The organization continuously checks that an S3 bucket is not publicly exposed.
It needs resource configuration history and rule evaluation.
Which AWS service is primarily used?
AWS Config records resource configuration history and evaluates Config rules against desired compliance conditions.
Detailed explanation
Shield provides DDoS protection and is not a configuration-compliance evaluator.
Shield provides DDoS protection and is not a configuration-compliance evaluator.
AWS Config records resource configuration and evaluates rules such as whether a bucket meets a required setting.
AWS Config records resource configuration and evaluates rules such as whether a bucket meets a required setting.
GuardDuty detects threats from data sources and does not provide resource configuration history.
GuardDuty detects threats from data sources and does not provide resource configuration history.
CloudTrail records API events; Config rules provide the configuration compliance evaluation.
CloudTrail records API events; Config rules provide the configuration compliance evaluation.
Check official documentation
Compare the following points with the official documentation.
AWS Config terminology and conceptsでconfiguration historyとConfig ruleを確認する。
What to confirm
S3バケットの設定履歴を記録し、ルールの評価結果で公開状態を確認する。
Key points
- AWS Config
- Configuration history
- Config rule
Notes
- Environment: AWS公式Configドキュメントの確認
- Confirm current service capabilities and compliance guidance in the official AWS documentation.
Foundation review
Configuration versus activity
Config evaluates resource state, while CloudTrail records API activity that may have changed it.
Continuous evaluation
Rules can identify a resource that drifts from a required security setting.