AWS Conformance pack> I re-evaluated after the action, but the results are the same.

0

I am deploying the AWS Conformance pack (K-ISMS) and taking action on non-compliance.

For some items, even though I corrected the defect and reevaluated it, the result is still non-compliant as before.

In the case of https://docs.aws.amazon.com/config/latest/developerguide/iam-user-no-policies-check.html, IAM Users that were out of compliance were deleted.

After that, I reevaluated, and the already deleted IAM USERS are displayed in the non-compliant list.

In the case of "https://docs.aws.amazon.com/config/latest/developerguide/vpc-default-security-group-closed.html", all inbound and outbound rules were deleted from the SG detected as non-compliant.

Afterwards, a re-evaluation was conducted, and the SG was detected as non-compliant as before.

What should I do?

remy
질문됨 8달 전236회 조회
1개 답변
0
수락된 답변

AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This includes how the resources are related to one another and how they were configured in the past so that you can see how the configurations and relationships change over time.

When you turn on AWS Config, it first discovers the supported AWS resources that exist in your account and generates a configuration item for each resource. AWS Config also generates configuration items when the configuration of a resource changes, and it maintains historical records of the configuration items of your resources from the time you start the configuration recorder.

By default, AWS Config creates configuration items for every supported resource in the region. Also, AWS Config keeps track of all changes to your resources by invoking the Describe or the List API call for each resource in your account.

It seems config is not updating Configuration Item for resources due to which Config is still showing those resources as Non-Compliant even when they are either remediated or deleted. Hence, I would request you to kindly validate if Config Recorder is 'Enabled' or not [1]. Also, I would request you to validate Service Linked role [2] for Config as it should have enough permissions to record changes for applicable resources.

With that being said, if you still see issue after validating above configuration details, I would request you to open Support case to further investigate the issue.

==== Reference ====

[1] https://docs.aws.amazon.com/config/latest/developerguide/stop-start-recorder.html [2] https://docs.aws.amazon.com/config/latest/developerguide/using-service-linked-roles.html

Rohit
답변함 8달 전
  • After setting Config Recorder to 'Enabled' as you suggested, I saw that several items were displayed as "compliant". I'll have to check the remaining items again to see if the settings are incorrect. Thanks for your advice!

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