Take 800 network interfaces that each write 10 configuration items a day. Recording them continuously in us-east-1 costs $720 a month. Recording that one type daily costs at most $288.
AWS Config pricing looks like three per-unit rates, but the bill follows how often resources change, not how many you have. This covers the recording-mode break-even, three worked bills, a diagnosis without Athena, and the IaC fix. Prices are from AWS's US East (N. Virginia) price list, September 2026.
AWS Config pricing: three charges and what triggers them
AWS Config charges for each configuration item (CI) it records, each rule evaluation, and each conformance pack evaluation. A CI is a point-in-time record of one resource's configuration. In us-east-1, a CI costs $0.003 continuous or $0.012 daily. Evaluations start at $0.001 each and get cheaper past 100,000 and 500,000 a month. There's no minimum, commitment or free tier.
| Charge | us-east-1 price | Triggered by |
|---|---|---|
| Continuous CI | $0.003 per CI | Each detected change to a recorded type |
| Daily (periodic) CI | $0.012 per CI | At most one per resource per day, if changed |
| Custom (third-party) CI | $0.003 per CI | A record for a third-party resource |
| Rule evaluation | $0.001 / $0.0008 / $0.0005 | One rule checking one resource |
| Proactive evaluation, detective also on | $0.00 | The same rule in proactive mode |
| Conformance pack evaluation | $0.001 / $0.0008 / $0.0005 | One pack rule checking one resource |
Config bills per Region per account. History files and snapshots cost standard S3 rates for the delivery bucket, SNS notifications bill at standard rates, and custom Lambda rules add Lambda charges for custom rules that managed rules avoid. Prices exclude taxes.
Some parts cost nothing: AWS::Config::ConfigurationRecorder CIs, the create and delete records for excluded types, aggregators, advanced query, and service-linked recorders with INTERNAL scope.
Most commercial Regions list the same rates on the AWS Config pricing page. AWS GovCloud (US) charges $0.0036 per continuous CI and $0.0012 / $0.00096 / $0.0006 per rule evaluation.
What creates a configuration item (and why resource count misleads)
Config writes a CI when it detects a change to a recorded resource type or captures a snapshot, and one change can write several. Indirect relationships each get a CI, so a security group associated with an EC2 instance gives two. AWS notes one instance change can produce 4: security group, subnet, VPC and instance. Direct relationships don't double up.
Rapid successive changes to one resource coalesce into one CI. Change-triggered rules add AWS::Config::ResourceCompliance CIs, the largest source in AWS's example data at 42,784 a day on continuous recording.
Three multipliers catch people out:
- The first month. Bootstrapping evaluates every resource Config records.
- New resource types. All-types recording adds them automatically: 60 in September 2026 alone.
- Global IAM types in several Regions. A new IAM role in an account operating in five Regions writes five CIs.
AWS also names ephemeral workloads (EC2 Spot, Amazon EMR, Auto Scaling) as churn sources.
Continuous or daily recording: the 4-CI break-even
A daily CI costs $0.012 against $0.003 continuous, 4x as much. Daily recording writes at most one CI per changed resource per day, so it only saves money when changed resources average more than 4 CIs per day, the line AWS's analysis of recording frequencies also draws. AWS's pricing example clears it: 100 EC2 instances writing 10 CIs each in 24 hours cost $3.00 continuous, $1.20 daily.
For 1,000 resources of one type on a 30-day month, assuming one CI per change and, from 1 upward, a daily change to every resource:
| CIs per resource per day | Continuous | Daily | Cheaper |
|---|---|---|---|
| 0.1 | $9.00 | $36.00 | Continuous |
| 1 | $90.00 | $360.00 | Continuous |
| 4 | $360.00 | $360.00 | Break-even |
| 10 | $900.00 | $360.00 | Daily, saves $540.00 |
| 50 | $4,500.00 | $360.00 | Daily, saves $4,140.00 |
That's arithmetic on AWS's two rates; related-resource CIs push real counts higher.
