Lecture 255: AWS Config
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：08:44
- 来源：Udemy Lecture 33789886
- Slide 数量：6
- 画面切换：01:24、02:09、03:43、04:41、06:37
扫描说明
逐条读取了 Transcript 面板中的 194 条英文 cue，并按播放器进度同步全长约 8:44 的视频。依据 Config vs CloudTrail、Configuration Recorder、Config Rules、Evaluation Trigger、Remediation/Timeline 与 Detective/Aggregator 边界划分为 6 个小节。6 张截图来自真实课程 Slide，统一为 1364×770。课程录制时提到的 Managed Rule 数量会持续变化；讲义不把该数字作为考试记忆点，并补充了 EventBridge 新名称、SSM Automation Remediation 以及 Config/CloudTrail 的准确职责边界。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. CloudFormation 管 Provisioning，AWS Config 管 Configuration State 与变化历史
时间范围：00:00–01:24
总结 / Summary
中文
CloudFormation/Service Catalog 负责把资源 Provision 出来；AWS Config 持续记录受支持资源的 Configuration Item、Relationship 与状态变化，回答“某时刻资源长什么样、何时变了、与什么相连”。CloudTrail 记录 API/Event，回答“谁在何时从哪里调用了什么 API”。排障常把两者关联：Config 找到 Route Table、Security Group 或 Load Balancer 的配置变化，再通过 CloudTrail Event 确认 Actor、Source IP 与 API Detail。Config 本身不是完整的 API Audit Log。
English
CloudFormation and Service Catalog provision resources; AWS Config records configuration items, relationships, and state changes for supported resource types, answering what a resource looked like, when it changed, and what it was related to. CloudTrail records API events, answering who called which API, when, and from where. Troubleshooting often correlates them: Config identifies a route table, security group, or load balancer configuration change, then CloudTrail provides the actor, source IP, and API details. Config itself is not the complete API audit log.
Transcript
00:00 Hello and welcome to this lecture,
00:02 AWS Config.
00:03 So we already saw a couple of AWS management
00:05 and governance services including AWS cloud formation
00:08 and AWS service catalog.
00:10 Now the purpose of cloud formation and service catalog
00:13 is to provision the AWS resources,
00:16 that means the infrastructure for your solution.
00:19 And then once that is done,
00:21 probably you don't need to then look
00:23 at AWS cloud formation again.
00:25 Now, what if you have a lot of resources
00:27 created either through AWS cloud formation automatically
00:30 or manually created resources are there in your AWS account
00:34 and you want to know exact state of your resources,
00:38 and then what changes have been made
00:40 to these resources over the time?
00:42 Now this is typically required for,
00:44 again, maybe for audit purpose
00:46 or something went bad with your AWS account,
00:49 somebody deleted something
00:50 and you want to find out the root cause
00:53 or probably who did that from where the API call was made.
00:57 So if you really look at this problem,
01:00 there are multiple services involved.
01:02 First of all you should know exactly
01:03 which resources were deleted and when,
01:06 and then who deleted that resource.
01:08 So if you know already, AWS cloud is really the service
01:12 which logs every API call that you make, right?
01:16 But then there should be a service
01:17 which really looks at all these things
01:19 and then can give you a bit of view
01:21 of what happened to a particular resource over the time.
2. Configuration Recorder 选择资源范围并构建 Inventory、Relationship 与 Timeline
时间范围：01:24–02:09
总结 / Summary
中文
启用 AWS Config 后，Configuration Recorder 按所选 Resource Type 记录受支持资源；Delivery Channel 可把 Configuration Snapshot/History 送至 S3，并通过 SNS 通知。网络场景会覆盖 VPC、Route Table、Security Group、NAT Gateway、Flow Log、EC2、RDS 等受支持对象。记录范围可以是全部受支持资源或指定类型，但增加范围会影响成本与噪声。必须同时理解：Config 记录的是 Control-plane Configuration，不采集 Packet/Flow Content，也不替代 VPC Flow Logs。
English
After AWS Config is enabled, a configuration recorder records supported resources in the selected resource scope. A delivery channel can send configuration snapshots and history to S3 and notifications through SNS. Network scenarios may include supported VPCs, route tables, security groups, NAT gateways, flow logs, EC2 instances, and RDS resources. Recording can cover all supported resources or selected types, and broader scope affects cost and noise. Config records control-plane configuration; it does not capture packet or flow content and does not replace VPC Flow Logs.
