AWS Config provides configuration, compliance, and auditing features required for governing resources and providing security posture assessment at scale. This service lets you create managed rules, which are predefined, customizable rules that AWS Config uses to evaluate whether AWS resources comply with common best practices.
An AWS Config conformance pack is a collection of AWS Config rules and remediation actions defined as YAML templates. Conformance Packs can be easily deployed as a single entity in an account and a Region or across an organization within AWS Organizations. AWS provides sample Conformance Pack templates for various compliance standards and industry benchmarks. You can download every conformance pack template from GitHub.
Terraform is an open-source, infrastructure as code software tool, similar to AWS CloudFormation, the AWS native IaC solution. Infrastructure as code is the process of provisioning and managing your cloud resources by writing a template file that is both human readable and machine consumable.
In February 2021, HashiCorp Terraform announced support for AWS Config Conformance pack as part of its AWS provider version 3.28.0. If you plan to use Terraform to manage your AWS environment, this approach demonstrates how to deploy AWS Config and Conformance packs by using Terraform.
Prerequisites and Initial Setup
To complete the steps, you will need the following:
- An AWS account with permissions to AWS Config, Amazon S3, and CloudFormation. Make sure to check the prerequisites for using AWS Config.
- Download and set up Terraform.
- Make sure you have installed the AWS Command Line Interface and configured access to the AWS account you would like to deploy to. You can also utilize AWS CloudShell and deploy the solution.
Ensure that your AWS CLI is configured in your terminal. You will need to input your AWS Access Key ID and Secret Access Key.
aws configure
Next, write your Terraform configuration. The configuration is a set of files that describe infrastructure in Terraform:
mkdir learn-terraform-conformance-packs
Change into this directory:
cd learn-terraform-conformance-packs
You will now create a file entitled main.tf to define your infrastructure:
touch main.tf
Open main.tf in your text editor, paste in the following Terraform configuration file, and save the file.
Terraform configuration to enable AWS Config and deploy a conformance pack is used when AWS Config is not yet enabled. If you have already enabled Config, use the Terraform Configuration to just deploy the conformance pack.
For credential setup for Terraform with AWS:
- Log in to your AWS Management Console.
- Go to Identity and Access Management.
- Create a new IAM user with programmatic access, which will give you an access key ID and a secret access key.
Pro Tip: Store your credentials securely
Terraform with AWS Foundations
Managing infrastructure can get complex, especially as your cloud footprint grows. Terraform, an open-source Infrastructure as Code tool, makes it simpler by automating the deployment and management of your infrastructure on AWS.
Terraform's integration with AWS provides a powerful, scalable solution for managing infrastructure.
Key benefits:
- Automation and Efficiency: By automating infrastructure provisioning, Terraform reduces manual work and errors.
- Scalability: Scaling your infrastructure up or down based on demand is straightforward.
- Version Control: Using IaC, you can track changes and revert to previous states if necessary.
To get started, you'll need to set up credentials so Terraform can access your AWS account to create, update, and delete resources.
Remote state storage is a best practice. Add this configuration to your project:
terraform {
backend "s3" {
bucket = "my-terraform-state-bucket"
key = "state"
region = "us-east-1"
}
}
With the S3 backend, any changes to the infrastructure state will be saved and versioned automatically in the bucket.
It is important not to hardcode sensitive data like database passwords or API keys into your Terraform files. AWS Secrets Manager can help here by securely storing secrets.
Here is how you can retrieve secrets from AWS Secrets Manager in your Terraform configuration:
```
data "awssecretsmanagersecretversion" "mysecret" {
secretid = "mysecretname"
}
resource "awsdbinstance" "mydatabase" {
other configuration...
password = data.awssecretsmanagersecretversion.mysecret.secret_string
}
```
In this example, Terraform retrieves the database password from Secrets Manager, keeping your sensitive data secure and out of the configuration files.
Setting up Terraform with AWS provides a powerful framework for efficiently managing cloud infrastructure as code. By following these practices, like using IAM roles for access, remote state storage, and securely managing sensitive data, you'll establish a robust, scalable, and secure foundation for your infrastructure management.
Deploying AWS Config Conformance Packs
The blog will work with the Conformance pack around Operational Best Practices for Amazon Simple Storage Service. Note that you can utilize this mechanism for other sample conformance packs or for your own.