Decide per resource type. In AWS's analysis, daily recording cut EC2 instance CIs by 90% but network interfaces by only 34% and volumes by 30%. Those two raised the total bill. A recording mode override sets daily recording for a list of types while the rest stay continuous.
Some types stay continuous regardless. AWS::Config::ResourceCompliance, AWS::Config::ConformancePackCompliance and AWS::Config::ConfigurationRecorder can't go daily. Firewall Manager needs continuous recording for protected resources. A PAID service-linked recorder's continuous setting wins, and each CI bills once however many recorders produce it.
AWS recommends continuous recording for ongoing security monitoring. I'd keep the default continuous and override only types measuring above 4. To price both modes for a resource type, run the AWS Config Pricing Calculator once for each.
How AWS Config rule and conformance pack evaluations add up
One evaluation is one rule checking one resource, so 50 resources attached to a rule is 50 evaluations. Tiers reset monthly: 600,000 detective evaluations in one account and one Region cost $100 + $320 + $50 = $470.
Rules trigger on configuration change, on a schedule, or both. Change-triggered rules run after a CI change notification, scoped by resource type, resource ID, tag, or all recorded resources.
Periodic rules: frequency multiplies evaluations
Periodic rules run every 1, 3, 6, 12 or 24 hours, and each run checks every resource in scope. At 1 hour that's 24 times the evaluations of 24 hours, which is why AWS recommends the 24-hour maximum.
Global IAM types add a trap: a periodic rule reporting on them evaluates in every Region where it's deployed. Deploy it to one.
Proactive evaluations are free when detective mode is on
A rule runs in detective mode (checking deployed resources), proactive mode (checking resources before deployment), or both. Proactive-only rules bill at the normal tiers. A rule that also runs in detective mode gets its proactive evaluations at $0, while its detective ones bill as usual. For 10,000 proactive evaluations a month in one account and Region, that's $10.00 against $0. US East (N. Virginia) and most commercial Regions list the $0 rate.
Conformance packs bill on their own counter
A conformance pack evaluation is one pack rule checking one resource. It shares the rule evaluation tiers under a separate usage type, and AWS's examples start each counter in its own first tier. Pack rules count toward the 1,000 rules per Region per account quota.
Three AWS Config bills, worked from resource counts
Inputs below are illustrative assumptions; rates are us-east-1 on a 30-day month. Swap in measured counts before trusting a total.
Scenario A: one stable account, and what 1-hour rules do to it
Assume 2,000 resources at 0.25 CIs per resource per day, 2 change-triggered rules in scope per CI, and 3 periodic rules covering 400 resources each.
| Line | Quantity | Cost |
|---|---|---|
| CIs (2,000 × 0.25 × 30) | 15,000 | $45.00 |
| Change-triggered evaluations | 30,000 | $30.00 |
| Periodic evaluations at 24 hours | 36,000 | $36.00 |
| Monthly total | $111.00 | |
| All evaluations, periodic at 1 hour | 894,000 | $617.00 |
| Monthly total at 1 hour | $662.00 |
The $617 walks the tiers: $100 + $320 + $197. Frequency moved the bill 6x with no new resources. ResourceCompliance CIs aren't modeled, so measure yours.
Scenario B: high-churn network interfaces and volumes
| Resource type | Continuous | Daily (ceiling) | Override result |
|---|---|---|---|
800 AWS::EC2::NetworkInterface at 10 CIs a day | $720.00 | $288.00 | Saves at least $432.00 |
1,000 AWS::EC2::Volume at 1.5 CIs a day | $135.00 | $360.00 | Up to $225.00 more |
Override the interfaces, not the volumes. AWS's own analysis saw a network interface override raise the bill, so the measured rate decides, not the type's name.
