IAM / management / config

AWS Config (IAM)

JSON →

AWSconfigmanagement

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources.

iamaws

docs ↗

Permissions

Actions in this service

config:DescribeConfigRules

config:ListDiscoveredResources

config:GetResourceConfigHistory

config:PutEvaluations

config:StartConfigRulesEvaluation

config:DescribeConformancePacks

config:ListStoredQueries

config:GetStoredQuery

Policy

Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "config:DescribeConfigRules", "config:ListDiscoveredResources", "config:GetResourceConfigHistory", "config:PutEvaluations", "config:StartConfigRulesEvaluation", "config:DescribeConformancePacks", "config:ListStoredQueries", "config:GetStoredQuery" ], "Resource": "*" } ] }

SDK mapping

Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns

Known gotchas

Avoid config:* — grants full control including rule deletion and configuration recorder changes

Avoid config:DeleteConfigRule and config:DeleteConfigurationRecorder — can break compliance monitoring

Resources

docshttps://servicereference.us-east-1.amazonaws.com/v1/config/config.json ↗