[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEZYQQJHEE12QQ8DFZE9BD":3,"skill-same:01M6AEZYQQJHEE12QQ8DFZE9BD":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":71,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6AEZYQQJHEE12QQ8DFZE9BD","implementing-aws-config-rules-for-compliance",null,"Implements AWS Config managed and custom rules for continuous compliance monitoring of AWS resources aligned to CIS and PCI DSS, configuring automatic remediation with SSM Automation and aggregating compliance data across accounts. Use when establishing continuous compliance monitoring, detecting configuration drift, or building a multi-account compliance dashboard via AWS Organizations.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-config-rules-for-compliance\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"compliance","implementing aws config rules for compliance","aws","config","automation","pr","monitoring","cloud","security","cloud-security","data","dashboard","remediation","continuous compliance","t1078","config-rules","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-aws-config-rules-for-compliance\ndescription: 'Implements AWS Config managed and custom rules for continuous compliance\n  monitoring of AWS resources aligned to CIS and PCI DSS, configuring automatic remediation\n  with SSM Automation and aggregating compliance data across accounts. Use when establishing\n  continuous compliance monitoring, detecting configuration drift, or building a\n  multi-account compliance dashboard via AWS Organizations.'\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- aws\n- config-rules\n- compliance\n- automation\n- remediation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n---\n\n# Implementing AWS Config Rules for Compliance\n\n## When to Use\n\n- When establishing continuous compliance monitoring for AWS resources against regulatory standards\n- When implementing automated detection and remediation of configuration drift\n- When building a compliance dashboard across multiple AWS accounts using AWS Organizations\n- When audit teams require evidence of continuous compliance rather than point-in-time assessments\n- When deploying guardrails that detect non-compliant resources within minutes of creation\n\n**Do not use** for real-time threat detection (use GuardDuty), for application vulnerability scanning (use Inspector), or for one-time compliance assessments (use Prowler for faster ad-hoc audits).\n\n## Prerequisites\n\n- AWS Config recording enabled in all target accounts and regions\n- IAM role with `config:*`, `ssm:*`, and `lambda:*` permissions for rule management\n- AWS Organizations with delegated administrator for Config aggregation\n- S3 bucket for Config delivery channel and SNS topic for notifications\n- CloudFormation StackSets or Terraform for multi-account rule deployment\n\n## Workflow\n\n### Step 1: Enable AWS Config Recording\n\nSet up the Config recorder and delivery channel in each target account.\n\n```bash\n# Create S3 bucket for Config data\naws s3api create-bucket \\\n  --bucket config-compliance-data-ACCOUNT_ID \\\n  --region us-east-1\n\n# Create Config service role\naws iam create-service-linked-role --aws-service-name config.amazonaws.com\n\n# Start the Config recorder\naws configservice put-configuration-recorder \\\n  --configuration-recorder name=default,roleARN=arn:aws:iam::ACCOUNT:role\u002Faws-service-role\u002Fconfig.amazonaws.com\u002FAWSServiceRoleForConfig \\\n  --recording-group allSupported=true,includeGlobalResourceTypes=true\n\n# Set up delivery channel\naws configservice put-delivery-channel \\\n  --delivery-channel '{\n    \"name\": \"default\",\n    \"s3BucketName\": \"config-compliance-data-ACCOUNT_ID\",\n    \"snsTopicARN\": \"arn:aws:sns:us-east-1:ACCOUNT:config-notifications\",\n    \"configSnapshotDeliveryProperties\": {\"deliveryFrequency\": \"TwentyFour_Hours\"}\n  }'\n\n# Start recording\naws configservice start-configuration-recorder --configuration-recorder-name default\n```\n\n### Step 2: Deploy Managed Config Rules for CIS Compliance\n\nEnable AWS-managed Config rules that map to CIS AWS Foundations Benchmark controls.