Answer
A Config rule represents a desired configuration state, either using an AWS managed rule covering common best practices, such as ensuring S3 buckets are not publicly readable, or a custom rule you write yourself using a Lambda function, and Config continuously evaluates your actual resources against these rules, marking each resource as compliant or non compliant whenever its configuration is created or changed.
aws configservice put-config-rule --config-rule '{"ConfigRuleName":"s3-bucket-public-read-prohibited","Source":{"Owner":"AWS","SourceIdentifier":"S3_BUCKET_PUBLIC_READ_PROHIBITED"}}'Real-world example A company enables the AWS managed rule that checks for publicly readable S3 buckets, and Config immediately flags an existing bucket as non compliant, prompting the team to correct its permissions before any sensitive data is exposed.