AWS Config for SOC 2: CC7.1 Configuration Drift Detection
How AWS Config satisfies SOC 2 CC7.1 monitoring requirements, which Config rules matter most, and how to generate auditor-ready compliance evidence.
AWS Config and SOC 2 CC7.1
SOC 2 CC7.1 requires organizations to "use defined configuration standards, monitor implemented systems and infrastructure for deviations from those standards, and correct identified deviations." AWS Config is the primary AWS service for satisfying this control.
AWS Config continuously records your AWS resource configurations and evaluates them against Config Rules you define. When a resource drifts from its expected configuration — an S3 bucket's block public access setting changed, an EC2 security group rule was modified — Config detects the change, timestamps it, and evaluates it against your rules.
What AWS Config Actually Does
AWS Config operates at two levels:
Configuration Recording: Config records every configuration change to your AWS resources and creates a timeline. You can see that at 2:34 PM on March 15th, the security group sg-0a1b2c3d had an inbound rule allowing 0.0.0.0/0 on port 22 added. And at 2:52 PM, it was removed. This timeline is audit gold.
Compliance Evaluation: Config evaluates resources against rules (managed rules from AWS or custom Lambda-backed rules). A rule might check "all S3 buckets must have server-side encryption enabled." Any bucket without encryption is marked NON_COMPLIANT.
The Config Rules That Matter Most for SOC 2
AWS provides 150+ managed Config rules. For SOC 2 Security TSC, prioritize:
Access Control (CC6.1):
iam-root-access-key-check— No active access keys for the root accountiam-user-mfa-enabled— MFA enabled for all IAM usersaccess-keys-rotated— Access keys rotated within 90 daysiam-password-policy— Password policy meets minimum requirements
restricted-ssh— Security groups do not allow unrestricted SSH (port 22) inboundrestricted-common-ports— No unrestricted inbound on common administrative portsvpc-flow-logs-enabled— VPC flow logs enabled for all VPCs
s3-bucket-server-side-encryption-enabledrds-storage-encryptedkms-cmk-not-scheduled-for-deletion
cloud-trail-enabled— CloudTrail enabled in all regionscloudtrail-log-file-validation-enabledguardduty-enabled-centralized
What SecureSpect Checks
SecureSpect runs two AWS Config checks that directly map to CC7.1:
aws.config.recorder_enabled — CC7.1
Verifies the AWS Config recorder is enabled and recording all resource types.
aws.config.rules_compliance — CC7.1
Checks that no Config rules have NON_COMPLIANT resources.
A common finding: Config recorder is enabled but not recording all resource types. This creates blind spots in your configuration history.
Setting Up AWS Config for SOC 2
Enable Config in every region where you have resources:
# Create an S3 bucket for Config delivery
aws s3 mb s3://your-company-config-bucket --region us-east-1
# Enable Config recorder in a region
aws configservice put-configuration-recorder --configuration-recorder name=default,roleARN=arn:aws:iam::123456789:role/config-role --recording-group allSupported=true,includeGlobalResourceTypes=true
# Set delivery channel
aws configservice put-delivery-channel --delivery-channel name=default,s3BucketName=your-company-config-bucket,configSnapshotDeliveryProperties={deliveryFrequency=Daily}
# Start recording
aws configservice start-configuration-recorder --configuration-recorder-name default
For multi-account environments, use AWS Config aggregator to centralize compliance data across accounts.
Using Config Data as Audit Evidence
AWS Config produces three types of evidence useful for SOC 2 auditors:
1. Configuration snapshots: A point-in-time record of all resource configurations. Deliver these daily to S3 for auditor review.
2. Configuration history: The complete timeline of changes to a resource. Auditors use this to verify that controls were in place throughout the audit period, not just at evaluation time.
3. Compliance reports: Aggregated pass/fail status for all Config rules. Export these monthly and retain them as evidence of ongoing monitoring.
SecureSpect exports AWS Config compliance status as timestamped evidence, linking each check to its SOC 2 control code for auditor review.
FAQ
Is AWS Config required for SOC 2? Not required, but strongly recommended for CC7.1. Without Config, demonstrating continuous configuration monitoring requires manual attestation — which auditors scrutinize heavily.
What does AWS Config cost? Pricing is per configuration item recorded. A typical startup account runs $50–$200/month. Well worth it for the audit evidence it generates.
Can AWS Security Hub replace Config? Security Hub aggregates Config findings but doesn't provide the configuration history that Config does. Use both.
