AWS Config

AWS Config Skill

Analyze AWS Config compliance and resource configuration with parallel execution and anti-hallucination guardrails.

Relationship to other AWS skills:

• aws-config/ → Config-specific analysis (rules, compliance, conformance packs)
• aws/ → "How to execute" (parallel patterns, throttling, output format)

CRITICAL: Parallel Execution Requirement

ALL independent operations MUST run in parallel using background jobs (&) and wait.

#!/bin/bash
export AWS_PAGER=""

for rule in $rules; do
  get_compliance_details "$rule" &
done
wait

Helper Functions

#!/bin/bash
export AWS_PAGER=""

# Get configuration recorder status
get_recorder_status() {
  aws configservice describe-configuration-recorder-status \
    --output text \
    --query 'ConfigurationRecordersStatus[].[name,recording,lastStatus,lastStatusChangeTime]'
}

# List Config rules
list_config_rules() {
  aws configservice describe-config-rules \
    --output text \
    --query 'ConfigRules[].[ConfigRuleName,ConfigRuleState,Source.Owner,Source.SourceIdentifier]'
}

# Get compliance summary by rule
get_compliance_summary() {
  aws configservice describe-compliance-by-config-rule \
    --output text \
    --query 'ComplianceByConfigRules[].[ConfigRuleName,Compliance.ComplianceType]'
}

# Get non-compliant resources for a rule
get_non_compliant_resources() {
  local rule_name=$1
  aws configservice get-compliance-details-by-config-rule \
    --config-rule-name "$rule_name" \
    --compliance-types NON_COMPLIANT \
    --output text \
    --query 'EvaluationResults[].[EvaluationResultIdentifier.EvaluationResultQualifier.ResourceId,EvaluationResultIdentifier.EvaluationResultQualifier.ResourceType,ResultRecordedTime]' | head -20
}

# List conformance packs
list_conformance_packs() {
  aws configservice describe-conformance-packs \
    --output text \
    --query 'ConformancePackDetails[].[ConformancePackName,ConformancePackState,LastUpdateRequestedTime]'
}

Common Operations

1. Configuration Recorder and Delivery Status

#!/bin/bash
export AWS_PAGER=""
aws configservice describe-configuration-recorder-status \
  --output text \
  --query 'ConfigurationRecordersStatus[].[name,recording,lastStatus,lastStatusChangeTime]' &

aws configservice describe-delivery-channel-status \
  --output text \
  --query 'DeliveryChannelsStatus[].[name,configSnapshotDeliveryInfo.lastStatus,configHistoryDeliveryInfo.lastStatus,configStreamDeliveryInfo.lastStatus]' &
wait

2. Compliance Dashboard

#!/bin/bash
export AWS_PAGER=""
echo "=== Compliance Summary ==="
aws configservice get-compliance-summary-by-config-rule \
  --output text \
  --query 'ComplianceSummary.[CompliantResourceCount.CappedCount,NonCompliantResourceCount.CappedCount]'

echo "=== Per-Rule Compliance ==="
aws configservice describe-compliance-by-config-rule \
  --output text \
  --query 'ComplianceByConfigRules[].[ConfigRuleName,Compliance.ComplianceType]' | sort -k2

3. Non-Compliant Resource Investigation

#!/bin/bash
export AWS_PAGER=""
NON_COMPLIANT_RULES=$(aws configservice describe-compliance-by-config-rule \
  --compliance-types NON_COMPLIANT \
  --output text \
  --query 'ComplianceByConfigRules[].ConfigRuleName')
for rule in $NON_COMPLIANT_RULES; do
  aws configservice get-compliance-details-by-config-rule \
    --config-rule-name "$rule" --compliance-types NON_COMPLIANT \
    --output text \
    --query "EvaluationResults[].[\"$rule\",EvaluationResultIdentifier.EvaluationResultQualifier.ResourceId,EvaluationResultIdentifier.EvaluationResultQualifier.ResourceType]" | head -5 &
done
wait

4. Conformance Pack Status

#!/bin/bash
export AWS_PAGER=""
aws configservice describe-conformance-pack-compliance \
  --conformance-pack-name "$1" \
  --output text \
  --query 'ConformancePackRuleComplianceList[].[ConfigRuleName,ComplianceType]' | sort -k2

5. Resource Configuration Timeline

#!/bin/bash
export AWS_PAGER=""
RESOURCE_TYPE=$1  # e.g., AWS::EC2::Instance
RESOURCE_ID=$2
aws configservice get-resource-config-history \
  --resource-type "$RESOURCE_TYPE" --resource-id "$RESOURCE_ID" \
  --limit 10 \
  --output text \
  --query 'configurationItems[].[configurationItemCaptureTime,configurationItemStatus,resourceType,resourceId]'

Anti-Hallucination Rules

1. Config recorder must be on - If the recorder is not recording, compliance data is stale. Always check recorder status first.
2. Compliance types - Valid types: COMPLIANT, NON_COMPLIANT, NOT_APPLICABLE, INSUFFICIENT_DATA. Do not invent other states.
3. CappedCount - Compliance summary counts are capped at 25. If count is 25, the actual number may be higher. Use detailed queries for exact counts.
4. AWS-managed vs custom rules - Source.Owner is AWS for managed rules, CUSTOM_LAMBDA for custom rules. Different remediation approaches apply.
5. Resource types use CloudFormation format - Resource types follow AWS::Service::Resource format (e.g., AWS::EC2::Instance). Do not use API resource names.

Output Format

Present results as a structured report:

Aws Config Report
═════════════════
Resources discovered: [count]

Resource       Status    Key Metric    Issues
──────────────────────────────────────────────
[name]         [ok/warn] [value]       [findings]

Summary: [total] resources | [ok] healthy | [warn] warnings | [crit] critical
Action Items: [list of prioritized findings]

Target ≤50 lines of output. Use tables for multi-resource comparisons.

Counter-Rationalizations

Common Pitfalls

• Multi-region: Config rules and recorders are regional. For organization-wide view, use Config Aggregators.
• Evaluation frequency: Periodic rules evaluate on a schedule (1h, 3h, 6h, 12h, 24h). Change-triggered rules evaluate on resource changes. Recent changes may not be reflected.
• Conformance packs vs rules: Conformance packs are collections of rules deployed together. Individual rule compliance is tracked separately.
• CloudWatch statistics syntax: Use spaces not commas: --statistics Average Maximum.
• Resource timeline retention: Config retains configuration history based on delivery channel settings. Default retention varies by resource type.