Transcript
01:24 And that's what exactly AWS conflict does.
01:27 So AWS config is all about tracking the state change
01:32 of your AWS resources.
01:34 Just an example here, you have VPC
01:37 and a lot of components provision in your AWS account.
01:40 Like VPCs, NAT gateways, EC2 machine, databases,
01:43 security group, flow logs, route tables,
01:46 a lot of things, right?
01:48 And what you can do then is you can enable
01:50 the AWS config for these resources.
01:53 And once you enable the config, then config would make sure
01:57 that it is tracking the changes happening
02:00 to these resources.
02:02 And you can enable and disable the tracking
02:04 for individual resources or you can just enable it
02:07 for an entire AWS account.
3. Config Rule 把 Desired Configuration 转成 Compliant/Noncompliant Evaluation
时间范围：02:09–03:43
总结 / Summary
中文
Config Rule 对当前 Resource Configuration 求值，例如检查 Security Group 是否允许 0.0.0.0/0 访问敏感 Port、S3 Bucket 是否 Public、Flow Log 是否启用。AWS Managed Rule 提供常见检查；Custom Rule 可使用 Lambda 或 Custom Policy/Guard 方式，具体支持取决于 Rule Type。Evaluation 结果进入 Config Dashboard/API，并可通过 EventBridge、SNS 或后续流程处理。Config Rule 判断 Compliance，不等于 Security Group 实际 Traffic Test，也不验证 End-to-end Reachability。
English
A Config rule evaluates current resource configuration, such as whether a security group permits 0.0.0.0/0 to a sensitive port, an S3 bucket is public, or flow logs are enabled. AWS managed rules cover common checks, while custom rules can use Lambda or custom-policy mechanisms such as Guard where supported. Evaluation results appear in the Config dashboard and APIs and can feed EventBridge, SNS, or later workflows. A Config rule evaluates compliance; it is not an actual traffic test and does not prove end-to-end reachability.
Transcript
02:09 So for example, there is a user now who goes
02:14 and changes something into your security group,
02:18 maybe user adds port 80 in your security group.
02:23 Now your security policy says that port 80 should never
02:26 be opened, right?
02:28 Now, how do you detect that?
02:29 So AWS conflict can also help you detect
02:32 this kind of deviation from your standard practices.
02:36 So you could have a desired configuration.
02:39 In AWS conflict terms it is called rule.
02:41 So rule will check, are there any security group
02:44 which has a port 80 open?
02:46 And this rule will be run across all the security groups
02:49 in your account.
02:51 And if there are no security group
02:53 which has this kind of port open,
02:55 it will say that your configurations look okay,
02:58 but in case it finds some security groups
03:01 which are deviating from the standard configuration,
03:04 then it'll raise an alert.
03:06 Now this alert can then further be seen through SNS
03:10 or it can be fetched to an API call for AWS config,
03:14 can be shown in the dashboard,
03:16 it can go as a cloud watch event.
03:18 And then cloud watch even can then
03:20 further trigger further action,
03:22 the chain of lambdas or this event can also be stored
03:25 in S3 bucket, and then it can be evaluated further.
03:29 So what you do with that event is a different thing,
03:32 but ultimately AWS conflict can run
03:34 those kind of desired configuration rules
03:37 on your existing resource state
03:39 and then it'll tell you if there is any problem with that.
4. Configuration Change 与 Periodic Trigger 适合不同 Compliance Question
时间范围：03:43–04:41
总结 / Summary
中文
Change-triggered Rule 在相关 Configuration Item 变化时求值，适合 Security Group、Route Table 等需要快速发现 Drift 的对象；Periodic Rule 按频率扫描，适合依赖外部状态或集合查询的检查。Managed Rule 数量会持续变化，不应死记。Config 也支持某些 Proactive Evaluation，但 Rule 自身仍不执行 IAM Deny；真正的 Preventive Guardrail 应使用 IAM/SCP、Control Tower Control、CloudFormation Hook 或 Service-specific Policy 等机制。
English
A change-triggered rule evaluates when a relevant configuration item changes, which suits security groups, route tables, and other resources requiring rapid drift detection. A periodic rule evaluates on a schedule and suits checks that depend on external state or collection queries. The count of managed rules changes over time and should not be memorized. Config also supports proactive evaluation for some rules, but a rule itself does not issue an IAM deny; preventive guardrails require IAM or SCPs, Control Tower controls, CloudFormation hooks, or service-specific policies.
