AWS Config

AWS Config is a continuous monitoring service that records the configuration history of AWS resources and evaluates those configurations against rules you define. When a resource drifts out of compliance — say, an Amazon SageMaker notebook instance loses encryption at rest — Config flags it and can trigger automated remediation via AWS Systems Manager Automation. The exam distinguishes Config from AWS CloudTrail carefully: CloudTrail captures who did what (API calls and user activity), while Config captures what the resource looks like at any point in time. For AI workloads, Config commonly checks that Bedrock or SageMaker resources stay compliant with data-governance baselines.