HTMLCSSJAVASCRIPTANGULARINTERVIEW QUESTIONSSQLPYTHONJAVAPHPHOW TOW3.CSSCC++C#BOOTSTRAPREACTNEXTJSMYSQLJQUERYEXCELXMLDJANGONUMPYPANDASNODEJSDSATYPESCRIPTANGULARJSGITPOSTGRESQLMONGODBASPAIRGOKOTLINSWIFTSASSVUEGEN AIAGENTIC AIPROMPT ENGINEERINGDOCKERKUBERNETESSPRINGSPRING BOOTUNIXSCIPYAWSCYBERSECURITYDATA SCIENCEINTRO TO PROGRAMMINGINTRO TO HTML & CSSBASHRUSTTOOLSHTMLCSSJAVASCRIPTANGULARINTERVIEW QUESTIONSSQLPYTHONJAVAPHPHOW TOW3.CSSCC++C#BOOTSTRAPREACTNEXTJSMYSQLJQUERYEXCELXMLDJANGONUMPYPANDASNODEJSDSATYPESCRIPTANGULARJSGITPOSTGRESQLMONGODBASPAIRGOKOTLINSWIFTSASSVUEGEN AIAGENTIC AIPROMPT ENGINEERINGDOCKERKUBERNETESSPRINGSPRING BOOTUNIXSCIPYAWSCYBERSECURITYDATA SCIENCEINTRO TO PROGRAMMINGINTRO TO HTML & CSSBASHRUSTTOOLS
    AWS Cloud & DevOps Tutorial 0/70 lessons ~6 min read Lesson 44

    AWS Config and Compliance Automation

    CI policy-as-code (lesson 35) stops many bad templates before apply. It cannot stop a Friday console click that opens a security group or disables Block Public Access on a notes bu

    Course progress0%
    Focus
    15 guided sections
    Practice signal
    Examples included
    Career prep
    Interview Q&A included

    AWS Config and Compliance Automation

    AWS Cloud & DevOps Engineering · Lesson 44 · Observability, Security and Reliability

    Lesson Overview

    CI policy-as-code (lesson 35) stops many bad templates before apply. It cannot stop a Friday console click that opens a security group or disables Block Public Access on a notes bucket. AWS Config records configuration history for supported resources, evaluates them against rules, and can package rules into conformance packs. With remediation actions (often Systems Manager Automation documents or custom Lambda), Config becomes a detective—and carefully corrective—compliance engine. Aggregators roll multi-account, multi-Region compliance into a central view that Security Hub and auditors understand.

    TechLearningPro uses Config to enforce encryption, deny public exposure, and require ownership tags continuously—not only at merge time. This lesson focuses on recorder scope, managed rules, conformance packs, safe remediation patterns, and cost control. Tag Project=tlp-lesson44. Budget before enabling recorders; configuration items and evaluations bill—verify current pricing. Clean up lab recorders, rules, packs, and remediation bindings when finished unless the account intentionally keeps a minimal production-like baseline.

    Learning Objectives

    1. Explain Config recorders, delivery channels, configuration items, and rules.
    2. Choose recording strategies that balance coverage and cost.
    3. Apply managed rules for encryption, public access, and required tags.
    4. Deploy conformance packs as versioned compliance bundles.
    5. Design remediation with least privilege and human approval for risky fixes.
    6. Aggregate multi-account compliance for Organizations.
    7. Connect Config results to Security Hub and ticketing.
    8. Contrast preventive CI gates with detective Config controls.
    9. Interpret COMPLIANT vs NON_COMPLIANT vs NOT_APPLICABLE results.
    10. Estimate and verify Config cost drivers; avoid all-Region accidents.
    11. Use configuration timelines in incident investigations.
    12. Maintain exception registries with expiry for justified deviations.
    13. Troubleshoot missing evaluations and remediation failures.
    14. Write an ADR for TechLearningPro’s compliance baseline.
    15. Clean up lab Config resources deliberately.
    16. Prepare interview answers on drift and continuous compliance.
    17. Map to Well-Architected operational excellence and security.
    18. Preview backup/DR needing compliant multi-AZ configurations (lessons 45–46).

    Prerequisites

    • Lesson 35 policy-as-code; lesson 43 Security Hub awareness; IAM and Organizations basics.
    • Budget alert; sandbox preferred; willingness to read current Config managed rule identifiers from AWS docs.

    Detailed Core Concepts

    Configuration recorder and delivery channel

    The recorder notices resource changes (and periodic captures per settings). The delivery channel stores configuration snapshots and history in S3 and can emit SNS notifications—confirm current channel requirements. Without a recorder, rules cannot evaluate live state. Leaving recorders in every Region “just in case” is a classic surprise bill.

