> ## Documentation Index
> Fetch the complete documentation index at: https://cloud-architect.ipoint-labs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Auditing Resource Compliance with AWS config
> Hands-on lab ยท 45m
Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console.
Open IP Lab Portal
## Overview
### Lab details
1. This lab walks you through the steps to deploy Auditing Resource Compliance with AWS config
2. You will practice it using AWS config
3. Duration : **45 Minutes**
4. AWS Region: **US East (N. Virginia)**
### Introduction
#### AWS config
* AWS config is a service that enables you to audit and evaluate the configuration of your AWS resource.
* It continuously able to monitor and record your AWS resource configuration and provides you alert whenever there is change in your configuration.
* It will also automatically deliver a configuration history file to the Amazon S3 bucket you specify conformance packs help you manage compliance of your AWS resource configuration
* It will send you Mail using SNS topic for the update or change in AWS config Rule.
#### Architecture Diagram :
#### Lab task
1. First setup AWS config.
2. Create an EC2 server with the desired security group.
3. Create config rule in AWS config to add configuration.
4. Create and subscribe SNS topic and verify email ID
5. Monitoring the complaint status in [Conformance packs](https://us-west-1.console.aws.amazon.com/config/home?region=us-west-1\&v2=true#/conformance-packs) and verify mail complaints
6. Validation Of The Lab
### Summary of Lab session:
1. You will be provided with an EC2 server named **Config\_server** followed by some random number.
2. EC2 server will be attached with **config\_server\_SG security group** with ports 22 and 80 allowed to handle the traffic
3. Creating AWS config rule in AWS config dashboard.
4. Creating and subscribing to SNS topic.
5. Modifying the security group **config\_server\_SG** to add some custom or new port range.
6. Checking for AWS non compliance resource in AWS config dashboard.
7. Getting Alert from AWS regarding founding non compliance resource in AWS config.
8. Reverting the changes by removing the custom or new port added to the security group.
9. AWS will send Alert that the resources are under compliance.
### Launching the lab environment
1. To launch the lab environment, Click on the **Launch lab** button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with **IAM user name**, **Password**, **Access** **Key**, and **Secret** **Access** **Key**.
**Note** : You can only start one lab at any given time
## Lab guide
#### Lab steps
#### Task 1: Sign in to AWS Management Console
1. Click on the **Open console** button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
* Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
* Now copy your **User Name** and **Password** in the Lab Console to the **IAM Username and Password** in AWS Console and click on the **Sign in** button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as **US East (N. Virginia) us-east-1.**
#### Task 2: Create S3 and SNS
1. Click on services and type config and navigate to **AWS Config** dashboard.
2. Make sure you are in the N.Virginia Region.
3. Click on **Get Started**.
4. Now complete the **settings** using below details
* Recording strategy:
* Select : **All resource types with customizable overrides**
* Keep rest things as default
* Delivery Method:
* Select the **Create a bucket** and enter your bucket name.
* Bucket name : **Enter Unique bucket name** ( Ex: whizlabs34567)
* Amazon SNS topic:
* Check the box **Stream configuration changes** and then configure the SNS topic
* Select the **Create a Topic**
* Topic name : **config\_for\_securitygroup\_change**
* Click on **Next** button.
5. In the next screen, leave as default and then click on **Next**.
6. Finally, review your config setup and click on **Confirm.** It will take a few seconds to complete the config rule setup.
#### Task 3: Setting of AWS config Rules
1. Go to AWS Config **Dashboard** in the left panel.
2. Click on **Rules** under conformance packs.
3. Then click on **Add rule** on the right top.
4. Configure Rule type using below details
* Select rule type:
* Select **Add AWS managed rule**
* AWS Managed Rules:
* Type **sg** in the filter box and then select **vpc-sg-open-only-to-authorized-ports** as shown in the below screenshot.
5. Once provided the above details click on **Next**.
6. In the next screen customize the rule with the below details
* Name : **SgauthorizingRule**
* Description : Leave default
7. Trigger:
* Scope of changes: select **Resources**
8. Resources: Leave the default **AWS EC2 SecurityGroup**.
9. Parameters: select the ports you need to add in the rule. In your existing security group you will be added with the ports 22 and 80.
