Continuous Compliance on AWS: Best Practices That Hold Up

Why compliance has to be continuous

On AWS, infrastructure changes all the time. A security group opened for a test, an S3 bucket policy edited in a hurry or a new account created without logging can break a control minutes after an audit passed. Continuous compliance means checking configuration as it changes, not once a year, and fixing drift quickly.

It also starts with the shared responsibility model: AWS is responsible for security of the cloud, and you are responsible for security in the cloud, including how you configure services, identities and networks. Everything below is about the customer side.

The loop has four parts: record what exists and what changed, evaluate it against rules, alert the right people, and remediate, automatically where it is safe.

Record: AWS Config first

AWS Config keeps an inventory of your resources and a history of their configuration. Nothing else in this post works well without it, and AWS Security Hub CSPM requires it.

Practical points:

• Turn on the configuration recorder in every account and every Region you use, not just your main Region. Rules cannot evaluate resources that are not recorded.
• Decide what to record. Recording all supported resource types gives the fullest picture; you can exclude high-churn types you do not need and choose daily rather than continuous recording for some types to control cost.
• Deliver configuration snapshots and history to a central S3 bucket in a log archive account.

In a multi-account setup, AWS Control Tower or your own automation (for example AWS CloudFormation StackSets) should enable the recorder for every new account automatically.

Evaluate: Config rules and conformance packs

AWS Config rules evaluate recorded resources and mark them compliant or noncompliant. They run when a relevant configuration changes, on a schedule, or both. AWS provides hundreds of managed rules, such as s3-bucket-public-read-prohibited, cloudtrail-enabled, encrypted-volumes and vpc-flow-logs-enabled, and you can write custom rules with AWS Lambda or AWS CloudFormation Guard.

Rather than managing rules one by one, group them in conformance packs: a YAML template of rules and remediation actions that you deploy as one unit to an account and Region, or across an AWS Organizations organization. AWS publishes sample packs mapped to common frameworks that you can start from. A minimal pack looks like this:

Resources:
  S3BucketPublicReadProhibited:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: s3-bucket-public-read-prohibited
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED

To see results across accounts, create an aggregator in a central security account. An aggregator collects configuration and compliance data from many accounts and Regions into one view. It is read-only: it shows results but does not deploy rules, so pair it with organization conformance packs.

Evaluate: Security Hub CSPM standards

AWS Security Hub CSPM runs security checks, called controls, grouped into standards. They include:

• AWS Foundational Security Best Practices
• CIS AWS Foundations Benchmark
• NIST SP 800-53 Revision 5 and NIST SP 800-171 Revision 2
• PCI DSS
• AWS Resource Tagging

Most controls run on service-linked AWS Config rules, which is why the recorder must be on. Security Hub CSPM also collects findings from services such as Amazon GuardDuty, Amazon Inspector and Amazon Macie. If you enable more than one standard, turn on consolidated control findings so each control produces one finding rather than one per standard.

AWS is clear that these standards do not guarantee compliance with any regulation or audit. They are a way to measure and monitor your configuration against a framework. The newer AWS Security Hub builds on Security Hub CSPM by correlating signals into exposure findings, and AWS recommends using both.

Use AWS Organizations integration with a delegated administrator account, enable automatically for new accounts, and use cross-Region aggregation so one Region shows findings from all of them.

Record activity: AWS CloudTrail

Config records what a resource looks like. AWS CloudTrail records who did what, through API calls in the console, CLI, SDKs and AWS services. For compliance:

• Create an organization trail so every account, including new ones, logs to one place.
• Send it to an S3 bucket in a separate log archive account with restricted access, and turn on log file integrity validation.
• Encrypt the logs with an AWS KMS key and set S3 lifecycle and retention rules that match your requirements.
• Add data events, such as S3 object-level access, only where you need them, because they are billed separately.

Record traffic: VPC Flow Logs

VPC Flow Logs capture information about IP traffic going to and from network interfaces in your VPC. They record metadata, not packet contents: fields such as source and destination address and port, protocol, packet and byte counts, start and end time, and whether security groups and network ACLs accepted or rejected the traffic. If you need payload inspection, that is a job for Traffic Mirroring or AWS Network Firewall, not Flow Logs.

Enable Flow Logs at the VPC level in every VPC, publish them to Amazon S3 or Amazon CloudWatch Logs, and use the vpc-flow-logs-enabled Config rule to catch VPCs that are missing them.

Remediate: Systems Manager Automation

A finding nobody acts on is just noise. AWS Config can remediate noncompliant resources by running AWS Systems Manager Automation runbooks, either AWS-owned ones or your own. For example, AWS-DisableS3BucketPublicReadWrite uses S3 Block Public Access to remove public access from a bucket.

You can attach remediation as:

• Manual: someone reviews the finding and starts the runbook from the console.
• Automatic: Config runs the runbook when a resource becomes noncompliant, with settings for retries.

Start with manual remediation, watch what it would change, and switch to automatic only for fixes that cannot break a workload, such as turning on encryption by default or blocking public access on buckets that should never be public. For Security Hub CSPM findings, an Amazon EventBridge rule can trigger the same runbooks or a ticket.

Prevent: guardrails before resources exist

Detection is the safety net. Preventive controls stop the problem in the first place:

• Service control policies in AWS Organizations, for example to block disabling CloudTrail or leaving approved Regions.
• S3 Block Public Access at the account level.
• Infrastructure as code with policy checks in the pipeline, so noncompliant changes fail before deployment.

A short checklist

1. Config recorder on in every account and Region, delivered to a log archive account.
2. Organization conformance packs and an aggregator in a security account.
3. Security Hub CSPM with the standards that match your obligations, organization-wide.
4. An organization CloudTrail trail with integrity validation.
5. VPC Flow Logs in every VPC.
6. Remediation runbooks, manual first, automatic where safe.
7. Preventive guardrails with service control policies.

9Acts is an AWS Advanced Tier Services Partner and AWS MSP Partner with the AWS Level 1 MSSP Competency. If you want help putting continuous compliance in place across your accounts, see our security and compliance services.