\n\n```bash\n# S3 bucket security rules\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"s3-bucket-public-read-prohibited\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"S3_BUCKET_PUBLIC_READ_PROHIBITED\"}\n}'\n\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"s3-bucket-server-side-encryption-enabled\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED\"}\n}'\n\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"s3-bucket-ssl-requests-only\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"S3_BUCKET_SSL_REQUESTS_ONLY\"}\n}'\n\n# IAM security rules\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"iam-root-access-key-check\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"IAM_ROOT_ACCESS_KEY_CHECK\"}\n}'\n\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"mfa-enabled-for-iam-console-access\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS\"}\n}'\n\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"iam-password-policy\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"IAM_PASSWORD_POLICY\"},\n  \"InputParameters\": \"{\\\"RequireUppercaseCharacters\\\":\\\"true\\\",\\\"RequireLowercaseCharacters\\\":\\\"true\\\",\\\"RequireSymbols\\\":\\\"true\\\",\\\"RequireNumbers\\\":\\\"true\\\",\\\"MinimumPasswordLength\\\":\\\"14\\\"}\"\n}'\n\n# Network security rules\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"restricted-ssh\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"INCOMING_SSH_DISABLED\"}\n}'\n\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"vpc-flow-logs-enabled\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"VPC_FLOW_LOGS_ENABLED\"}\n}'\n\n# Encryption rules\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"rds-storage-encrypted\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"RDS_STORAGE_ENCRYPTED\"}\n}'\n\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"encrypted-volumes\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"ENCRYPTED_VOLUMES\"}\n}'\n```\n\n### Step 3: Create Custom Config Rules with Lambda\n\nBuild custom rules for organization-specific compliance requirements.\n\n```python\n# custom_config_rule.py - Ensure EC2 instances have required tags\nimport json\nimport boto3\n\nconfig = boto3.client('config')\n\nREQUIRED_TAGS = ['Environment', 'Owner', 'CostCenter', 'Project']\n\ndef lambda_handler(event, context):\n    invoking_event = json.loads(event['invokingEvent'])\n    configuration_item = invoking_event.get('configurationItem', {})\n\n    if configuration_item['resourceType'] != 'AWS::EC2::Instance':\n        return\n\n    tags = {t['key']: t['value'] for t in configuration_item.get('tags', [])}\n    missing_tags = [tag for tag in REQUIRED_TAGS if tag not in tags]\n\n    if missing_tags:\n        compliance = 'NON_COMPLIANT'\n        annotation = f\"Missing required tags: {', '.join(missing_tags)}\"\n    else:\n        compliance = 'COMPLIANT'\n        annotation = 'All required tags present'\n\n    config.put_evaluations(\n        Evaluations=[{\n            'ComplianceResourceType': configuration_item['resourceType'],\n            'ComplianceResourceId': configuration_item['resourceId'],\n            'ComplianceType': compliance,\n            'Annotation': annotation,\n            'OrderingTimestamp': configuration_item['configurationItemCaptureTime']\n        }],\n        ResultToken=event['resultToken']\n    )\n```\n\n```bash\n# Deploy the custom rule\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"ec2-required-tags\",\n  \"Source\": {\n    \"Owner\": \"CUSTOM_LAMBDA\",\n    \"SourceIdentifier\": \"arn:aws:lambda:us-east-1:ACCOUNT:function:config-required-tags\",\n    \"SourceDetails\": [{\n      \"EventSource\": \"aws.config\",\n      \"MessageType\": \"ConfigurationItemChangeNotification\"\n    }]\n  },\n  \"Scope\": {\"ComplianceResourceTypes\": [\"AWS::EC2::Instance\"]}\n}'\n```\n\n### Step 4: Configure Automatic Remediation\n\nSet up SSM Automation documents for automatic remediation of non-compliant resources.