Tools/AWS_Config
AWS Config
Tracks resource configuration changes and evaluates them against compliance rules (managed or custom Config Rules) — drift detection and audit trail, not content inspection. Complements Amazon_GuardDuty (behavior/threat detection) and Amazon_Macie (data content) as the "is this resource configured correctly" layer. Closest open-source equivalent is Cloud_Custodian — policy-as-code across AWS/Azure/GCP instead of AWS-only managed rules.