    Configuration items (CIs)

    A CI is a point-in-time representation of a resource’s configuration. Rules evaluate CIs. History enables “who changed this bucket policy?” style investigations alongside CloudTrail.

    Rules: managed, custom, periodic vs change-triggered

    Managed rules cover common controls (encryption, public access, IAM patterns, tagging—exact inventory online). Custom rules use Lambda for organization-specific logic. Evaluation modes include change-triggered and periodic—pick per control urgency and cost.

    Conformance packs

    Packs bundle rules (and remediations) into deployable units, often from AWS sample templates aligned to frameworks. Parameterize packs for required tags (Owner, Environment, Project). Treat pack versions like product releases.

    Remediation patterns

    Safe: add missing tags; enable bucket encryption defaults; attach restrictive BPA configurations when playbooks are tested. Dangerous: automatic deletion, automatic SG rule removal without change windows. Prefer SSM Automation with approvals or ticket-gated Step Functions. Document blast radius.

    Aggregators

    Central audit/security accounts use aggregators to query compliance across members. Pair with Organizations for automatic discovery where supported.

    Architecture and Design Diagrams

    mermaid
    flowchart TB
      Res[AWS resources]
      Rec[Config recorder]
      S3[Config history bucket]
      Rules[Managed and custom rules]
      Pack[Conformance pack]
      Rem[Remediation SSM or Lambda]
      Agg[Aggregator]
      Hub[Security Hub]
    

      Res --> Rec --> S3
      Rec --> Rules
      Pack --> Rules
      Rules -->|NON_COMPLIANT| Rem
      Rules --> Hub
      Agg --> Rules
    mermaid
    sequenceDiagram
      participant Eng as Engineer console
      participant SG as SecurityGroup
      participant Cfg as AWS Config
      participant Ticket as Ticket system
      Eng->>SG: Open 22 to 0.0.0.0/0
      SG->>Cfg: CI change
      Cfg->>Cfg: managed rule evaluate
      Cfg->>Ticket: NON_COMPLIANT event
      Note over Ticket: Human or approved automation remediates

    Technical Explanation

    Lab recording strategy

    For TechLearningPro labs: one Region, include only resource types you will test (or use documented limited strategies), few managed rules, short lifetime. Production: approved Regions, packs aligned to policy, remediations staged.

    Rule identifiers

    Never invent managed rule names in exams or ADRs—look up s3-bucket-public-read-prohibited-style identifiers and confirm they still exist. Providers rename and deprecate.

    Remediation IAM

    The automation role needs minimal config:, ssm:, and service permissions for the fix. Separate roles for tag-fix versus network-change. CloudTrail must log AssumeRole and remediation execution.

    Timing expectations

    Evaluations are not always instant. Design SLAs accordingly (“detect within X minutes”) based on measured behavior, not wishes. Periodic rules run on schedules you configure within service limits.

    Integration with CI

    Pipeline can call Config APIs or Security Hub for a compliance gate before prod promote. Still keep shift-left policy-as-code—Config is the backstop.

    Cost dimensions

    Configuration items recorded, active rule evaluations, conformance pack overhead, SNS/S3 storage, remediation runs—verify pricing. Classroom: delete lab recorders promptly.

    Practical Implementation or Design Walkthrough

    Problem

    Create compliance checks for encryption, public access, and tags—demonstrate noncompliant→compliant with optional safe remediation design.

    Steps

    1. Budget; tag Project=tlp-lesson44.
    2. Create encrypted Config bucket + delivery channel + recorder (one Region).
    3. Add three managed rules (encryption, public access, required tags)—verify IDs.
    4. Create violating resource; capture NON_COMPLIANT; fix; capture COMPLIANT.
    5. Optionally attach a small conformance pack; list rules.
    6. Design (dry-run) tag remediation with approval notes.
    7. ADR + cleanup (stop recorder, delete rules/pack/channel per docs).

    Enterprise Real-World Scenarios

    Console drift opens public ACL

    Config catches; Hub fails control; ticket to owner; SCP later hardens. CI alone would have missed it.

    Aggressive auto-remediation deletes lab data

    Team binds delete automation to wrong rule. Fix: remove binding; require dual approval; chaos-test remediations in sandbox first.

    Pack explosion

    Twenty overlapping packs fight. Fix: one curated baseline pack + few supplements; own centrally.

    Aggregator without tickets

    Pretty dashboard, zero fixes. Fix: EventBridge→Jira for high-risk NON_COMPLIANT only.

    Cost spike after multi-Region enable

    FinOps finds Config line item. Fix: restrict Regions; reduce resource types; review rules count.

