config rules + optional remediation actions packaged as a CloudFormation template, deployable to one account or across an organization. AWS publishes conformance packs aligned to HIPAA, PCI, NIST, CIS, and more.

How do you keep Config costs under control?

Use recording filters to exclude high-churn types (e.g., AWS::Lambda::Function versions, ENIs in heavy ASG accounts), record global resource types in only one region, and don't enable both periodic and change-triggered evaluations on the same rules unless required.

What does Inspector scan and how is v2 different from classic Inspector?

Inspector v2 covers EC2 (OS packages via SSM agent), ECR container images, and Lambda functions and dependencies — continuously and agentlessly where possible. Classic Inspector required deploying the Inspector agent and running on-demand assessments; v2 is always-on.

How do you handle a critical CVE finding from Inspector?

Triage by Inspector score (factors exposure and exploitability beyond raw CVSS), suppress accepted risk via suppression rules, route findings to Security Hub or Jira via EventBridge, and integrate with SSM Patch Manager for OS patches or container rebuilds for ECR images.

Can Inspector check for misconfigurations like open S3 buckets?

No — Inspector focuses on software vulnerabilities and network reachability of compute. Misconfigurations of services like S3 are AWS Config's domain, with results aggregated in Security Hub alongside Inspector findings.

© Kevin Thomas Luzbetak, MSc