Remediating non-compliant resources with Config

If you would like to take an automated approach to fix items that are out of compliance, then AWS provides you the ability to do this to the resources the Config Rules evaluate. System Manager Automation Documents carry out these actions.

There are several predefined auto remediations that you can select from, or you can create custom remediations to suit your organization’s needs.

Real-Life example of using automated remediations

Suppose you are part of a company that has developed an organizational-wide policy that says no EBS volume can be created without encryption. In that case, this is the perfect opportunity for automatic remediation. First, you would create a rule that would check if a volume was encrypted and would be triggered when the resource was created. If the resource failed to meet these standards, you could create a custom System Manager Automation document that would instantly destroy that EBS volume...