10.4 Compliance Enforcement with AWS Config & Conformance Packs

AWS Certified CloudOps Engineer – Associate SOA-C03

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Monitoring & Observability Infrastructure

1.1 Configuring Workload Observability 1.2 CloudWatch Agent Architecture & Deployment 1.3 Metric Alarms, Anomaly Detection & Composite Alarms

2 Chapter 2: Alarms, Dashboards & Event-Driven Remediation

2.1 CloudWatch Dashboards & Multi-Account Visibility 2.2 Notification Architecture & Alarm Invocation 2.3 Amazon EventBridge Rules, Event Buses & Troubleshooting 2.4 Automated Remediation with Systems Manager & Lambda

3 Chapter 3: Performance Optimization for Compute, Storage & Databases

3.1 EC2 & Compute Performance Optimization 3.2 Amazon EBS Performance Metrics & Volume Tuning 3.3 S3 Performance Strategies & Data Transfer 3.4 Shared Storage (EFS/FSx) & Database Performance

4 Chapter 4: Compute & Database Scalability and Elasticity

4.1 EC2 Auto Scaling Policies & Elasticity 4.2 Auto Scaling Advanced Operations: Warm Pools & Lifecycle Hooks 4.3 Dynamic Scalability Through Caching 4.4 Managed Database Scaling: RDS, Aurora & DynamoDB

5 Chapter 5: High Availability, Fault Tolerance & Load Balancing

5.1 Elastic Load Balancing (ALB/NLB) Configuration & Troubleshooting 5.2 Route 53 Health Checks & DNS Failover 5.3 Multi-AZ Architecture & Fault-Tolerant Deployments

6 Chapter 6: Backup, Data Protection & Disaster Recovery

6.1 Centralized Backup Automation & AWS Backup 6.2 Database Restore Strategies & RTO/RPO Management 6.3 Storage Versioning, Replication & Immutability 6.4 Disaster Recovery Patterns & Multi-Region Resilience

7 Chapter 7: Infrastructure as Code with CloudFormation & AWS CDK

7.1 CloudFormation Foundations & Resource Modeling 7.2 Managing Stacks, Drift Detection & Change Sets 7.3 Infrastructure as Code with AWS CDK 7.4 Identifying & Remediating Deployment Failures

8 Chapter 8: Multi-Account Provisioning, Containers & Third-Party IaC

8.1 Golden Images with EC2 Image Builder & Amazon ECR 8.2 Multi-Account & Multi-Region Resource Sharing 8.3 Deployment Strategies & Container Deployments 8.4 Third-Party Automation with Terraform & Git Workflows

9 Chapter 9: Systems Manager & Event-Driven Operations Automation

9.1 AWS Systems Manager Core Management & Run Command 9.2 Systems Manager Patch Manager & Session Manager 9.3 Event-Driven Operations Automation

10 Chapter 10: Identity, Access Management & Governance

10.1 Advanced IAM Policies, Roles & Policy Conditions 10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer 10.3 Multi-Account Security: Organizations, SCPs & Identity Center 10.4 Compliance Enforcement with AWS Config & Conformance Packs

11 Chapter 11: Data Security, Encryption & Vulnerability Management

11.1 Data Classification & Amazon S3 Security 11.2 Encryption at Rest with AWS Key Management Service (KMS) 11.3 Encryption in Transit with AWS Certificate Manager (ACM) 11.4 Secrets Management & Centralized Security Findings

12 Chapter 12: VPC Architecture, Endpoints & Network Protection

12.1 VPC Core Architecture, Subnetting & High Availability NAT 12.2 Private Network Connectivity: VPC Endpoints & Peering 12.3 Network Protection & Edge Security Auditing

13 Chapter 13: DNS, Route 53 Routing & Content Delivery

13.1 DNS Architecture & Route 53 Resolver for Hybrid Clouds 13.2 Route 53 Advanced Routing Policies & Query Logging 13.3 Global Content & Service Distribution: CloudFront & Global Accelerator

14 Chapter 14: Network Troubleshooting, Traffic Analysis & Hybrid Connectivity

14.1 VPC Configuration Troubleshooting & Analysis Tools 14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics 14.3 CloudFront Caching & Hybrid Connectivity Troubleshooting

10.4 Compliance Enforcement with AWS Config & Conformance Packs

Key Takeaways Explain This Topic AI

AWS Config continuously tracks resource configuration changes and evaluates compliance against managed or custom rules, generating point-in-time Configuration Items (CIs) stored in S3.

Config Rules support two distinct evaluation triggers: Configuration change triggers for near real-time evaluation upon resource modification, and Periodic evaluation triggers running at fixed intervals.

Automated remediation pairs AWS Config rules with AWS Systems Manager (SSM) Automation runbooks, mapping resource IDs dynamically to resolve non-compliant resources without human intervention.

AWS Config Conformance Packs package rules and automated remediations into a single YAML template; Organization Conformance Packs enforce immutable compliance guardrails across all member accounts.

AWS Trusted Advisor monitors critical operational and security checks (such as root MFA and open ports 22/3389), which can be integrated with Amazon EventBridge and SSM Automation for reactive security remediation.

Last updated: September 2026

10.4 Compliance Enforcement with AWS Config & Conformance Packs

CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests your ability to continuously audit resource configuration drift with AWS Config, deploy managed and custom rules, automate configuration remediation using Systems Manager Automation runbooks, enforce immutable compliance frameworks using Organization Conformance Packs, and remediate high-severity findings from AWS Trusted Advisor.

AWS Config Architecture: Recorders, Configuration Items & Snapshots

While AWS CloudTrail records API calls, AWS Config tracks point-in-time resource configurations, historical relationships, and compliance against desired baselines.