\n\n```bash\n# Auto-remediate public S3 buckets\naws configservice put-remediation-configurations --remediation-configurations '[{\n  \"ConfigRuleName\": \"s3-bucket-public-read-prohibited\",\n  \"TargetType\": \"SSM_DOCUMENT\",\n  \"TargetId\": \"AWS-DisableS3BucketPublicReadWrite\",\n  \"Parameters\": {\n    \"S3BucketName\": {\"ResourceValue\": {\"Value\": \"RESOURCE_ID\"}},\n    \"AutomationAssumeRole\": {\"StaticValue\": {\"Values\": [\"arn:aws:iam::ACCOUNT:role\u002FConfigRemediationRole\"]}}\n  },\n  \"Automatic\": true,\n  \"MaximumAutomaticAttempts\": 3,\n  \"RetryAttemptSeconds\": 60\n}]'\n\n# Auto-remediate unencrypted EBS volumes\naws configservice put-remediation-configurations --remediation-configurations '[{\n  \"ConfigRuleName\": \"encrypted-volumes\",\n  \"TargetType\": \"SSM_DOCUMENT\",\n  \"TargetId\": \"AWS-EnableEBSEncryptionByDefault\",\n  \"Parameters\": {\n    \"AutomationAssumeRole\": {\"StaticValue\": {\"Values\": [\"arn:aws:iam::ACCOUNT:role\u002FConfigRemediationRole\"]}}\n  },\n  \"Automatic\": true,\n  \"MaximumAutomaticAttempts\": 1,\n  \"RetryAttemptSeconds\": 300\n}]'\n\n# Auto-remediate security groups allowing SSH from 0.0.0.0\u002F0\naws configservice put-remediation-configurations --remediation-configurations '[{\n  \"ConfigRuleName\": \"restricted-ssh\",\n  \"TargetType\": \"SSM_DOCUMENT\",\n  \"TargetId\": \"AWS-DisablePublicAccessForSecurityGroup\",\n  \"Parameters\": {\n    \"GroupId\": {\"ResourceValue\": {\"Value\": \"RESOURCE_ID\"}},\n    \"AutomationAssumeRole\": {\"StaticValue\": {\"Values\": [\"arn:aws:iam::ACCOUNT:role\u002FConfigRemediationRole\"]}}\n  },\n  \"Automatic\": true,\n  \"MaximumAutomaticAttempts\": 3,\n  \"RetryAttemptSeconds\": 60\n}]'\n```\n\n### Step 5: Set Up Multi-Account Aggregation\n\nAggregate compliance data from all organization accounts into a central view.\n\n```bash\n# Create a Config aggregator for the organization\naws configservice put-configuration-aggregator \\\n  --configuration-aggregator-name org-compliance-aggregator \\\n  --organization-aggregation-source '{\n    \"RoleArn\": \"arn:aws:iam::ACCOUNT:role\u002FConfigAggregatorRole\",\n    \"AllAwsRegions\": true\n  }'\n\n# Query aggregate compliance across all accounts\naws configservice get-aggregate-compliance-details-by-config-rule \\\n  --configuration-aggregator-name org-compliance-aggregator \\\n  --config-rule-name s3-bucket-public-read-prohibited \\\n  --compliance-type NON_COMPLIANT \\\n  --query 'AggregateEvaluationResults[*].[AccountId,AwsRegion,EvaluationResultIdentifier.EvaluationResultQualifier.ResourceId,ComplianceType]' \\\n  --output table\n\n# Get compliance summary by account\naws configservice get-aggregate-compliance-summary-by-source \\\n  --configuration-aggregator-name org-compliance-aggregator \\\n  --query 'AggregateComplianceCounts[*].[GroupName,ComplianceSummary.CompliantResourceCount.CappedCount,ComplianceSummary.NonCompliantResourceCount.CappedCount]' \\\n  --output table\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| AWS Config Rule | A compliance check that evaluates whether AWS resource configurations meet specified requirements, either continuously or on a schedule |\n| Managed Rule | AWS-provided pre-built Config rule with standardized logic for common compliance checks like encryption and public access |\n| Custom Rule | Organization-specific Config rule backed by a Lambda function that evaluates custom compliance logic |\n| Remediation Action | SSM Automation document or Lambda function