AWS Config detected “ResourceDiscovered” for SubnetNetworkAclAssociation even though no configuration change was made

Question

I received an AWS Config notification about a resource change, but I didn’t manually modify any VPC configuration.

Here is the message I received (in Japanese):

```
検出時刻 : 2025-10-29T04:56:34.792Z
リソースタイプ : AWS::EC2::SubnetNetworkAclAssociation
リソースID : aclassoc-***
ステータス : ResourceDiscovered
AWSアカウント : ***
AWSリージョン : ap-northeast-1

Configアイテムの変更を検出しました。
Configダッシュボードから状態を確認してください。
https://console.aws.amazon.com/config/home?region=ap-northeast-1#/timeline/AWS::EC2::SubnetNetworkAclAssociation/aclassoc-***/configuration
```

This means AWS Config detected a change for 
AWS::EC2::SubnetNetworkAclAssociation (aclassoc-***) in region ap-northeast-1 (Tokyo) at that time.

However, I didn’t make any manual changes to the Subnet or Network ACL in that VPC around that time — neither via the AWS Console nor CloudFormation.

Question:
Why would AWS Config send a “ResourceDiscovered” notification for

AWS::EC2::SubnetNetworkAclAssociation even though no configuration was changed manually?

Any insights or similar experiences would be appreciated.

re:Post Agent · Answer

AWS Config can detect and record "ResourceDiscovered" events for SubnetNetworkAclAssociation even when no manual changes were made to your VPC configuration. This behavior occurs because AWS Config records configuration changes on a best-effort basis when it detects them, which doesn't always align with manual actions.

There are several possible explanations for why you received this notification:

1. AWS Config might be recording this resource for the first time if you recently enabled AWS Config or added this resource type to your recording configuration.

2. AWS Config generates configuration items not only for direct changes but also for indirect relationships between resources. When a related resource changes, AWS Config may generate new configuration items for associated resources, including SubnetNetworkAclAssociation.

3. The notification could be triggered by automated system maintenance or background processes within AWS that affected the network ACL association, even though you didn't make any manual changes.

4. By default, when you create a subnet, it's automatically associated with the default network ACL. Any system-level adjustments to this association could trigger the notification.

AWS Config records these changes to maintain an accurate configuration history, even if they weren't initiated by a user action. The "ResourceDiscovered" status specifically indicates that AWS Config has detected this resource in your environment, rather than necessarily indicating a user-initiated change.

If you need to verify exactly what changed, you can check the complete configuration item details in the AWS Config timeline for that resource using the console link provided in the notification.  
**Sources**  
[Frequently Asked Questions - AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/faq.html)  
[ReplaceNetworkAclAssociation - Amazon Elastic Compute Cloud](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceNetworkAclAssociation.html)  
[Example Oversized Configuration Item Change Notification - AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/oversized-notification-example.html)  
[AWS Config Resources – Amazon Web Services](https://aws.amazon.com/config/resources/)

AWS Config detected “ResourceDiscovered” for SubnetNetworkAclAssociation even though no configuration change was made

Add your answer

Relevant content