Auto-remediate non-compliant AWS Config Findings

Question

Hi AWS, we have recently deployed AWS Config Conformance packs to detect non-compliant resources and remediation was done manually. It has improved the performace score to a certain extent but now the issue is we still don't have AWS Control Tower and as folks are deploying new AWS resources more non-compliant findings come up and it has deteriorated improved performance score to some extent.

We are planning to control that by consolidating SCPs and leverage its functionality as much as we can to bring compliance in place but as you know there are certain limits with SCPs itself i.e.
1. You cannot have more than **5 SCPs** per AWS account
2. The maximum size of an SCP is **5120** characters (hard-limit).

Currently we are planning to amalgamate as many SCPs as we can to control creation of non-compliant resources but down the line I need to know how to turn on auto-remediation for AWS Config conformance packs?

Trevor Schiavone · Answer

Resources that do not comply with AWS Config rules can be automatically remediated using AWS Systems manager automation run books. The process for doing this outlined in the blog post Remediate noncompliant AWS Config rules with AWS Systems Manager Automation runbooks

The specific procedure for adding automated remediation to rules deployed via conformance packs is outlined in the blog post Deploy Conformance Packs across an Organization with Automatic Remediation

The specific procedure for adding automated remediation to rules deployed via conformance packs is outlined in the blog post [Deploy Conformance Packs across an Organization with Automatic Remediation](https://aws.amazon.com/blogs/mt/deploying-conformance-packs-across-an-organization-with-automatic-remediation/)

Praveen Muppala · Answer

The implementation of AWS Organizations, Organizational Unit (OU) structure, account mapping within OUs, AWS Control Tower, and Service Control Policies (SCPs) necessitates a well-thought-out strategy, despite the inherent limitations of SCPs. The following links can provide guidance on developing an effective strategy for this implementation:

[SCP evaluation & Strategies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_evaluation.html#strategy_using_scps)

[How can I increase the SCP character size limit or number of SCPs for an AWS Organization?](https://repost.aws/knowledge-center/organization-scp-size)

[Achieving operational excellence with design considerations for AWS Organizations SCPs](https://aws.amazon.com/blogs/mt/achieving-operational-excellence-with-design-considerations-for-aws-organizations-scps/)

[Get more out of service control policies in a multi-account environment](https://aws.amazon.com/blogs/security/get-more-out-of-service-control-policies-in-a-multi-account-environment/)

Auto-remediate non-compliant AWS Config Findings

Relevant content