100 Days of DevOps — Day 40-Introduction to AWS Config
Welcome to Day 40 of 100 Days of DevOps, Focus for today AWS Config
What Is AWS Config?
AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This includes how the resources are related to one another and how they were configured in the past so that you can see how the configurations and relationships change over time.
Features
- Track state of all resources(OS level too — Windows/Linux)
- Meet your compliance need(PCI-DSS, HIPAA)
- Validate against AWS Config Rule
Setting up AWS Config
- Go to AWS Config https://us-west-2.console.aws.amazon.com/config → Get started
* All resources: You can check on, Record all rsources supported in this region
OR
Global resources like IAM
OR
We can even check specific resources eg: EC2* Amazin S3 bucket: This bucket will recieve configuration history and configuration snapshot files
* Amazon SNS topic(Optional): We can send config changes to S3 bucket
* AWS Config role: It give AWS config read-only access(IAM Role)to AWS resource
* Skip this for the time being- Confirm and AWS Config setup for us.
- Check the status of AWS config, by click on the status icon on the top of the page
- Now click on Resource and then Instance
- Click on the Configuration timeline
- Scroll down and click on changes
Scenario: Last time we skipped the rule section, this time let add all the config rule, our task for today to make sure for an account is compliant
- CloudTrail must be enabled
- S3 bucket versioning must be enabled
- EC2 instance must be a part of VPC
- We are only using instance type as t2.micro
Search for CloudTrail and select cloudtrail-enabled
- You don't need to change any of the default value and click on save
Same way search for S3 bucket versioning enabled
Search for ec2-instances-in-vpc
- This requires some changes as you need to specify your VPC id
Search for desired-instance-type
- Add the instanceType Value to t2.micro
- Finally, you will see something like this
- If you further drill down, as you can see this instance is using t2.medium while in config rule for the desired-instance-type we choose t2.micro
- One more example, as you can see in this case S3 bucket is non-compliant
- If we can go to the S3 bucket and enabled versioning
- As we remediated the issue, to see the immediate effect
- We are back in business
Terraform Code
- Now we need to automate the entire process and then is no better tool other then terraform to do a job for us
GitHub Link
Looking forward from you guys to join this journey and spend a minimum an hour every day for the next 100 days on DevOps work and post your progress using any of the below medium.
- Twitter: @100daysofdevops OR @lakhera2015
- Facebook: https://www.facebook.com/groups/795382630808645/
- Medium: https://medium.com/@devopslearning
- Slack: https://devops-myworld.slack.com/messages/CF41EFG49/
- GitHub Link:https://github.com/100daysofdevops
Reference