triggered to automatically fix non-compliant resources |\n| Configuration Aggregator | AWS Config feature that collects compliance data from multiple accounts and regions into a centralized view |\n| Conformance Pack | Collection of Config rules and remediation actions packaged as a deployable unit for specific compliance frameworks |\n\n## Tools & Systems\n\n- **AWS Config**: Continuous configuration recording and compliance evaluation service for AWS resources\n- **SSM Automation**: AWS Systems Manager documents for executing automated remediation actions on non-compliant resources\n- **Config Conformance Packs**: Pre-built rule collections for CIS, PCI DSS, NIST 800-53, and HIPAA compliance\n- **CloudFormation StackSets**: Multi-account deployment mechanism for Config rules across AWS Organizations\n- **Config Aggregator**: Cross-account and cross-region compliance data consolidation\n\n## Common Scenarios\n\n### Scenario: Deploying CIS Compliance Monitoring Across 30 AWS Accounts\n\n**Context**: A financial services company needs to demonstrate continuous CIS AWS Foundations Benchmark compliance across all 30 production accounts for their annual SOC 2 audit.\n\n**Approach**:\n1. Enable AWS Config recording in all accounts via CloudFormation StackSets\n2. Deploy the CIS conformance pack to all accounts using StackSets\n3. Set up a Config aggregator in the security account for organization-wide visibility\n4. Configure auto-remediation for safe-to-fix rules (public S3, unencrypted volumes)\n5. Create EventBridge rules to alert on new NON_COMPLIANT evaluations\n6. Build a weekly compliance report aggregating scores across all accounts\n7. Store Config snapshots in S3 with lifecycle policies for audit retention\n\n**Pitfalls**: Config recording incurs costs per configuration item recorded. In accounts with many resources, costs can be significant. Use targeted recording groups to focus on compliance-relevant resource types rather than recording all resources. Auto-remediation of network rules (security groups) can disrupt applications if the rule was intentionally permissive.\n\n## Output Format\n\n```\nAWS Config Compliance Report\n===============================\nOrganization: Acme Financial (30 accounts)\nFramework: CIS AWS Foundations 1.4\nReport Date: 2026-02-23\nConfig Rules Active: 48\n\nCOMPLIANCE SUMMARY:\n  Overall Compliance: 87%\n  Compliant Resources:     4,234\n  Non-Compliant Resources:   612\n  Not Applicable:            189\n\nTOP NON-COMPLIANT RULES:\n  encrypted-volumes:              89 resources (14 accounts)\n  vpc-flow-logs-enabled:          67 resources (12 accounts)\n  mfa-enabled-for-iam-console:    45 resources (8 accounts)\n  s3-bucket-ssl-requests-only:    34 resources (6 accounts)\n  restricted-ssh:                 28 resources (5 accounts)\n\nAUTO-REMEDIATION (Last 30 Days):\n  Public S3 buckets remediated:    12\n  Security groups restricted:       8\n  EBS default encryption enabled:   6\n  Total auto-remediated:           26\n  Failed remediation attempts:      3\n\nACCOUNT COMPLIANCE RANKING:\n  1. prod-core (account-001):     96% compliant\n  2. prod-data (account-002):     94% compliant\n  ...\n  30. dev-sandbox (account-030):  68% compliant\n```\n","# Implementing AWS Config Rules for Compliance\n\n## When to Use\n\n- When establishing continuous compliance monitoring for AWS resources against regulatory standards\n- When implementing automated detection and remediation of configuration drift\n- When building a compliance dashboard across multiple AWS accounts using AWS Organizations\n- When audit teams require evidence of continuous compliance rather than point-in-time assessments\n- When deploying guardrails that detect non-compliant resources within minutes of creation\n\n**Do not use** for real-time threat detection (use GuardDuty), for application vulnerability scanning (use Inspector), or for one-time compliance assessments (use Prowler for faster ad-hoc audits).