Amazon Config Monitoring in ObserveOps
Overview
The Amazon Config integration with ObserveOps (formerly known as AIOps) collects configuration recorder state, delivery channel health, and compliance telemetry from AWS Config. It monitors recorder activity, delivery snapshot and history states, compliance rule evaluations, and conformance pack scores across your AWS accounts.
These metrics help compliance and cloud governance teams verify that configuration recording is active, detect delivery failures, track non-compliant resources, and measure overall compliance posture across Config rules and conformance packs.
Prerequisites
- AWS Config is enabled in the target AWS account and region with at least one configuration recorder and delivery channel configured.
- The IAM role or user used for integration has read access to Config resources (
config:DescribeConfigurationRecorders, config:DescribeConfigurationRecorderStatus, config:DescribeDeliveryChannels, config:DescribeDeliveryChannelStatus, config:DescribeConfigRules, config:DescribeConformancePacks). - Required Config API endpoints are reachable from ObserveOps.
- The AWS account is added in discovery with correct credentials and region configuration.
List of Supported KPIs
Recording
| Metric | Description | Type |
|---|
| aws.config.recording.active | Indicates whether the configuration recorder is currently active. | Boolean |
| aws.config.recording.state | Current state of the configuration recorder. | String |
| aws.config.recording.error.code | Error code of the most recent recording failure. | String |
| aws.config.recording.resources | Number of resource types currently being recorded. | Count |
| aws.config.retention.days | Number of days configuration history is retained. | Count |
| aws.config.recording.per.sec | Rate of configuration change recordings per second. | Count |
| aws.config.recording.permission.failures | Number of recording failures due to insufficient IAM permissions. | Count |
| aws.config.compliance.rules | Total number of Config rules in the account. | Count |
Delivery Channel
| Metric | Description | Type |
|---|
| aws.config.channel.snapshot.state | State of the last configuration snapshot delivery. | String |
| aws.config.channel.snapshot.error.code | Error code of the last configuration snapshot delivery failure. | String |
| aws.config.channel.snapshot.age.seconds | Age of the last successfully delivered configuration snapshot in seconds. | Seconds |
| aws.config.channel.history.state | State of the last configuration history delivery. | String |
| aws.config.channel.history.error.code | Error code of the last configuration history delivery failure. | String |
| aws.config.channel.stream.state | State of the configuration stream delivery to S3. | String |
| aws.config.channel.stream.error.code | Error code of the last configuration stream delivery failure. | String |
Compliance
| Metric | Description | Type |
|---|
| aws.config.rules.compliant | Number of Config rules currently in compliant state. | Count |
| aws.config.rules.noncompliant | Number of Config rules currently in non-compliant state. | Count |
| aws.config.compliance.packs | Total number of conformance packs in the account. | Count |
| aws.config.rule | Identifier of an individual Config rule. | String |
| aws.config.rule.state | Current state of the Config rule. | String |
Rules Detail
| Metric | Description | Type |
|---|
| aws.config.rule.evaluation.age.seconds | Time since the last successful rule evaluation in seconds. | Seconds |
| aws.config.rule.evaluation.error.code | Error code of the last rule evaluation failure. | String |
| aws.config.rule.compliance.state | Compliance state of the Config rule. | String |
| aws.config.rule.noncompliant.resources | Number of resources evaluated as non-compliant by the rule. | Count |
| aws.config.rule.noncompliant.cap.exceeded | Indicates whether the non-compliant resource count cap was exceeded. | Boolean |
| aws.config.rule.remediation.state | State of the auto-remediation configuration for the rule. | String |
| aws.config.pack | Identifier of an individual conformance pack. | String |
| aws.config.pack.state | Current deployment state of the conformance pack. | String |
| Metric | Description | Type |
|---|
| aws.config.pack.state.reason | Reason for the current conformance pack state. | String |
| aws.config.pack.compliance.state | Overall compliance state of the conformance pack. | String |
| aws.config.pack.compliant.rules | Number of rules within the pack that are compliant. | Count |
| aws.config.pack.noncompliant.rules | Number of rules within the pack that are non-compliant. | Count |
| aws.config.pack.compliance.score.percent | Compliance score of the conformance pack as a percentage. | Percent |