AWS Config rules

aws configservice describe-config-rules

Lists the AWS Config rules in the environment, reviewing the configuration evaluation of resources and detected drift.

Run it when you need to know what Config rules exist and what they evaluate: describe-config-rules lists the rules (AWS managed and custom) with their status, and get-compliance-details-by-config-rule gives the resources that are non-compliant. This is the configuration evaluation layer: resources out of policy (an open security group, an unencrypted bucket, a key without rotation) are flagged as NON_COMPLIANT. In hardening and IR, Config is the drift detection: the resource modified by the attacker (the security group with a new port, the changed IAM policy) violates the rule and the finding appears.

Do not use it as intrusion detection: Config evaluates declared configuration — policy drift, not behavior; poorly designed rules (or those not evaluating critical resources) won't see the change. The cost of Config (continuous evaluations) and resource volume are sized: rules cover the critical, not everything. And watch out: evaluated rules only cover resources in regions with Config enabled and with the recorder active — without the recorder, there are no evaluations. The Config finding is the configuration change (the NON_COMPLIANT resource), not the attack context — correlation with CloudTrail (who changed it) completes the analysis.