\n\n## Prerequisites\n\n- AWS Config recording enabled in all target accounts and regions\n- IAM role with `config:*`, `ssm:*`, and `lambda:*` permissions for rule management\n- AWS Organizations with delegated administrator for Config aggregation\n- S3 bucket for Config delivery channel and SNS topic for notifications\n- CloudFormation StackSets or Terraform for multi-account rule deployment\n\n## Workflow\n\n### Step 1: Enable AWS Config Recording\n\nSet up the Config recorder and delivery channel in each target account.\n\n```bash\n# Create S3 bucket for Config data\naws s3api create-bucket \\\n  --bucket config-compliance-data-ACCOUNT_ID \\\n  --region us-east-1\n\n# Create Config service role\naws iam create-service-linked-role --aws-service-name config.amazonaws.com\n\n# Start the Config recorder\naws configservice put-configuration-recorder \\\n  --configuration-recorder name=default,roleARN=arn:aws:iam::ACCOUNT:role\u002Faws-service-role\u002Fconfig.amazonaws.com\u002FAWSServiceRoleForConfig \\\n  --recording-group allSupported=true,includeGlobalResourceTypes=true\n\n# Set up delivery channel\naws configservice put-delivery-channel \\\n  --delivery-channel '{\n    \"name\": \"default\",\n    \"s3BucketName\": \"config-compliance-data-ACCOUNT_ID\",\n    \"snsTopicARN\": \"arn:aws:sns:us-east-1:ACCOUNT:config-notifications\",\n    \"configSnapshotDeliveryProperties\": {\"deliveryFrequency\": \"TwentyFour_Hours\"}\n  }'\n\n# Start recording\naws configservice start-configuration-recorder --configuration-recorder-name default\n```\n\n### Step 2: Deploy Managed Config Rules for CIS Compliance\n\nEnable AWS-managed Config rules that map to CIS AWS Foundations Benchmark controls.\n\n```bash\n# S3 bucket security rules\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"s3-bucket-public-read-prohibited\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"S3_BUCKET_PUBLIC_READ_PROHIBITED\"}\n}'\n\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"s3-bucket-server-side-encryption-enabled\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED\"}\n}'\n\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"s3-bucket-ssl-requests-only\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"S3_BUCKET_SSL_REQUESTS_ONLY\"}\n}'\n\n# IAM security rules\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"iam-root-access-key-check\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"IAM_ROOT_ACCESS_KEY_CHECK\"}\n}'\n\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"mfa-enabled-for-iam-console-access\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS\"}\n}'\n\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"iam-password-policy\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"IAM_PASSWORD_POLICY\"},\n  \"InputParameters\": \"{\\\"RequireUppercaseCharacters\\\":\\\"true\\\",\\\"RequireLowercaseCharacters\\\":\\\"true\\\",\\\"RequireSymbols\\\":\\\"true\\\",\\\"RequireNumbers\\\":\\\"true\\\",\\\"MinimumPasswordLength\\\":\\\"14\\\"}\"\n}'\n\n# Network security rules\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"restricted-ssh\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"INCOMING_SSH_DISABLED\"}\n}'\n\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"vpc-flow-logs-enabled\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"VPC_FLOW_LOGS_ENABLED\"}\n}'\n\n# Encryption rules\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"rds-storage-encrypted\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"RDS_STORAGE_ENCRYPTED\"}\n}'\n\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"encrypted-volumes\",\n  \"Source\": {\"Owner\": \"AWS\", \"SourceIdentifier\": \"ENCRYPTED_VOLUMES\"}\n}'\n```\n\n### Step 3: Create Custom Config Rules with Lambda\n\nBuild custom rules for organization-specific compliance requirements.