Skip to main content

Config Rules

The Config Rules page shows the AWS Config rules that were active in a selected account and region at the time of the last Refresh. This is a read-only snapshot; it is not a live query against AWS.

Accessing Config Rules​

Open the Security Hub from the application selection screen, then click AWS Config in the sidebar. Select Config Rules from the sub-navigation.

Selecting an Account and Region​

Before rules are shown, you must choose which account and region to inspect:

  1. Select an Account from the first dropdown. Only accounts that have a running or in-progress AWS Config recorder appear in this list (status enabled, external, or enabling). Accounts without a recorder are excluded.
  2. Select a Region from the second dropdown. The region list is filtered to the regions where the selected account has a recorder. The dropdown is disabled until an account is selected.
  3. Click Load rules to fetch the rule snapshot for the selected account and region.
info

If the Account dropdown is empty, no accounts have AWS Config recording set up yet. Go to Config Recorders and enable recording in at least one account/region pair, then run a Refresh before returning to this page.

Rules Table​

After clicking Load rules, the table displays each Config rule captured during the last refresh:

ColumnDescription
Rule nameThe name of the AWS Config rule in that account and region
SourceThe source identifier, typically the AWS managed rule name (for example, EC2_INSTANCE_NO_PUBLIC_IP)
StateThe rule's state at the time of the last refresh: ACTIVE (green chip) means the rule was evaluating resources; any other state is shown with a grey chip

Empty State​

If the table shows No Config rules captured yet, it means either:

  • A Refresh has never been run after the recorder was enabled, or
  • The last Refresh completed before this account/region pair had any rules deployed

In both cases, click Refresh on the Config Recorders page to update the snapshot, then return here and reload.

info

Config rules are served from Prism's last recorded snapshot, not from a live AWS API call. The snapshot is updated each time you run a Refresh from the Config Recorders page. Rules added or removed in AWS after the last Refresh do not appear until the next Refresh completes.

  • Config Recorders, Enable recorders and run a Refresh to populate this snapshot
  • AWS Config, AWS Config overview and recording scope