* In case of adding a new rule, you can click on **Add another row.**
10. After providing above details, click on **Next**.
11. Finally Click on **Save.**
12. It will take 4 to 5 minutes for the rule to become available.
#### Task 4: Creating and subscribe SNS topic
1. Click on services and navigate to **Simple Notification Service**.
2. Click on **Topics** in the left panel.
3. Click on the config rule i.e, **config\_for\_securitygroup\_change** created in the earlier step.
4. Click on **Create Subscription** in the right bottom.
5. Complete the subscription using below details
* Topic ARN : Leave Default
* Protocol : Select **Email** in the drop down.
* Endpoint : Enter the **Email address for subscription** ( ex: [test@gmail.com](mailto:test@gmail.com))
* Finally click on **Create Subscription** .
6. Now go to the Inbox of the email provided in the above step and click on **confirm subscription** to get the alerts as shown below
#### Task 5: Checking the status of AWS config
1. To check the status of your config rule navigate to **AWS config dashboard.**
2. Click on **Rules** under conformance packs and click on the rule create by you.
3. Now, scroll down to the **Resources in scope** and select **Compliant** in filter, and you will see one security group with **Compliant** status.
4. Thus the above screenshot states that the ports opened in the Security group attached with our running instance satisfy the rule given in the config.
#### Task 6: Testing the working of AWS config
1. Now click on **Services** and then navigate to the **EC2** dashboard.
2. Click on **Security Groups** and select the security group named **Config\_server\_SG.**
3. Click on **Inbound rules** and then **Edit inbound rules** to add some custom ports. ( Ex: 20-21)
4. Now add the new port with below details
* Type : Select **Custom TCP**
* Protocol : **TCP**
* Port Range : Enter **20-21**
* Source : **0.0.0.0/0**
* Click on **Save rules.**
5. Now navigate to **AWS config dashboard** and then click on **Rules,** wait for **1 or 2 minutes**, and you could see the status of your rule as **Noncompliant resource(s)** as shown below
6. To check the **detailed status,** click on the **SgauthorizingRule** and scroll down a bit and then click on **Resources in scope** and then click on your **security group ID** of your noncompliant security group
7. In the next step click **Resource Timeline** in the right corner.
8. To confirm Alert via **SNS topic,** navigate to the inbox of the email provided at the time of creating SNS topic, and you could see the Alert email from AWS regarding change in your AWS config rule.
9. Now click on **Services** and then navigate to the EC2 **dashboard** and click on **Security Groups** and select the security group named **Config\_server\_SG** and remove the port number 20-21 from the security group and save.
10. Once removed navigate to **AWS config dashboard** and then click on rule, and you could see the status as **Compliant.**
11. Now navigate to the Inbox of your email and you could see AWS have sent the email that the rules are under **complaint**
#### Task 7 : Validation of the Lab
1. Once The Lab Steps Are Completed, Please Click On The **Validation** Button On The Left Side Panel.
2. This Will Validate The Resources In The AWS Account And Displays Whether You Have Completed This Lab Successfully Or Not.
3. Sample Output :
**Do you know?**
AWS Config can be used to audit resources for compliance with a variety of standards, including CIS AWS Foundations Benchmark and HIPAA.
### Completion and conclusion
1. You have successfully created the Config rule along with the SNS topic.
2. Modified the security group by adding custom port to get the alert from AWS regarding change in config rule.
3. Successfully tested the working of config rule.
4. Revert back the changes by removing the ports added to make the rule complaint.
5. Successfully received the email from AWS stating the AWS config rules with non compliant. resources.
### End lab
1. Sign out from the AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps click on **End lab** in the IP Lab Portal
## What gets checked
When you press **Check my work**, the platform verifies each of these:
* **Create Private S3 bucket** โ Check whether a private S3 bucket is created or not
* **Create an Amazon SNS Topic** โ Check If SNS Topic created or not
* **AWS config rule** โ check whether AWS config rule is created or not
## Related help
* [FAQs and Troubleshooting](/aws-cp/support/faqs-and-troubleshooting)