\n\n```python\n# custom_config_rule.py - Ensure EC2 instances have required tags\nimport json\nimport boto3\n\nconfig = boto3.client('config')\n\nREQUIRED_TAGS = ['Environment', 'Owner', 'CostCenter', 'Project']\n\ndef lambda_handler(event, context):\n    invoking_event = json.loads(event['invokingEvent'])\n    configuration_item = invoking_event.get('configurationItem', {})\n\n    if configuration_item['resourceType'] != 'AWS::EC2::Instance':\n        return\n\n    tags = {t['key']: t['value'] for t in configuration_item.get('tags', [])}\n    missing_tags = [tag for tag in REQUIRED_TAGS if tag not in tags]\n\n    if missing_tags:\n        compliance = 'NON_COMPLIANT'\n        annotation = f\"Missing required tags: {', '.join(missing_tags)}\"\n    else:\n        compliance = 'COMPLIANT'\n        annotation = 'All required tags present'\n\n    config.put_evaluations(\n        Evaluations=[{\n            'ComplianceResourceType': configuration_item['resourceType'],\n            'ComplianceResourceId': configuration_item['resourceId'],\n            'ComplianceType': compliance,\n            'Annotation': annotation,\n            'OrderingTimestamp': configuration_item['configurationItemCaptureTime']\n        }],\n        ResultToken=event['resultToken']\n    )\n```\n\n```bash\n# Deploy the custom rule\naws configservice put-config-rule --config-rule '{\n  \"ConfigRuleName\": \"ec2-required-tags\",\n  \"Source\": {\n    \"Owner\": \"CUSTOM_LAMBDA\",\n    \"SourceIdentifier\": \"arn:aws:lambda:us-east-1:ACCOUNT:function:config-required-tags\",\n    \"SourceDetails\": [{\n      \"EventSource\": \"aws.config\",\n      \"MessageType\": \"ConfigurationItemChangeNotification\"\n    }]\n  },\n  \"Scope\": {\"ComplianceResourceTypes\": [\"AWS::EC2::Instance\"]}\n}'\n```\n\n### Step 4: Configure Automatic Remediation\n\nSet up SSM Automation documents for automatic remediation of non-compliant resources.\n\n```bash\n# Auto-remediate public S3 buckets\naws configservice put-remediation-configurations --remediation-configurations '[{\n  \"ConfigRuleName\": \"s3-bucket-public-read-prohibited\",\n  \"TargetType\": \"SSM_DOCUMENT\",\n  \"TargetId\": \"AWS-DisableS3BucketPublicReadWrite\",\n  \"Parameters\": {\n    \"S3BucketName\": {\"ResourceValue\": {\"Value\": \"RESOURCE_ID\"}},\n    \"AutomationAssumeRole\": {\"StaticValue\": {\"Values\": [\"arn:aws:iam::ACCOUNT:role\u002FConfigRemediationRole\"]}}\n  },\n  \"Automatic\": true,\n  \"MaximumAutomaticAttempts\": 3,\n  \"RetryAttemptSeconds\": 60\n}]'\n\n# Auto-remediate unencrypted EBS volumes\naws configservice put-remediation-configurations --remediation-configurations '[{\n  \"ConfigRuleName\": \"encrypted-volumes\",\n  \"TargetType\": \"SSM_DOCUMENT\",\n  \"TargetId\": \"AWS-EnableEBSEncryptionByDefault\",\n  \"Parameters\": {\n    \"AutomationAssumeRole\": {\"StaticValue\": {\"Values\": [\"arn:aws:iam::ACCOUNT:role\u002FConfigRemediationRole\"]}}\n  },\n  \"Automatic\": true,\n  \"MaximumAutomaticAttempts\": 1,\n  \"RetryAttemptSeconds\": 300\n}]'\n\n# Auto-remediate security groups allowing SSH from 0.0.0.0\u002F0\naws configservice put-remediation-configurations --remediation-configurations '[{\n  \"ConfigRuleName\": \"restricted-ssh\",\n  \"TargetType\": \"SSM_DOCUMENT\",\n  \"TargetId\": \"AWS-DisablePublicAccessForSecurityGroup\",\n  \"Parameters\": {\n    \"GroupId\": {\"ResourceValue\": {\"Value\": \"RESOURCE_ID\"}},\n    \"AutomationAssumeRole\": {\"StaticValue\": {\"Values\": [\"arn:aws:iam::ACCOUNT:role\u002FConfigRemediationRole\"]}}\n  },\n  \"Automatic\": true,\n  \"MaximumAutomaticAttempts\": 3,\n  \"RetryAttemptSeconds\": 60\n}]'\n```\n\n### Step 5: Set Up Multi-Account Aggregation\n\nAggregate compliance data from all organization accounts into a central view.