c4.15 Automate correction of configuration drift

Detect and correct with AWS Config

AWS Config auto-remediation runs an AWS Systems Manager Automation runbook to return a non-compliant resource to its desired state, enforcing your security baseline continuously.

Prevent vs. detect-and-correct

Why not just prevent drift with SCPs and IAM policies? Prevention is ideal — the misconfiguration never exists — and you should use guardrails for your hard invariants. But detect-and-correct is a useful complement:

• Better builder experience — instead of an opaque "access denied", you can let the change happen, revert it, and notify the owner (via tags) with an explanation.
• Covers pre-existing drift — policies do not fix misconfigurations that predate them; Config remediation does.
• Catches privileged bypass — if someone who can bypass a policy misconfigures a resource, Config still corrects it.
• Supports softer responses — for example open a ticket on drift and auto-close it when resolved, rather than hard-blocking.