AWS Certified Cloud Practitioner (CLF-C02)Security and ComplianceHard
A company manages 15 AWS accounts through AWS Organizations and wants a compliance analyst to view AWS Config compliance data from all accounts and Regions in a single consolidated dashboard, without switching between accounts. Which AWS Config feature should the company use?
- AConfig Conformance Pack
- BConfig Recorder
- CConfig Rules
- DConfig Aggregator
Show answer & explanationAnswer & explanation
Correct answer: D. Config Aggregator
An AWS Config aggregator collects configuration and compliance data from multiple accounts and Regions into a single account, providing a unified view. Config Rules evaluate compliance within a single account, Conformance Packs bundle rules for deployment, and the Config Recorder tracks configuration changes within one account but does not aggregate across accounts.
Why the other options are wrong
- A. Conformance packs bundle rules and remediation but don't aggregate multi-account views.
- B. The Config Recorder tracks changes in a single account, not across an organization.
- C. Config Rules define compliance checks but operate per account, not across accounts.
AWS Config Aggregator
A Config feature that collects configuration and compliance data from multiple AWS accounts and Regions into a single aggregator account for centralized visibility.
- Supports both individual account aggregation and AWS Organizations-wide aggregation
- Provides a single pane of glass for multi-account compliance review
- Does not replace Config Rules; it aggregates their results
Memory trick: An aggregator gathers every account's Config report into one binder.