c2.4 Inventory assets and monitor configuration changes
Keep at least a high-level inventory of what runs in each account, and track configuration changes with AWS Config so drift from your security baseline is detected and remediated.
Implementation guidance
Know what you run
Maintain an asset inventory — which applications live in each account, the business process they support, the resource types they should use, and the security configurations they must enforce. An inventory makes controls easier to apply and helps you spot rogue resources created by an adversary.
Track drift with AWS Config
AWS Config records configuration changes across your resources and lets you detect, notify on, and remediate non-compliant configurations — for example flagging SSH or RDP ports open to the internet. Remediation can run automatically through AWS Systems Manager Automation runbooks to correct or roll back a resource.
Config underpins other services
AWS Security Hub CSPM security standards depend on AWS Config being enabled — Config must record the resources a control checks, in each Region, for findings to be accurate. AWS Firewall Manager also requires Config. If you use AWS Control Tower, Config is turned on automatically in enrolled accounts.
How to validate
- Do you have an asset inventory (ideally with criticality, related business process, and account)?
- Is AWS Config enabled across the organization (it is enabled automatically if you use Control Tower)?
- Is the team trained to use AWS Config to see what changed and when — important for incident response?
Threats addressed
- Without an inventory it is harder to apply controls consistently and to spot rogue resources an adversary created.
- Untracked configuration drift lets a resource silently fall out of your security baseline.
AWS services
AWS Config 
AWS Systems Manager 
AWS Security Hub Pricing
AWS Config bills per configuration item recorded and per rule evaluation. See AWS Config pricing.