What Is AWS Config? The Clerk Who Writes Everything Down

AWS Config is the service that writes down every change anyone makes to your AWS account — every security group edit, every bucket policy tweak, every instance launched at 11 p.m. — and keeps the whole history as a timeline you can replay later, when you are standing in front of something broken asking "what changed?" It is the least famous service in AWS’s security family and the one most of the others secretly run on. And it carries a distinction worth knowing before you touch anything: AWS Config has no free tier. None. Almost every service in this series gives you something free forever or a 30-day trial — Config bills from the very first change it records, at $0.003 per recorded change (US East, August 2026). If you enabled Security Hub after the last post, Config is already on and already billing — quietly, underneath the "free trial" — because Security Hub’s checks cannot run without it. Nothing is broken and for a small account it is cents, not dollars. But it is the line item people find when they open their first bill expecting zero, and this post exists so that when you see it, you will know exactly what it is, why it is there, what it is doing for you, and which two settings decide whether it stays at pocket change.

This is the twenty-second stop in the Learn AWS for Free series, and it is the post the Security Hub post promised. It also completes something: with this stop, every member of the security staff this series has been hiring one by one — the smoke detector, the key-card log, the guard, the inspector, the front desk — finally gets its bookkeeper, and the whole team is on the payroll. If you have followed along, this post explains the engine that was running under two of the services you already enabled. If you landed here cold because a bill or a console banner said "AWS Config" and you wanted a straight answer — you are in the right place, and you do not need the earlier posts to follow this one.

What is AWS Config, in plain English?

Ethan has been explaining this series with one building, so let him finish the staff: "Every office building that takes itself seriously has a clerk nobody notices. When maintenance replaces a lock, the clerk writes it down — which lock, which door, what day, what it was before. When a new door goes in, the clerk opens a file for it. Nobody reads the ledger on a normal day. Then one morning the fifth-floor door will not open, and suddenly that ledger is the most valuable book in the building, because it answers the only question that matters: what changed, and when? The fire inspector does not measure the building herself either — she reads the clerk’s ledger and checks it against the code book. AWS Config is the clerk. The ledger is the configuration history. The code book is the rules."

Strip the analogy away and the mechanics are exactly that. Config watches your resources — EC2 instances, security groups, S3 buckets, IAM roles, load balancers, over three hundred resource types — and every time one of them changes, it records a configuration item: a JSON snapshot of the resource’s complete settings at that moment, stamped with the time and linked to the change that caused it. String the items together and you get a timeline per resource — not just what it looks like now, but every state it has ever been in, including resources that were deleted months ago. The console calls this the resource timeline, and the first time you use it in anger — production broke at 2:14 p.m., the timeline shows the security group changed at 2:11 — it pays for years of its own pocket-change bill in one afternoon.

What a "configuration item" actually is (the thing you pay for)

Since the bill is counted in configuration items, it is worth being precise about what one is, because two reasonable guesses are both wrong. It is not "one per resource" — a resource that never changes generates nothing after its first recording. And it is not "one per resource per day" — that is a different mode we will get to. A configuration item is recorded when something changes. Edit a security group once: one item. Edit it five times while debugging: five items, $0.015. Leave it alone for a year: zero items, $0.00. The snapshot itself contains the resource’s full settings, its metadata, and — this is the underrated part — its relationships: the item for a security group lists the instances attached to it, so when the timeline shows a change, you also see the blast radius, what else was standing next to the thing that moved.

The practical consequence runs both directions, and it is the single most useful sentence in this post for predicting your bill: Config costs almost nothing on infrastructure that sits still, and real money on infrastructure that churns. A hobby account with a website, a bucket, and a database might record a few dozen changes a month — call it a dime. An account where a CI pipeline builds and tears down a full test stack forty times a day is writing thousands of ledger pages daily, and that is how the horror stories start — not because Config is expensive, but because somebody pointed a meticulous clerk at a revolving door.