\n\n```bash\n# Create a Config aggregator for the organization\naws configservice put-configuration-aggregator \\\n  --configuration-aggregator-name org-compliance-aggregator \\\n  --organization-aggregation-source '{\n    \"RoleArn\": \"arn:aws:iam::ACCOUNT:role\u002FConfigAggregatorRole\",\n    \"AllAwsRegions\": true\n  }'\n\n# Query aggregate compliance across all accounts\naws configservice get-aggregate-compliance-details-by-config-rule \\\n  --configuration-aggregator-name org-compliance-aggregator \\\n  --config-rule-name s3-bucket-public-read-prohibited \\\n  --compliance-type NON_COMPLIANT \\\n  --query 'AggregateEvaluationResults[*].[AccountId,AwsRegion,EvaluationResultIdentifier.EvaluationResultQualifier.ResourceId,ComplianceType]' \\\n  --output table\n\n# Get compliance summary by account\naws configservice get-aggregate-compliance-summary-by-source \\\n  --configuration-aggregator-name org-compliance-aggregator \\\n  --query 'AggregateComplianceCounts[*].[GroupName,ComplianceSummary.CompliantResourceCount.CappedCount,ComplianceSummary.NonCompliantResourceCount.CappedCount]' \\\n  --output table\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| AWS Config Rule | A compliance check that evaluates whether AWS resource configurations meet specified requirements, either continuously or on a schedule |\n| Managed Rule | AWS-provided pre-built Config rule with standardized logic for common compliance checks like encryption and public access |\n| Custom Rule | Organization-specific Config rule backed by a Lambda function that evaluates custom compliance logic |\n| Remediation Action | SSM Automation document or Lambda function triggered to automatically fix non-compliant resources |\n| Configuration Aggregator | AWS Config feature that collects compliance data from multiple accounts and regions into a centralized view |\n| Conformance Pack | Collection of Config rules and remediation actions packaged as a deployable unit for specific compliance frameworks |\n\n## Tools & Systems\n\n- **AWS Config**: Continuous configuration recording and compliance evaluation service for AWS resources\n- **SSM Automation**: AWS Systems Manager documents for executing automated remediation actions on non-compliant resources\n- **Config Conformance Packs**: Pre-built rule collections for CIS, PCI DSS, NIST 800-53, and HIPAA compliance\n- **CloudFormation StackSets**: Multi-account deployment mechanism for Config rules across AWS Organizations\n- **Config Aggregator**: Cross-account and cross-region compliance data consolidation\n\n## Common Scenarios\n\n### Scenario: Deploying CIS Compliance Monitoring Across 30 AWS Accounts\n\n**Context**: A financial services company needs to demonstrate continuous CIS AWS Foundations Benchmark compliance across all 30 production accounts for their annual SOC 2 audit.\n\n**Approach**:\n1. Enable AWS Config recording in all accounts via CloudFormation StackSets\n2. Deploy the CIS conformance pack to all accounts using StackSets\n3. Set up a Config aggregator in the security account for organization-wide visibility\n4. Configure auto-remediation for safe-to-fix rules (public S3, unencrypted volumes)\n5. Create EventBridge rules to alert on new NON_COMPLIANT evaluations\n6. Build a weekly compliance report aggregating scores across all accounts\n7. Store Config snapshots in S3 with lifecycle policies for audit retention\n\n**Pitfalls**: Config recording incurs costs per configuration item recorded. In accounts with many resources, costs can be significant. Use targeted recording groups to focus on compliance-relevant resource types rather than recording all resources. Auto-remediation of network rules (security groups) can disrupt applications if the rule was intentionally permissive.