Overlap among AWS Config conformance packs FedRAMP Low/Moderate/High?

The AWS Config conformance packs for FedRAMP are not accumulative - you only need to deploy the specific level you're targeting. This is because:

1. Each FedRAMP level (Low, Moderate, High) contains all the controls required for that specific level. The higher levels include stricter controls and additional requirements, not just additive ones from lower levels.

2. For example:

   • FedRAMP Low has its specific set of controls
   • FedRAMP Moderate includes both equivalent Low controls (often with stricter requirements) plus additional controls
   • FedRAMP High includes equivalent Moderate controls (often with even stricter requirements) plus additional controls

So if you're aiming for FedRAMP Moderate compliance:

• You only need to deploy the Moderate conformance pack
• You do NOT need to deploy the Low conformance pack
• The Moderate pack already includes all necessary controls for your compliance level

This is by design to avoid:

• Duplicate rules
• Conflicting configurations
• Unnecessary complexity in compliance monitoring

Best practice is to deploy only the conformance pack that matches your target FedRAMP level. https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-fedramp-low.html https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-fedramp-moderate.html https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-fedramp-high-part-2.html