The Core Engine

Configuration Recorder: Detects configuration changes in supported AWS resources within a region. It can record all supported resource types (including global resources like IAM) or specific resource categories.

Configuration Items (CIs): A CI is a standardized JSON representation of resource state generated whenever a resource is created, modified, or deleted. It captures:

Metadata: Resource ID, ARN, and creation timestamp.

Attributes: The complete configuration dictionary (e.g., instance type, VPC ID, tags).

Relationships: Linkages to other resources (e.g., an EC2 instance linked to a security group and subnet).

Related Events: The CloudTrail event ID that triggered the state change.

Configuration History: A continuous timeline of CIs for any resource, showing exactly what changed, when, and by whom.

Configuration Snapshots: Scheduled point-in-time exports of all CIs in an account/region delivered to an Amazon S3 bucket.

Config Rules: Managed vs. Custom & Evaluation Triggers

An AWS Config Rule evaluates resource configurations against desired compliance criteria, marking resources as COMPLIANT or NON_COMPLIANT .

Managed vs. Custom Rules

Managed Rules: Over 300 pre-built, AWS-maintained rules implementing best practices:

s3-bucket-public-read-prohibited : Verifies S3 buckets prohibit public read access.

s3-bucket-server-side-encryption-enabled : Verifies default server-side encryption is active.

encrypted-volumes : Ensures attached EBS volumes are encrypted at rest.

restricted-ssh : Flags security groups allowing incoming port 22 traffic from 0.0.0.0/0 .

root-account-mfa-enabled : Verifies the root account has active MFA.

iam-password-policy : Enforces account password complexity and rotation.

Custom Rules: Lambda-backed rules for proprietary compliance logic (e.g., validating EC2 instances use approved golden AMIs). Config passes the CI to the Lambda function, which returns an evaluation via PutEvaluations .

Evaluation Trigger Types

Configuration Change Triggers: Evaluated in near real-time whenever a monitored resource changes state (e.g., catching an engineer modifying a security group).

Periodic Evaluation Triggers: Evaluated on a recurring frequency (1, 3, 6, 12, or 24 hours). Used for rules checking temporal conditions (e.g., certificate expiration within 30 days).

Automatic Remediation via Systems Manager (SSM) Automation Runbooks

Detecting violations is insufficient; non-compliant resources must be corrected automatically without human latency. AWS Config integrates directly with AWS Systems Manager (SSM) Automation Runbooks .

Remediation Workflow

Rule Evaluation: Config identifies a non-compliant resource (e.g., an unencrypted S3 bucket).

SSM Document Selection: The rule links to an AWS-managed runbook (e.g., AWS-EnableS3BucketEncryption or AWS-DisablePublicAccessForS3Bucket ).

Parameter Mapping: Config dynamically maps the non-compliant resource attribute ResourceId into the runbook's target parameter (e.g., BucketName or GroupId ).

Execution Role: Config invokes the runbook using an AutomationAssumeRole granted permissions to modify the target resource.

Execution Mode & Retries: Can run in Automatic mode (triggering immediately upon non-compliance) or Manual mode. Configurable retry controls (e.g., 3 retries with 60-second backoff) handle eventual consistency delays.

Config Conformance Packs & Organization Conformance Packs

Managing individual Config rules across dozens of accounts leads to severe configuration drift. An AWS Config Conformance Pack packages rules and automated remediations into a single declarative YAML template.

Standard Compliance Frameworks

AWS provides pre-architected conformance pack templates for major regulatory standards including CIS AWS Foundations Benchmark, NIST SP 800-53, PCI-DSS, and HIPAA.

Organization Conformance Packs

Deployed from the AWS Organizations management account or delegated administrator account:

Enterprise-Wide Deployment: Rolls out rules and remediations simultaneously across all member accounts or targeted OUs.

Automatic Account Onboarding: Newly provisioned accounts joining an OU automatically inherit the conformance pack.

Immutable Guardrails: Member account administrators cannot modify, disable, or delete organization conformance packs or their rules.

Config Aggregators: Multi-account multi-Region data aggregators consolidate inventory and compliance metrics into a single centralized dashboard.

Remediating Findings from AWS Trusted Advisor Security Checks

AWS Trusted Advisor continuously monitors account security posture across critical operational checks:

Trusted Advisor Check Security Risk Automated Remediation Flow

MFA on Root Account Root account lacks hardware/virtual MFA. Alert via SNS; enforce SCP blocking member root actions.

Exposed Access Keys Access key exposed on public code repositories. EventBridge triggers Lambda to deactivate the key immediately.

Unrestricted Security Groups Ports 22 (SSH) or 3389 (RDP) open to 0.0.0.0/0 . SSM runbook AWS-RevokeSecurityGroupIngress closes the port.

Amazon S3 Permissions Buckets allow open global read/write access. SSM runbook AWS-DisablePublicAccessForS3Bucket enables Block Public Access.

IAM Password Policy Password policy lacks complexity/expiration. Deploy Config managed rule iam-password-policy .

Event-Driven Trusted Advisor Remediation

Trusted Advisor publishes status change events to Amazon EventBridge when a check transitions to WARN or ERROR . An EventBridge rule captures the event and triggers automated containment:

When an "Exposed Access Keys" error is emitted, EventBridge triggers an AWS Lambda function or SSM runbook.

The automation extracts the compromised Access Key ID from the event detail.

The function calls iam:UpdateAccessKey with Status=Inactive within seconds, revoking credentials before exploitation.

An urgent alert is published to an Amazon SNS topic for security incident response.