What is AWS Config? A plain-English explainer

What “configuration” means here

Every AWS resource has a configuration: the settings that describe its current state — a security group’s inbound rules, whether an S3 bucket allows public access, which subnet an instance sits in, and so on. Configuration changes constantly as infrastructure evolves, often through many small edits made by different people or automated processes over weeks or months.

AWS Config’s job is to capture that state repeatedly and keep a record of it, rather than leaving “what it looks like right now” as the only view available.

Configuration history and snapshots

AWS Config records a configuration item each time a tracked resource changes, building up a timeline for that resource rather than a single current snapshot. That means you can look back and see a resource’s configuration as it was at a given point, and step through exactly what changed between two points in time.

This is useful well beyond troubleshooting: it turns “what did this look like before someone changed it” from a question nobody can answer into one Config already has the record for.

Config rules and compliance

On top of that history, Config rules let you define the configuration you expect — for example, that a particular type of storage should always be encrypted, or that a security group should never allow unrestricted inbound access — and Config continuously evaluates resources against those rules. A resource that matches the rule shows as compliant; one that does not shows as non-compliant, with the specific configuration that failed the check.

AWS provides a library of managed rules for common standards, and you can also write custom ones, so the rules can reflect your organisation’s own policy rather than only generic best practice.

AWS Config versus AWS CloudTrail

Config is frequently paired with AWS CloudTrail, but the two answer different questions. Our what-is-aws-cloudtrail explainer covers CloudTrail in depth: it is a log of API calls — a record of who did what and when, across your account. Config is not a log of actions at all; it is a record of resource state and compliance over time.

Put simply: CloudTrail tells you which API call was made and by whom; Config tells you what a resource’s configuration looked like before and after, and whether that configuration meets your rules. Used together, CloudTrail can explain how a resource ended up non-compliant, and Config is what noticed that it was.

Common uses

Typical reasons teams enable AWS Config include:

• Compliance auditing — continuously checking resources against internal or regulatory standards rather than auditing manually on a schedule.
• Change tracking — understanding exactly what changed on a resource and when, without relying on memory or tribal knowledge.
• Troubleshooting — comparing a resource’s current configuration against an earlier, known-good state after something breaks.
• Governance at scale — applying the same rules consistently across many resources and accounts rather than reviewing each one by hand.

Pricing model, in one line

AWS Config is pay-for-use: you are charged based on the configuration items it records and the rule evaluations it runs, rather than a fixed subscription — check AWS’s own pricing pages for current detail.

Where AWS Config appears in certification study

Config comes up on AWS Certified CloudOps Engineer – Associate, where operational visibility and compliance tooling are core content, and on AWS Certified Security Specialty, where auditing and governance services are tested in depth. It is also introduced at a lighter level on AWS Certified Solutions Architect – Associate as one of the standard governance tools in the toolkit.

This article covers what Config is and why it exists — the syllabus depth on specific managed rules, remediation actions and multi-account aggregation belongs in the exam guide itself, which our /revision study library covers lesson by lesson.