Not the same thing: AWS Config vs the aws configure command

A quick fork in the road, because search engines mix these up and so does everyone on their first week: aws configure (and its cousins aws configure sso and the credentials file it writes) is a CLI command that stores your access keys on your own computer so the terminal can talk to AWS. It runs once, costs nothing, and has nothing to do with this post. AWS Config — no "-ure" — is the recording service this post is about. If you typed "aws config" into a search box while your terminal was yelling about credentials or SSO sessions, you want the command, not the clerk — and the honest signpost is: run aws configure for keys, aws configure sso for an SSO login, and come back here the day you need to know what changed in your account. Everyone else, onward.

Config vs CloudTrail: "what changed" vs "who did it"

This is the confusion that fills forum threads, because both services seem to answer "what happened in my account?" The split is clean once you see it. CloudTrail is the key-card log: it records API calls — who called what, from where, at what time. Config records states — what the resource’s settings actually were, before and after. CloudTrail tells you Jake’s cousin called AuthorizeSecurityGroupIngress at 11:04 p.m.; Config shows you the security group’s full rule set at 11:03 and at 11:05, diffed side by side. One names the hand, the other shows the damage. In a real investigation you want both open in two tabs, and the console links them: a Config timeline entry shows the CloudTrail events that caused it.

That last row is worth pausing on, because it explains a pattern you may have felt in this series: CloudTrail gave you its core for free, GuardDuty and Inspector and Security Hub all opened with 30-day trials — and Config, the humblest of the lot, charges from minute one. There is a logic to it. The others are analysis on top of data AWS already has; Config is storage-backed bookkeeping that starts writing the moment you turn it on. But it means the mental model "security services start free" fails exactly here, on the service the others depend on.

Rules: the clerk starts judging, not just recording

Recording history is half the service. The other half is Config rules: checks that evaluate resources against a condition, either every time the resource changes or on a schedule. AWS ships hundreds of managed rules ready to switch on — s3-bucket-public-read-prohibited, restricted-ssh (no port 22 open to 0.0.0.0/0), encrypted-volumes, iam-user-mfa-enabled — and each one marks each resource it covers as COMPLIANT or NON_COMPLIANT. The clerk stops being a passive scribe and starts flagging ledger entries that break the building code. Three things make rules more useful than they sound:

First, they are continuous. A one-time security review finds the port that was open on review day; a Config rule finds the port that opens at 11 p.m. three weeks later, within minutes of it opening. Second, they are historical — because rules ride on the timeline, you can answer "how long was this bucket public?" with dates, which is precisely the question an incident report asks. Third, some rules can fix things: attach a remediation action (an SSM Automation document, prebuilt for the common cases) and a NON_COMPLIANT finding can automatically close the port or re-enable the encryption, no human awake. Use that power sparingly and start with the alarm-only version further down — but know it exists, because "detects and reverts world-open SSH by itself" is a sentence that used to require a security team.

Two more features round out the service, both included in what you already pay: conformance packs bundle dozens of rules into one deployable unit ("Operational Best Practices for S3") with its own per-evaluation price, and advanced query lets you ask SQL-style questions across your whole inventory — SELECT resourceId WHERE resourceType = 'AWS::EC2::SecurityGroup' — which quietly makes Config the best free-with-what-you-pay asset inventory in AWS: every resource, every region, one search box, including the ones you forgot you had.

The engine under Security Hub: why enabling one enabled the other

If you followed the Security Hub post, you clicked one Enable button and the console mentioned Config in passing. Here is what actually happened: Security Hub CSPM’s hundreds of checks are Config rules, mechanically. The front desk does not inspect the building; it reads the clerk’s ledger against AWS’s code book. So enabling CSPM enables Config recording — no ledger, no checks — and AWS, fairly, does not charge you separately for the rule evaluations those standards run. What it does charge for, normally and from day one, is the recording underneath, and the 30-day CSPM trial does not touch that. This is not fine print we discovered; it is in AWS’s own pricing notes — but it is the single most common "why is there a Config line on my free trial" question on the internet, which tells you how many people click Enable without meeting the clerk first. You have now met the clerk. You are ahead of most.

The dependency also runs the other way, and it bites quietly: if you disable Config recording to save its pocket change, Security Hub CSPM’s checks silently stop updating. The score freezes, findings go stale, nothing turns red to tell you. If you ever decide to turn either service off, turn them off together, on purpose — not one out from under the other.

AWS Config pricing: the honest bill, with no free tier

All prices US East (N. Virginia), checked on AWS’s pricing page August 31, 2026. Other regions differ slightly; the shape is identical.

Worked small-account math, so the abstractions become a bill: say your account has 40 recorded resources and a normal month touches 60 changes — deploys, a few console edits, some automatic certificate rotations. Recording: 60 × $0.003 = $0.18. Add Security Hub CSPM’s standards evaluating on those changes (which AWS does not bill you rule-fees for) and a handful of your own rules: maybe another few hundred evaluations, well under a dollar. That is the realistic hobby-account landing zone — cents to a dollar or two — and it matches what we saw on a real account in the last post. For contrast, AWS’s own worked example for a mid-size setup — 10,000 items and 65,000 evaluations in a month — comes to $95. The gap between eighteen cents and ninety-five dollars is not a pricing trick; it is churn. Which brings us to the setting AWS built for exactly that problem — and its counterintuitive catch.

The four-changes-a-day rule: when "cheaper" daily recording costs more

Config’s recorder has two modes. Continuous records every change as it happens: $0.003 each, full timeline, nothing missed. Daily (AWS calls it periodic) records one item per resource per day, only on days that resource changed: $0.012 each — you trade the play-by-play for an end-of-day summary. The word "daily" and the marketing around it read like a discount, and for the accounts it was built for, it is one: that CI pipeline rebuilding a stack 40 times a day writes 40 items ($0.12) continuously but one item ($0.012) daily — a 90% cut.

Now run the same arithmetic on a quiet account, because this is the trap: a resource that changes once on a given day costs $0.003 continuous but $0.012 daily — four times more. The break-even is four changes per resource per day: fewer than that and daily mode is a price increase wearing a discount’s name tag. Since most small accounts change most resources far less than four times a day, the honest default for readers of this series is the opposite of the intuition the names create: stay on continuous; you keep the full timeline and pay less. Daily mode earns its keep only on genuinely churning fleets — and if you have one of those, you likely also want the mixed approach in the next section instead of a blanket switch.

Three recorder settings that keep the bill at pocket change

All three live in Config → Settings → Edit recorder, none of them require turning the clerk off, and together they are the closest thing to a one-page AWS Config best-practices list for a small account:

1. Record specific resource types, not "all." The default records everything it supports, including chatty infrastructure plumbing you will never investigate. The classic offender is AWS::EC2::NetworkInterface — network interfaces appear and vanish every time certain services breathe, each one writing items. If your bill has a Config line you do not understand, open Config → Settings and look at what is being recorded, then scope the list to what you would actually miss: security groups, buckets, IAM, instances, databases. (The one caveat: Security Hub CSPM’s checks need the resource types its rules judge — if you scope, keep the security-relevant types on the list.)
2. Turn off global-resource recording everywhere except one region. IAM users and roles are global, but if Config records "global resources" in every region, every IAM change is written into each region’s ledger — the same change billed several times. Pick your home region, record global resources there, and uncheck it in the others. This is the closest thing Config has to a free lunch.
3. Choose recording mode per resource type, not per account. The daily-vs-continuous choice from the last section can be mixed: continuous for the quiet, important things (IAM, security groups, buckets — where you want the exact minute), daily for a churning type you must record but only need summarized. The four-changes-a-day arithmetic decides each row for you.

How to enable AWS Config properly, step by step

If Security Hub already switched Config on for you, skip to step 4 — steps 1–3 happened without you, and step 4 is where you make the recorder yours. Starting fresh:

1. Open the Config console in your main region and choose Get started (1-click setup is fine; everything it decides is editable later).
2. Let it create the S3 bucket it offers — that is where your configuration history and snapshots live, and its storage cost at this scale is fractions of a cent. Skip the SNS topic option; the alarm we build below is better targeted than a feed of every change.
3. Accept the service-linked role. Like every service in this series, the clerk gets exactly the permissions its job needs — the IAM post explains why that pattern is a feature, not a formality.
4. Go straight to Settings → Edit recorder and apply the last section: scope the resource types, keep global resources in this region only, leave the mode on continuous. Two minutes now, and the bill stays boring forever.
5. Add your first rule even if Security Hub already runs hundreds: Rules → Add rule → search restricted-ssh and add it as-is. It is the single highest-value check in the catalog for anyone who runs servers, and having one rule of your own makes the alarm below concrete.
6. Open a resource’s timeline once so you know the road before you need it at 2 a.m.: Config → Resources → pick a security group → Resource timeline. That page is the product.

The 11 p.m. door: what the clerk caught at Jake’s shop

Jake runs a phone repair shop; his AWS account runs the shop’s website, its booking system, and — since this series started — the whole security staff. Config arrived in his account the way it arrives in most: silently, under Security Hub, in the last post. His first reaction was the bill line — about sixty cents — and his second was the question this post opened with: what am I paying the clerk for? The answer showed up three weeks later, at 11:04 on a Tuesday night, when his cousin — who helps with the website and had a deploy that would not connect — "fixed" it by opening SSH to the entire internet. It worked. He went to bed. He did not mention it.

At 11:09, the restricted-ssh rule evaluated the changed security group and flipped it NON_COMPLIANT. At 11:10, the alarm you are about to build sent Jake an email. He read it in the morning — which was fine; this was a door left unlocked, not an intruder in the building — and the investigation took four minutes flat, because every question had a page: the Config timeline showed the security group’s before-and-after, diffed — port 22, 0.0.0.0/0, 11:04 p.m. The linked CloudTrail event named the cousin’s IAM user. And GuardDuty, asked whether anyone had walked through the open door overnight, had nothing to report — the door was open seven hours and the internet’s scanners had knocked, but nobody got in.

Ethan’s verdict, over the counter: "Notice what you did not have to do. You did not interrogate your cousin from memory, you did not wonder how long it had been open, you did not rebuild the rule set by guesswork. The clerk had the before-state, the log had the name, the guard had the all-clear. Sixty cents a month, and the first incident report writes itself." Jake closed the port from the timeline page, showed his cousin the diff instead of an argument — the ledger is wonderfully non-accusatory; it just says what happened — and they set up a proper path for deploys. If your version of the 11 p.m. door has already happened and you had no clerk: that is not a personal failing, it is the default state of every AWS account ever created. It is also fixable in the ten minutes above.

The $0 "email me when something goes NON_COMPLIANT" alarm — promise kept

Every post in this series keeps the same promise: the service’s findings must reach a human without a dashboard habit and without a monthly fee. If you built the Security Hub post’s alarm, good news — you may already be covered, because CSPM turns failed checks into Security Hub findings and that alarm catches Criticals from every service at once. This version is for direct Config users, for rules outside the standards, and for anyone who wants the un-filtered feed of their own rules:

1. Open Amazon SNS → Topics → Create topic: Standard, name it config-alerts. Create a subscription: protocol Email, your address, then click the confirmation link AWS sends you. (Email delivery here costs nothing at any volume a human inbox can survive.)
2. Open Amazon EventBridge → Rules → Create rule, name it config-noncompliant, event bus default, rule with an event pattern.
3. Pattern: source AWS services → Config → Config Rules Compliance Change. Then edit the pattern to add "newEvaluationResult": {"complianceType": ["NON_COMPLIANT"]} under detail — without that filter you will also get a cheerful email every time something turns back COMPLIANT, and cheerful emails train you to stop reading.
4. Target: your config-alerts SNS topic. Create the rule.
5. Test it for real, because an untested alarm is a decoration: open a security group on a test resource, add an SSH rule from 0.0.0.0/0, wait for restricted-ssh to evaluate (minutes), get the email, remove the rule, and watch that no second email arrives — that silence is your filter working.

Total cost: the EventBridge rule is free for AWS service events, SNS email at this volume is free, and the only bill is the $0.001 evaluation that would have run anyway. The clerk now taps you on the shoulder. That is the promise, kept — and it is the sixth alarm this series has wired for $0, which means Jake’s shop now has better security monitoring than most companies had a decade ago, for less than the price of one coffee a year.

Do you actually need Config? The honest sizes

Honesty corner, as every stop in this series has one. If your account is a single static website and nothing else ever changes, Config will record almost nothing, cost almost nothing, and tell you almost nothing — you can live without it, and if you also skip Security Hub CSPM, nothing else in this series breaks. The moment any of these is true, the clerk earns the desk: more than one human (or one script) can change your account; you run anything a compliance question could reach; you have ever asked "what changed?" while something was down; or you enabled Security Hub — in which case the decision is already made and your only real job is the recorder tuning above. And one scale note in the other direction: in a multi-account organization, Config aggregators pull every account’s compliance state into one view — that is enterprise territory, but if work ever asks you "can we see all accounts in one place?", the answer is the aggregator, and knowing the word is most of the battle.

The whole staff on one page: six services, six jobs

With the clerk hired, the security wing of Ethan’s building is fully staffed. The tell-words column settles nine out of ten "which service does X?" questions:

One hire is still missing from the building, and her job is different from all six: everyone above watches doors, locks, and ledgers — nobody has ever opened the filing cabinets and read what is inside the files. The employee who does that — who can tell you "this bucket contains 4,000 customer phone numbers and it is the one your cousin almost left public" — is Amazon Macie, the librarian, and she is the next stop in this series.

The exam corner: how certifications ask about Config

Config is an exam favorite precisely because of the CloudTrail confusion this post untangled, and the trap is always the same swap: a question describes needing to know who made a call (CloudTrail) but offers Config as a tempting answer, or describes needing a resource’s configuration history / point-in-time state / drift detection (Config, every time) and offers CloudTrail. Anchor sentence: CloudTrail records API activity; Config records resource state over time and evaluates it against rules. Second-order facts that appear: Config is regional (aggregators for cross-region/account views); rules can trigger automatic remediation via SSM Automation documents; conformance packs bundle rules for compliance frameworks; Config can record deleted resources’ final state; and "detect when someone changes a setting away from the approved baseline" is Config rules, not CloudWatch. If the words "compliance over time," "configuration history," or "drift" appear, the answer is the clerk.

FAQ — AWS Config, answered straight

What is AWS Config in simple terms?

A recorder for your AWS account’s settings. Every time a resource changes, Config saves a snapshot of its full configuration, building a per-resource timeline of what changed and when — and its rules can automatically flag changes that break best practice.

Is AWS Config free?

No — it is one of the few AWS security services with no free tier and no trial. It bills $0.003 per recorded change and $0.001 per rule evaluation (US East, first tier). A quiet small account lands at cents per month.

Why is AWS Config on my bill if I never enabled it?

Almost always: you enabled Security Hub CSPM, and its checks run on Config, so recording was switched on underneath. The CSPM free trial does not cover the Config charge. It is usually cents — check Billing → Bills → Config to see yours.

What is a configuration item in AWS Config?

One recorded snapshot of one resource’s complete settings at one moment, created when the resource changes. It is the unit Config bills by: five edits to a security group = five items = $0.015. Unchanged resources record nothing.

What is the difference between AWS Config and CloudTrail?

CloudTrail records API calls — who did what, when. Config records resource state — what the settings were before and after, kept as a timeline. CloudTrail names the hand; Config shows the damage. Investigations want both, and the console links them.

How much does AWS Config cost for a small account?

Cents to a dollar or two per month. Worked example: 60 recorded changes a month is $0.18, plus well under a dollar of rule evaluations. The bill only grows on accounts whose infrastructure churns constantly — and the recorder settings can tame that.

Should I use continuous or daily recording in AWS Config?

Continuous, for most small accounts. Daily recording ($0.012/item) only becomes cheaper than continuous ($0.003/item) when a resource changes more than four times a day. Below that threshold, "daily" is a 4x price increase — and you lose the minute-by-minute timeline.

How do I reduce my AWS Config bill?

Three recorder settings: record specific resource types instead of all (network interfaces are the classic churn offender), record global resources like IAM in only one region, and switch genuinely high-churn types to daily mode using the four-changes-a-day break-even.

Can I turn off AWS Config?

Yes — stop the recorder in each region (and delete rules to stop evaluations). But if Security Hub CSPM is on, its checks silently stop updating without Config. Turn them off together, deliberately — never one out from under the other.

What are AWS Config rules?

Automatic checks evaluated against recorded resources — on every change or on a schedule — marking each COMPLIANT or NON_COMPLIANT. AWS ships hundreds of managed ones, like restricted-ssh (no world-open port 22) and encrypted-volumes. $0.001 per evaluation in the first tier.

Can AWS Config fix problems automatically?

Yes — rules can attach remediation actions (SSM Automation documents) that, for example, close a world-open port or re-enable encryption when a resource goes NON_COMPLIANT. Start with email alerts first; add auto-remediation once you trust the rule’s judgment.

Does Security Hub need AWS Config?

Yes. Security Hub CSPM’s configuration checks are mechanically Config rules reading Config’s recorded data — no recording, no checks. That is why enabling CSPM enables Config, and why AWS does not separately bill the rule evaluations its standards run.

Does AWS Config tell me who changed something?

Not by itself — that is CloudTrail’s job. But Config’s timeline links each configuration change to the CloudTrail events that caused it, so in practice you get from "what changed" to "who did it" in one click.

What is a conformance pack in AWS Config?

A bundle of Config rules (plus optional remediation) deployed as one unit — for example "Operational Best Practices for S3" — billed at $0.001 per rule evaluation in the first tier. Useful when a compliance framework hands you a checklist forty rules long.

Is AWS Config worth it for a personal account?

If more than one person or script changes the account, or Security Hub is on, yes — the timeline alone justifies the cents. A truly static single-site account can honestly skip it; nothing else in this series breaks if you also skip CSPM.

Is AWS Config the same as the aws configure command?

No. aws configure is a CLI command that saves your access keys (or SSO login) on your own computer so the terminal can call AWS. AWS Config is a cloud service that records your resources’ configuration history. The similar names are an accident of AWS naming, nothing more.

AWS Config vs Trusted Advisor — what is the difference?

Trusted Advisor gives point-in-time recommendations from AWS’s own fixed checklist (cost, performance, security, limits), with the full list gated behind paid support plans. Config records your resources continuously, keeps the history, and evaluates rules you choose — and it alarms within minutes of a change, not whenever you next open a dashboard.

What comes after Config in this series?

Amazon Macie — the librarian. Every service so far watched doors, locks, and ledgers; Macie opens the filing cabinets and tells you which S3 buckets actually contain sensitive data, like customer phone numbers. That post is next.

Where to go next

Revision note. Written August 31, 2026. All prices are US East (N. Virginia), read from AWS’s Config pricing page that day; the four-changes-a-day arithmetic follows directly from those two published rates, so if the rates move, redo the division before trusting the conclusion. Rule names and console paths were checked the same day. Two things will drift first: pricing tiers, and the exact wording of the recorder settings screen, which AWS rearranges every year or so — tell me through the contact page when either happens and I will update this. And if you arrived here from your first bill, holding a Config line you never asked for: you were not careless, and nobody tricked you maliciously — you met the one AWS security service that starts work before introducing itself. Now it has introduced itself. Sixty cents a month for a clerk with a perfect memory is, on reflection, the best deal in the building.