Skip to main content

AWS Config

AWS Config is the recording foundation that Security Hub CSPM standards depend on. Prism provisions and manages AWS Config recorders in every enrolled account and region so that compliance standards can evaluate your resources, without requiring account-by-account setup in the AWS Console.

Why AWS Config Is Required​

Security Hub standards evaluate your resources by reading configuration snapshots produced by AWS Config. Without a running recorder in a given account and region, controls in that cell cannot assess your resources and will report NO_DATA instead of a pass or fail result. This means a compliance score of 0 % is expected for any cell that has never had a recorder.

info

Missing AWS Config never blocks the CSPM or GuardDuty engine from being enabled. It only prevents Security Hub standards from producing useful results in unrecorded account/region pairs. A warning banner on the Compliance Dashboard surfaces any cells that are enrolled but not yet recording.

The Foundational Summary Card​

On the Security Hub Overview page, the Foundational section shows an AWS Config (recording) card at all times, regardless of which engines are enabled. The card displays a X / Y cells recording count, where X is the number of account/region pairs currently recording and Y is the total number of enrolled pairs. A Manage button on the card navigates directly to the Config Recorders page.

Before any recorders are set up, the card reads 0 / 0 cells recording. That is the expected starting state and simply means no recorders have been provisioned yet.

What Prism Manages​

When you enable AWS Config through Prism, it provisions the following resources in each selected account and region:

ResourceIdentifier
Config recorderCKPrism-Config-Recorder
S3 delivery bucketckprism-awsconfig-{accountId}
Delivery channelPoints the recorder to the per-account S3 bucket

Prism creates the S3 bucket in the account where the recorder is provisioned, so log data stays within each account's boundary.

Recording Scope: Minimal vs Record All​

When you enable a recorder through Prism, you choose between two recording scopes:

ScopeWhat is recordedCost implication
MinimalOnly the resource types your currently enabled standards need to evaluateLower: you pay per configuration item recorded, so minimal scope avoids charges for resource types no standard uses
Record allEvery supported resource type in the regionHigher: more resource types means more configuration items and more S3 data
tip

Start with Minimal scope. Prism maps each enabled standard's controls to the resource types they need, so minimal scope is sufficient for full standards evaluation in most cases.

If your enabled standards include controls that require resource types not covered by the minimal mapping, the recorder cell on the Config Recorders grid shows a ! warning badge. Switching that cell to Record all resolves the gap.

The Inline Config Dialog​

Prism surfaces a one-click AWS Config setup dialog at key points in the workflow so you do not have to navigate to the AWS Config page separately. The dialog appears when:

  • You complete the CSPM setup wizard and some enrolled account/region pairs lack a running recorder
  • You save a standards or regions change from CSPM Settings and cells become unrecorded as a result
  • You click Enable AWS Config from the Compliance Dashboard warning banner or the CSPM Enrollment page banner

The dialog lists each affected account/region pair and offers two actions:

Enable mode: when one or more cells are missing a recorder:

  • Confirm the listed cells and click Enable AWS Config to start minimal-scope recording across all of them
  • After you confirm, recording begins asynchronously; a success message tells you to track progress on the AWS Config page
  • Click Open AWS Config page to jump directly to the Config Recorders grid, or Later to dismiss and handle it manually

Disable mode: when previously recorded cells are no longer needed by any enabled standard (for example, after removing a region):

  • The dialog lists the cells that are now unused and offers to stop recording to avoid ongoing AWS Config charges
  • The recorder itself is kept in place; you can delete it later from the Config Recorders page
  • Click Stop recording to disable the listed recorders, or Later to leave them running

The AWS Config section contains two pages, each accessible from the Security Hub sidebar:

PageDescription
Config RecordersAccount x region grid for enabling, disabling, deleting, and refreshing recorders
Config RulesSnapshot of the AWS Config rules active in a selected account and region