All 7 AWS Config questions
More in AWS Config
What is AWS Config and what problem does it help solve? How do AWS Config rules work to evaluate resource compliance? What is a Config conformance pack, and how does it simplify compliance management at scale? How does the AWS Config configuration timeline help with troubleshooting and root cause analysis? How does AWS Config aggregator support monitoring compliance across multiple AWS accounts and regions from a single place? How can custom Config rules built with Lambda functions evaluate complex, organization specific compliance requirements that AWS managed rules do not cover?
Advertisement
AWS › AWS Config

How can AWS Config automatically remediate non compliant resources once they are detected?

Intermediate

Answer

AWS Config supports automatic remediation actions, typically implemented using AWS Systems Manager Automation documents, that can be triggered the moment a resource is flagged as non compliant, allowing the system to automatically fix common issues, such as disabling public access on an S3 bucket or attaching a required tag, without needing a human to manually intervene every time a violation is detected.
aws configservice put-remediation-configurations --remediation-configurations '[{"ConfigRuleName":"s3-bucket-public-read-prohibited","TargetType":"SSM_DOCUMENT","TargetId":"AWS-DisableS3BucketPublicReadWrite"}]'
Real-world example A company configures automatic remediation so that any time Config detects an S3 bucket has been accidentally made public, the bucket's public access is automatically disabled within minutes, without requiring a manual response from the security team.

Common follow-ups: What remediation actions are available as AWS managed Systems Manager documents?;How do you test a remediation action safely before enabling it in production?

AWS Systems Manager;S3 & Storage
All 7 AWS Config questions