    Best Practices

    1. Preventive CI + detective Config together.
    2. Start few high-value managed rules.
    3. Conformance packs as versioned baselines.
    4. Safe remediations first; approvals for risky.
    5. Aggregate to security account.
    6. Tie to Security Hub and owners via tags.
    7. Exception registry with expiry.
    8. Budget recorders; limit Regions.
    9. Document rule→threat mapping.
    10. Test remediations in sandbox.
    11. Encrypt Config buckets; restrict access.
    12. Monitor remediation failures.
    13. Align SCP intents with Config rules.
    14. Educate engineers on console drift risk.
    15. Review NON_COMPLIANT aging weekly.

    Common Mistakes and Anti-Patterns

    1. Recorders everywhere forever.
    2. Hundreds of redundant rules.
    3. Auto-delete remediations.
    4. No owners on NON_COMPLIANT.
    5. Ignoring NOT_APPLICABLE floods.
    6. Inventing managed rule names.
    7. Config without CI (late detection only).
    8. CI without Config (console blind spot).
    9. Unencrypted history buckets.
    10. Skipping cleanup in shared sandboxes.

    Troubleshooting and Design Review

    SymptomCauseAction
    Rules NOT_APPLICABLEResource type mismatchFix scope
    No evaluationsRecorder stoppedStart recorder
    Remediation failsIAM permissionsFix role; check SSM
    Cost spikeBroad recordingNarrow scope
    Hub missing ConfigIntegration offEnable per docs

    Interview Questions and Answers

    Q1: What is AWS Config? A: Continuous assessment of resource configurations against rules with history.
    Q2: Recorder vs rule? A: Recorder captures state; rules evaluate compliance.
    Q3: Conformance pack? A: Packaged set of rules/remediations deployed together.
    Q4: Preventive vs detective? A: CI/SCP stop; Config detects drift after.
    Q5: Safe remediation example? A: Apply missing required tags via SSM with least privilege.
    Q6: Aggregator? A: Central view across accounts/Regions.
    Q7: Cost drivers? A: CIs, evaluations, related storage—verify pricing.
    Q8: Relation to Security Hub? A: Config findings/controls often visible in Hub.
    Q9: Custom rules? A: Lambda evaluating organization logic.
    Q10: Timeline use? A: Investigate when a resource became noncompliant.
    Q11: Exception handling? A: Expiry, owner, ticket—like policy-as-code.
    Q12: Why tags rules? A: Ownership and FinOps routing.
    Q13: Public access rules? A: Detect BPA/policy/ACL mistakes that expose data.
    Q14: Encryption rules? A: Ensure EBS/S3/RDS settings meet policy.
    Q15: First response to public bucket NON_COMPLIANT? A: Validate, block public access, incident if data exposed, root cause.

    Hands-On Exercises

    Exercise: Compliance checks for encryption, public access, and tags

    Deliverable: recorder proof, three rules, noncompliant/compliant evidence, pack notes, remediation ADR, cleanup.

    Challenge ADR

    Defend Config spend to Finance using one prevented public-bucket story versus CI-only.

    Lab evidence checklist

    Budget; tags; recorder Region; rule IDs; screenshots; cleanup.

    Narrative: missing Owner tag

    Noncompliant ASG instances; remediation adds tags; on-call routing fixed; FinOps can allocate cost.

    Continuity

    Next: Backup, Disaster Recovery and Resilience—compliance includes recoverable systems, not only encrypted ones.

    Deep dive: delivery channel bucket policy

    Restrict the Config history bucket to Config service principal and auditors; enable BPA; encrypt with KMS CMK where required by policy; lifecycle old histories per retention. Misopen history buckets leak infrastructure inventory.

    Deep dive: rule parameters

    Many managed rules take parameters (blocked port lists, required tag keys). Document parameter choices in the pack repo README. Changing parameters is a compliance change—review it.

    Deep dive: eventual consistency pedagogy

    Teach teams that spinning a resource and immediately expecting COMPLIANT in a demo can fail timing. Build lab scripts with waits/retries; do not declare Config “broken” prematurely.