As shown in the architecture, you use a Terraform configuration to create a Conformance pack in your AWS account. This Conformance pack will deploy rules around operational best practices for Amazon S3.
In this conformance pack, you are creating six immutable Config rules that help optimize your S3 buckets.
The first method assumes you are using AWS Config for the first time and have not yet enabled it in your AWS account. In the Terraform script, you will enable Config and deploy the Conformance pack.
In the second method, we assume you have already enabled Config, and show you how to use Terraform to deploy the Conformance Pack. In both methods, follow the same instructions until it is time to update your Terraform script, or the main.tf file.
Walkthrough highlights two different methods you can follow to set up Conformance Packs with Operational Best Practices for S3. The first method assumes you are using AWS Config for the first time and have not yet enabled it in your AWS account.
AWS Organizations Scale with Terraform
AWS Organizations, AWS Config, and Terraform can be used to deploy guardrails at scale.
AWS Config provides configuration, compliance, and auditing features that are required for governing your resources and providing security posture assessment at scale. With its recent support for AWS Organizations, AWS Config makes it possible for you to manage your organization centrally, with rules deployed either with AWS CloudFormation or Terraform.
Terraform is an IaC solution that operates in a way similar to AWS CloudFormation, the AWS native IaC solution. If you plan to use Terraform to manage your AWS environment, this post shows how to deploy controls. AWS CloudFormation also providers resources and properties for deploying organization AWS Config rules.
When the solution is deployed, Terraform creates the following infrastructure:
In this solution, AWS Config and the configuration recorder and delivery channel must be run in the delegated administrator and member accounts. The administrator account aggregates its findings through AWS Organizations. In the secondary/member accounts, Config is collecting data on resources in the environment, and making a determination of compliant or non-compliant based on the AWS Config rules.
Module Outputs and Related Projects
The terraform-aws-config module exposes outputs for integration.
| Output | Description |
|---|---|
| sns_topic | SNS topic |
| snstopicsubscriptions | SNS topic subscriptions |
| storagebucketarn | Bucket ARN |
| storagebucketid | Bucket Name aka ID |
Related projects to consider:
- terraform-null-label - Terraform module designed to generate consistent names and tags for resources. Use terraform-null-label to implement a strict naming convention.
- terraform-aws-config-storage - Terraform module that creates an S3 bucket suitable for storing AWS Config data.
- terraform-aws-guardduty - Terraform module that enables and configures AWS GuardDuty.
- terraform-aws-security-hub - Terraform module that enables and configures AWS Security Hub.
For additional context, refer to some of these links.
List of AWS Config Managed Rules is a list of rules AWS Config currently supports in the analytics; compute; cryptography and PKI; database; machine learning; management and governance; migration and transfer; network and content delivery; security; identity and compliance; and storage categories.
Tip
Use Cloud Posse's ready-to-go terraform architecture blueprints for AWS to get up and running quickly.
Conclusion
Deploying AWS Config Conformance Packs with Terraform unifies policy as code with continuous compliance. The February 2021 addition of AWS Config Conformance pack support to the AWS provider version 3.28.0 made it practical to codify operational best practices for S3 and other services directly in Terraform.
The two-path approach covered here allows teams to either bootstrap AWS Config for the first time alongside a conformance pack, or to target an account where Config is already enabled and only add the conformance pack rules. Both paths share the same foundational steps of AWS CLI configuration, project scaffolding with main.tf, and provider configuration.
Pairing this with Terraform best practices from the AWS integration guide, such as remote state storage via S3 backend and secret handling through AWS Secrets Manager, creates a durable pipeline for guardrails. At scale, combining AWS Organizations delegation with AWS Config recorders and delivery channels run in administrator and member accounts enables centralized aggregation of findings while keeping data collection distributed.
The Operational Best Practices for S3 conformance pack example, which creates six immutable Config rules to help optimize S3 buckets, demonstrates how a single Terraform apply can instantiate a complete compliance baseline. The same pattern extends to other AWS provided conformance packs or custom YAML templates downloaded from GitHub.
Using modules like terraform-aws-config, terraform-aws-config-storage, and related security modules, teams can standardize naming, storage, and notification via SNS topics and subscriptions, and maintain versioned state.