Transcript
03:43 So in short, AWS config does track the changes
03:48 for configuration happening to the infrastructure.
03:50 And when to apply this rule, that means when to run
03:54 this rule can be trigger on some action
03:57 or it could be periodic.
03:59 You may want to have like every six,
04:01 I'll say, run this kind of rules so that it'll scan
04:04 all my AWS resources and tell me whether the rules
04:07 are compliant or not.
04:09 And there are already 280 plus predefined rules out there.
04:14 So AWS is coming up with managed rules
04:17 so that you don't have to reinvent the wheel
04:19 and rewrite the rules.
04:21 These are some standard predefine rules.
04:23 You can either use that
04:24 or you can also write your own custom rules.
04:28 And for that, you have to write a lambda function.
04:30 So that's what you can do with AWS config.
04:35 So I hope the overview of AWS config is clear,
04:38 why it is used and what it exactly does.
5. Remediation 用 Systems Manager Automation 修复；Timeline 解释配置与合规变化
时间范围：04:41–06:37
总结 / Summary
中文
Noncompliant Rule 可关联 Manual 或 Automatic Remediation，通常调用 AWS Systems Manager Automation Document，并以指定 IAM Role 执行修改、隔离或删除动作。它不是任意 Shell Script 的同义词，而是受参数、重试、并发和权限控制的 Automation Workflow；高风险动作应先人工审批或设置安全阈值。Resource Timeline 与 Compliance Timeline 展示某配置何时改变、何时从 Compliant 变为 Noncompliant、何时修复；要确认操作者仍需关联 CloudTrail Event。
English
A noncompliant rule can use manual or automatic remediation, commonly invoking an AWS Systems Manager Automation document under a designated IAM role to modify, isolate, or delete a resource. This is not simply a synonym for an arbitrary shell script; it is an automation workflow governed by parameters, retries, concurrency, and permissions. High-risk actions should use human approval or safety thresholds. Resource and compliance timelines show when configuration changed, when compliance changed, and when remediation occurred; identifying the actor still requires correlated CloudTrail events.
Transcript
04:41 Now, there is one more thing
04:42 to AWS conflict, that is auto remediation
04:45 or manual remediation.
04:47 What it means that if any rule fails,
04:50 you could also trigger an action.
04:52 Typically it is done through AWS systems manager, right?
04:56 So you can write SSM documents.
04:58 SSM documents are systems manager document.
05:01 That means it's kind of script that you can write.
05:04 Like for Linux based machine,
05:05 it could be a shell script,
05:08 for a Windows based machine,
05:09 it could be a power shell script.
05:11 But ultimately, when some rule fail,
05:14 you can trigger that auto remediation
05:16 and then this SSM document will go and fix that problem.
05:21 Now, SSM document can do anything.
05:23 You can make an API call through an SSM document
05:26 which then ultimately fix that security group
05:29 if somebody accidentally opens port 80
05:32 or if there is an EC2 instance
05:34 which is using an AMI which is not approved AMI,
05:39 then you could write an action
05:40 like delete that EC2 instance all together.
05:43 So all that can be done using auto remediation
05:46 or manual remediation in AWS config.
05:50 So if you look at any compliance of a resource over time,
05:54 AWS config will give you that view.
05:57 Like at certain day, the resource was compliant
06:01 but then it became non-compliant
06:02 and then again it became compliant
06:04 because some rule was triggered
06:06 and then auto remediation was triggered.
06:08 Similarly, you can view the configuration
06:11 of resource over the time.
06:12 So you can really see at what time,
06:14 what changed and who did that change.
06:17 All that can be captured
06:19 into the AWS conflict dashboard itself.
06:21 So this is a screenshot for AWS security group changes.
06:25 Likewise, you can monitor all your resources.