    Extended practice scenario 1 — 44 aws config and compliance automation

    Enable Config recorder in ONE Region with a tightly scoped recording group if supported (verify current recording strategies: all resources vs specific types). Document cost awareness before leaving it on.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 2 — 44 aws config and compliance automation

    Add managed rules for: S3 public access prohibited, encrypted EBS volumes, required tags—confirm exact managed rule identifiers in current AWS Config managed rules docs.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 3 — 44 aws config and compliance automation

    Create a noncompliant resource deliberately (e.g., missing tag), show NON_COMPLIANT, fix, show COMPLIANT. Screenshot both.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 4 — 44 aws config and compliance automation

    Deploy or describe a conformance pack (AWS sample or CIS-related pack—use current pack names from docs). List five rules inside and owners for failures.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 5 — 44 aws config and compliance automation

    Design SSM Automation or Lambda remediation for a safe rule (apply required tags)—with approval gate; never auto-delete databases.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 6 — 44 aws config and compliance automation

    Aggregator design: which account collects multi-account compliance? Sketch Organizations integration per current docs.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 7 — 44 aws config and compliance automation

    Map Config NON_COMPLIANT results to Security Hub controls and ticket workflow.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 8 — 44 aws config and compliance automation

    Compare preventive CI policy-as-code (lesson 35) vs detective Config: write a table of failure modes each catches.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 9 — 44 aws config and compliance automation

    Recording exclusions: argue why recording every resource type in every Region is expensive for sandboxes.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 10 — 44 aws config and compliance automation

    Custom rule design at conceptual level: Lambda evaluating a TechLearningPro-specific tag policy—mention Config custom rule mechanics without inventing event payload fields; cite docs to verify.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 11 — 44 aws config and compliance automation

    Remediation change window: only auto-fix tags during business hours; page humans for public exposure findings.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 12 — 44 aws config and compliance automation

    Drift story: someone opens SSH 0.0.0.0/0 in console; Config detects; CI never saw it.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 13 — 44 aws config and compliance automation

    Conformance pack parameters: show how packs take parameters (e.g., required tag keys) using docs-verified examples.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 14 — 44 aws config and compliance automation

    Cost worksheet for configuration items + rule evaluations + remediation runs—verify pricing page dates.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 15 — 44 aws config and compliance automation

    Delete/stop recorder cleanup checklist for labs; confirm delivery channel and rules removal order per docs.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 16 — 44 aws config and compliance automation

    Evidence pack for auditors: timeline of compliance changes for a bucket (Config timeline UI).

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 17 — 44 aws config and compliance automation

    Exception registry for Config rules parallel to CI exceptions—expiry mandatory.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 18 — 44 aws config and compliance automation

    Multi-Region strategy: only approved Regions record; SCP denies other Regions for workloads.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 19 — 44 aws config and compliance automation

    Alerting: EventBridge on NON_COMPLIANT for high-risk rules only (public S3, open SG).

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 20 — 44 aws config and compliance automation

    IaC for Config: sketch CloudFormation/Terraform resources names; verify schema before apply.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 21 — 44 aws config and compliance automation

    Performance: rule evaluation delays—set expectations that compliance is eventual, not instantaneous.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 22 — 44 aws config and compliance automation

    Security of remediation roles: least privilege for automation; dual-control for destructive actions.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 23 — 44 aws config and compliance automation

    Teach executives: Config is not vulnerability scanning; do not conflate with Inspector.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 24 — 44 aws config and compliance automation

    Integrate with delivery: broken compliance blocks promotion to prod OU via pipeline check on aggregator API.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Extended practice scenario 25 — 44 aws config and compliance automation

    Full dress rehearsal: recorder → rules → fail → fix → pack → remediation dry-run → cleanup.

    In a timed drill for Config rules packs and remediation, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

    Discuss how this lesson’s tooling interacts with IAM least privilege, Security Hub findings from lesson 43, policy-as-code from lesson 35, CloudWatch alarms, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

    Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

    Compliance evidence pack for auditors

    Recorder enablement, pack version, sample CI timeline, remediation execution logs, exception register, pricing review date.

    Glossary drill

    Configuration item; recorder; delivery channel; managed rule; custom rule; conformance pack; remediation; aggregator; compliance type; resource type scope.

    Budget and cleanup sworn statement

    Recorder stopped/deleted; rules/packs removed if lab-only; budget on; Cost Explorer follow-up scheduled.

    Interview story to memorize

    “We caught a console-opened public notes bucket with Config the same afternoon CI would have blocked the Terraform twin, remediated BPA with an approved runbook, and tracked the Owner tag gap that delayed the ticket.”

    Final synthesis before summary

    Continuous compliance is CI plus Config plus Hub plus owners. Automation remediates the boring; humans handle the dangerous. Cost-control the recorder like any always-on telemetry.

    Lesson Summary

    AWS Config records and evaluates TechLearningPro resource state against rules and conformance packs, catching console drift that CI misses and feeding Security Hub. Use managed rules for encryption, public access, and tags; remediate safely; aggregate thoughtfully; budget and clean up recorders. Tag Project=tlp-lesson44.

    Next: Backup, Disaster Recovery and Resilience.

    Further Reading

    Ready to mark this lesson complete?Track your journey across the entire course.