AWS Config Rules and Automated Remediation

An AWS Config Rule defines a condition a resource's configuration must satisfy to be considered compliant — AWS Managed Rules cover common checks (encryption enabled, no public access, required tags present) without writing any code, while custom rules backed by a Lambda function can implement arbitrary organization-specific logic Config evaluates automatically whenever a tracked resource's configuration changes (or on a defined schedule).

Each evaluation produces a compliance status (COMPLIANT or NON_COMPLIANT) per resource, visible in a dashboard and queryable, giving continuous visibility into your account's actual compliance posture rather than only a point-in-time snapshot from a periodic manual audit.

For certain non-compliant findings where the correct fix is clear and low-risk (e.g. automatically enabling default encryption on an S3 bucket found without it), Config supports automatic remediation via Systems Manager Automation documents, closing the loop from detection to fix with no human intervention required — though this should be reserved for genuinely unambiguous, low-risk fixes, since automating remediation for something requiring nuanced judgment risks 'fixing' an intentional, legitimate exception.