AWS Config
- Records configuration changes and evaluates compliance. NOT real-time prevention — it records and alerts.
- Config Rules — evaluate resources. 75+ managed rules, or custom Lambda-based rules.
- Remediation — auto-remediate non-compliant resources using SSM Automation Documents.
- Notifications — EventBridge or SNS for non-compliance.
- Per-region service (can aggregate across regions/accounts).
CloudWatch vs CloudTrail vs Config:
- CloudWatch → performance monitoring, alerting, log aggregation
- CloudTrail → WHO made API calls, WHAT changed
- Config → WHAT configuration is, compliance state over time