AWS Config can provide a whole realm of resource management activities, including the following:
- Acting as a resource inventory for your infrastructure.
- The ability to capture and log any changes to your resources.
- You can take a snapshot of your configurations.
- Storing and reviewing the configuration history of resources.
- It integrates with AWS CloudTrail and will show you which API call made specific changes.
- Identify relationships held between different resources, for example, which EBS volumes are associated with which instances, and which instances are within which subnet.
- Through the use of compliance checks underpinned by AWS Lambda, you can implement automatic checking for compliance rules, for example, to check all EBS volumes provisioned are encrypted.
All of this helps you to perform security analysis across your environment. More on AWS Config will be discussed in Chapter 13, Auditing and Governance.
