AWS Conformance pack> I re-evaluated after the action, but the results are the same.

0

I am deploying the AWS Conformance pack (K-ISMS) and taking action on non-compliance.

For some items, even though I corrected the defect and reevaluated it, the result is still non-compliant as before.

In the case of https://docs.aws.amazon.com/config/latest/developerguide/iam-user-no-policies-check.html, IAM Users that were out of compliance were deleted.

After that, I reevaluated, and the already deleted IAM USERS are displayed in the non-compliant list.

In the case of "https://docs.aws.amazon.com/config/latest/developerguide/vpc-default-security-group-closed.html", all inbound and outbound rules were deleted from the SG detected as non-compliant.

Afterwards, a re-evaluation was conducted, and the SG was detected as non-compliant as before.

What should I do?

remy
asked 7 months ago227 views
1 Answer
0
Accepted Answer

AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This includes how the resources are related to one another and how they were configured in the past so that you can see how the configurations and relationships change over time.

When you turn on AWS Config, it first discovers the supported AWS resources that exist in your account and generates a configuration item for each resource. AWS Config also generates configuration items when the configuration of a resource changes, and it maintains historical records of the configuration items of your resources from the time you start the configuration recorder.

By default, AWS Config creates configuration items for every supported resource in the region. Also, AWS Config keeps track of all changes to your resources by invoking the Describe or the List API call for each resource in your account.

It seems config is not updating Configuration Item for resources due to which Config is still showing those resources as Non-Compliant even when they are either remediated or deleted. Hence, I would request you to kindly validate if Config Recorder is 'Enabled' or not [1]. Also, I would request you to validate Service Linked role [2] for Config as it should have enough permissions to record changes for applicable resources.

With that being said, if you still see issue after validating above configuration details, I would request you to open Support case to further investigate the issue.

==== Reference ====

[1] https://docs.aws.amazon.com/config/latest/developerguide/stop-start-recorder.html [2] https://docs.aws.amazon.com/config/latest/developerguide/using-service-linked-roles.html

Rohit
answered 7 months ago
  • After setting Config Recorder to 'Enabled' as you suggested, I saw that several items were displayed as "compliant". I'll have to check the remaining items again to see if the settings are incorrect. Thanks for your advice!

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions