6.1

6.1 Create AWS Config Rules for Encryption in Console

Review and ensure that you have setup your development environment before going through the steps below.

"AWS Config provides AWS managed rules, which are predefined, customizable rules that AWS Config uses to evaluate whether your AWS resources comply with common best practices. For example, you can define the rule's scope to constrain which resources trigger an evaluation for the rule, such as EC2 instances or volumes." Source

Enable AWS Config Recording

In this exercise, you will configure the settings for AWS Config which includes turning on the Config recorder along with a delivery channel. If you have already configured AWS Config, this section is optional. Here are the steps:

1. Go to the AWS Config console.
2. If it is your first time using Config, click the Get Started button.
3. Select the Include global resources (e.g., AWS IAM resources) checkbox.
4. In the Amazon SNS topic section, select the Stream configuration changes and notifications to an Amazon SNS topic checkbox.
5. Choose the Create a topic radio button in the Amazon SNS topic section
6. In the Amazon S3 bucket section, select the Create a bucket radio button
7. In the AWS Config role section, select the Use an existing AWS Config service-linked role radio button
8. Click the Next button
9. Click the Skip button on the AWS Config rules page
10. Click the Confirm button on the Review page

Launch a Managed Config Rule

1. Launch the AWS Config Console
2. Click Rules
3. Click Add rule
4. Type encrypted
5. Select encrypted-volumes
6. Click Save
7. Go to the AWS Config Dashboard and refresh the results

Additional Resources

• List of AWS Config Managed Rules
• Creating AWS Config Managed Rules With AWS CloudFormation Templates