06:28 Now you can also see AWS CloudTrail API
06:31 which made that change so that you can trace
06:34 on who was the user who made that API call.
6. AWS Config 是 Detective/Corrective Regional Service，可用 Aggregator 汇总多账号多 Region
时间范围：06:37–08:44
总结 / Summary
中文
Config 主要是 Detective，发现“Unrestricted SSH、Public Bucket、ALB/Route Table 配置变更”等问题；配合 Remediation 才形成 Corrective Control。它不会阻止原始 PutSecurityGroupRule 或 ModifyRouteTable API 成功。Config 在每个 Region 记录资源，Configuration Aggregator 可把多个 Account/Region 或 Organization 的 Inventory 与 Compliance 结果汇总到中央 Account，形成近似 CMDB 的视图；Aggregator 负责汇总查询，不会自动替目标 Region 启用 Recorder 或 Rule。
English
Config is primarily detective, identifying issues such as unrestricted SSH, public buckets, or load balancer and route-table configuration changes; paired remediation makes it corrective. It does not prevent the original security-group or route-table API call from succeeding. Config records resources regionally, while a configuration aggregator can centralize inventory and compliance results across accounts, regions, or an organization into a CMDB-like view. The aggregator centralizes queries; it does not automatically enable recorders or rules in target regions.
Transcript
06:37 So in summary, AWS config is a service which helps you
06:41 record the configuration and changes over the time.
06:44 And remember that AWS config
06:46 does not prevent actions from happening.
06:48 That means it doesn't say that do not allow adding port 80
06:52 to the security group,
06:53 it can't do that because it's a reactive action, right?
06:57 After somebody adds that rule,
06:59 then AWS config rule can be triggered
07:02 or it can be set in a periodic manner.
07:04 And then it'll detect that your security group
07:07 is deviating from the defined rule.
07:10 So config can't really help prevent actions.
07:13 Now, the questions that can be solved by AWS config,
07:16 here are a few examples.
07:18 Is there unrestricted access to my security group?
07:21 Are my buckets public?
07:23 Or has my ALB configuration changed over time?
07:27 If these are the questions that you want to answer,
07:29 then AWS config should be used.
07:32 You can also write custom rules that we have seen.
07:34 And for that, you would have to define the lambda functions.
07:37 Like for example, evaluate if each EBS disc
07:41 is of type gp2 or evaluate if EC2 instance is t2micro,
07:45 if instance is not t2micro maybe
07:48 or to terminate that instance.
07:49 Now finally, AWS conflict is a regional service.
07:51 That means it is enabled for the resources
07:54 in a given region, but then all the data it collects
07:58 around the state of those resources can be aggregated
08:01 across multiple region and multiple accounts.
08:04 And that becomes inventory
08:05 of your AWS resources state basically.
08:09 So it's kind of CMDB you can call.
08:11 If you heard that term,
08:12 configuration management database of your infrastructure.
08:16 So that's it about AWS conflict service.
08:18 And this is again, a good tool to experiment with,
08:22 it's more aligned to the DevOps again,
08:24 but important if you want to really track changes,
08:26 what's happening into your AWS networking space
08:30 as well, right?
08:30 If somebody changes some roots into your root table,
08:34 then you can go back to the AWS conflict service
08:37 and check what happened at what time and who did that.
08:41 So that's about AWS config.
08:42 Thanks for watching.
整讲总结 / Overall Summary
中文
AWS Config 的核心是 Configuration Recorder/Item/Relationship/Timeline、Config Rule 的 Compliance Evaluation、SSM Automation Remediation 与 Multi-account/Region Aggregator。考试务必区分：Config 回答资源配置状态和合规，CloudTrail 回答 API Actor/Event；Config Rule 本质上是 Detective，不直接 Deny 变更，预防控制需 IAM/SCP/Hook 等机制。
English
AWS Config centers on configuration recorders, items, relationships and timelines, Config rule compliance evaluations, Systems Manager Automation remediation, and multi-account or multi-region aggregators. For exams, distinguish Config's resource state and compliance from CloudTrail's API actor and event. Config rules are fundamentally detective and do not directly deny changes; prevention requires IAM, SCPs, hooks, or other guardrails.
返回顶部 ↑