How to Use AWS Config to Detect Non-Compliant Security Group Rules
Someone on your team opens port 22 to 0.0.0.0/0 on a production security group — maybe for a quick debug session, maybe by accident. Without automated detection, that change sits unnoticed until your next manual audit or, worse, until something goes wrong. AWS Config gives you a managed rule that flags this exact pattern and, wired to SNS, can alert your team within minutes of the change landing. TL;DR: AWS Config SSH Compliance Detection Step What You're Doing Why It Matters 1 Enable AWS Config with EC2 recording Config can't evaluate what it doesn't record 2 Deploy restricted-ssh managed rule AWS-managed logic, no Lambda required 3 Create SNS topic + subscription Humans need to know when compliance breaks 4 Wire EventBridge rule to SNS Config compliance change events route through EventBridge 5 Verify end-to-end with a test SG Confirm the pipeline before you trust it in production ...