AWS Config records and evaluates the configuration of your AWS resources over time. It answers “what does this resource look like, what did it look like last week, and does it follow our rules?”
Config vs CloudTrail
Easy to confuse. CloudTrail logs who did what (API actions). Config tracks how resources are configured and whether they comply with rules over time. Compliance and configuration history → Config; action auditing → CloudTrail.
Test yourself
A compliance team needs to continuously check that all S3 buckets have encryption enabled and see the configuration history of each resource. Which service?
- AWS CloudTrail
- AWS Config
- Amazon CloudWatch
- AWS Trusted Advisor
👉 Click to reveal the answer & explanation
Correct answer: B. AWS Config records resource configurations over time and evaluates them against compliance rules (like “S3 must be encrypted”). CloudTrail (A) logs API activity; CloudWatch (C) monitors performance; Trusted Advisor (D) gives best-practice checks, not per-resource config history.
Related topics
AWS CloudTrail · AWS Trusted Advisor · AWS Organizations
Ready to pass your AWS exam?
Stop guessing whether you’re ready. Our full-length, exam-realistic practice exams put you through the exact question style you’ll face — with a detailed explanation behind every answer, so you learn why, not just what.
- ✓ 6 full-length practice exams
- ✓ A detailed explanation for every single question
- ✓ Realistic, scenario-based questions — not memory dumps
- ✓ Lifetime access, kept current for 2026