\n\n## Output Format\n\n```\nAWS Config Compliance Report\n===============================\nOrganization: Acme Financial (30 accounts)\nFramework: CIS AWS Foundations 1.4\nReport Date: 2026-02-23\nConfig Rules Active: 48\n\nCOMPLIANCE SUMMARY:\n  Overall Compliance: 87%\n  Compliant Resources:     4,234\n  Non-Compliant Resources:   612\n  Not Applicable:            189\n\nTOP NON-COMPLIANT RULES:\n  encrypted-volumes:              89 resources (14 accounts)\n  vpc-flow-logs-enabled:          67 resources (12 accounts)\n  mfa-enabled-for-iam-console:    45 resources (8 accounts)\n  s3-bucket-ssl-requests-only:    34 resources (6 accounts)\n  restricted-ssh:                 28 resources (5 accounts)\n\nAUTO-REMEDIATION (Last 30 Days):\n  Public S3 buckets remediated:    12\n  Security groups restricted:       8\n  EBS default encryption enabled:   6\n  Total auto-remediated:           26\n  Failed remediation attempts:      3\n\nACCOUNT COMPLIANCE RANKING:\n  1. prod-core (account-001):     96% compliant\n  2. prod-data (account-002):     94% compliant\n  ...\n  30. dev-sandbox (account-030):  68% compliant\n```\n",{"name":5,"tags":51,"author":52,"domain":45,"license":15,"version":53,"nist_csf":54,"subdomain":38,"description":7,"mitre_attack":59},[38,31,44,29,33,41],"mahipal","1.0",[55,56,57,58],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01",[60,61,62,63],"T1078.004","T1530","T1537","T1580","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-aws-config-rules-for-compliance",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-aws-config-rules-for-compliance",{"tool":80,"command":81},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-aws-config-rules-for-compliance",{"tool":83,"command":84},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-aws-config-rules-for-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-config-rules-for-compliance\u002FSKILL.md",true,[88,93,99],{"path":89,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-config-rules-for-compliance\u002FLICENSE",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fapi-reference.md","REFERENCE","参考文档",2383,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-config-rules-for-compliance\u002Freferences\u002Fapi-reference.md",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"scripts\u002Fagent.py","SCRIPT","脚本",6973,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-config-rules-for-compliance\u002Fscripts\u002Fagent.py",[106,131,155,181,206,232],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":113,"publishedAt":46},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[112],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[114,115,116,117,37,45,118,119,34,120,121,122,123,124,125,126,127,128,129,130],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":46},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[137],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[139,127,140,141,37,142,45,34,143,144,145,146,147,148,149,150,151,152,153,154],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":165,"publishedAt":46},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[161,164],{"categoryNo":162,"categoryName":163,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[149,166,167,168,169,45,170,171,143,29,172,173,174,175,176,43,177,178,179,180],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":188,"publishedAt":46},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[187],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[189,190,191,45,192,193,194,195,196,197,198,39,199,200,201,202,146,203,204,205],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":213,"publishedAt":46},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[212],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[214,215,216,45,217,218,219,220,221,222,223,224,225,41,226,227,228,229,230,231],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":46},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[238],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[37,240,45,241,242,243,244,245,246,247,248,43,249,177,250,251,252,253,254,255],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]