Flash card
AWS Config conformance packs: collections of Config rules and remediation actions packaged and deployed together.
- A pack is a YAML template of Config rules plus optional remediation actions, deployed as a single immutable unit.
- Deployable across an entire organisation from the management or a delegated administrator account.
- AWS publishes sample packs mapped to common frameworks, so a compliance baseline is often configuration rather than authoring.
- Compliance is reported per pack and per rule, giving one score per account rather than a scatter of individual rule results.
- Remediation runs through Systems Manager Automation documents, which is how a non-compliant resource gets fixed rather than just flagged.
Pick it when
Pick it over individual Config rules when a whole baseline has to land on many accounts and be reported as a unit. Pick Config generally over drift detection when the question is continuous evaluation against rules, rather than whether one stack matches its template.
It's the wrong answer when
It is the wrong answer for prevention. Config evaluates resources after they exist and can remediate afterwards; stopping the non-compliant resource from being created is an SCP, a permission boundary, or a CloudFormation hook. A scenario insisting nothing non-compliant may ever be created is not asking about Config.