Scenario C: 20 accounts in 3 Regions
Assume self-managed recorders capture global IAM types in all 3 Regions, with 1,000 IAM changes per account per month. Each account and Region runs a 25-rule conformance pack checking 150 resources per rule daily, and 10 rules duplicate Security Hub CSPM controls.
| Line | Before | After |
|---|---|---|
| Global IAM CIs | All 3 Regions: 60,000, $180.00 | Home Region only: 20,000, $60.00 |
| Conformance pack evaluations | 25 rules: 6,750,000, at most $6,750 | 15 rules: 4,050,000, at most $4,050 |
Pack figures use the first-tier rate, so they're ceilings. Security Hub CSPM already runs those checks, so dropping the duplicates cuts pack evaluations 40%.
Run your own numbers with the AWS Config calculator, which this link opens on Scenario A.
Why the bill jumps after Security Hub, Control Tower, or Firewall Manager
Service-linked rules and recorders are ones another AWS service creates and manages for you. Which service switched Config on decides the bill:
- Security Hub CSPM. AWS Config doesn't charge separately for the service-linked rules it enables, but CIs bill at Config pricing. Since June 2, 2026, internal service-linked rules report at no charge from AWS Config. Its enabled controls need their resource types recorded, plus global resources in one Region for full findings, which raises the CI count.
- Service-linked recorders.
INTERNALscope records for free.PAIDscope bills you, and its continuous frequency overrides your daily setting for shared types. - AWS Control Tower. No cost of its own, but Config bills every CI in enrolled accounts. From landing zone 3.0 it records global IAM types in the home Region only.
- AWS Firewall Manager. Its Config rules bill at Config pricing, and it needs continuous recording.
Touch the recorder carefully: changes can leave these services' findings inaccurate, and a replacement recorder role must keep their permissions.
Find what's driving your ConfigurationItemRecorded charge without Athena
You can trace the expensive resource type without writing SQL:
- Find the dimension and Region. In your billing data, look for a usage type ending in
ConfigurationItemRecorded: unprefixed inus-east-1, prefixed elsewhere (EU-for Ireland). Daily CIs end inConfigurationItemRecordedDaily. - Find the resource type. Break down the
ConfigurationItemsRecordedmetric in the CloudWatchAWS/Confignamespace by resource type, as AWS's cost guidance does with a top-10 dashboard. - Get CIs per changed resource per day. Divide the type's daily CIs by how many of its resources changed. Dividing by all recorded resources (advanced query counts them free) understates the rate: above 4 still means go daily, but below 4 doesn't rule it out.
- Check the usual suspects: the first month, newly added types, global IAM types or
AWS::RDS::GlobalClusterin several Regions, frequently deleted evaluation results or re-evaluated rules, and aPAIDservice-linked recorder. - Go deeper only if needed. AWS publishes a CloudFormation template of saved Athena queries over configuration history, and CloudTrail-based estimates for sizing Config in advance. Both routes bill; Athena queries have their own cost.
- Keep watching with AWS Budgets and AWS Cost Anomaly Detection on a Linked Account monitor.
CloudBurn's open-source rule CLDBRN-AWS-CONFIG-1, run by cloudburn discover, automates step 2 and the conservative version of step 3. It reads 14 days of ConfigurationItemsRecorded and flags types where a daily override is estimated to save more than $10 a month.
Set recording scope and frequency in Terraform or CDK
Most AWS Config cost optimization happens on the configuration recorder, so keep it in code. In Terraform, add a recording_mode_override for types above the threshold:
resource "aws_config_configuration_recorder" "main" {
name = "default"
role_arn = aws_iam_role.config.arn
recording_mode {
recording_frequency = "CONTINUOUS"
recording_mode_override {
description = "High-churn network interfaces"
resource_types = ["AWS::EC2::NetworkInterface"]
recording_frequency = "DAILY"
}
}
}
aws_config_configuration_recorder_status starts the recorder and needs a delivery channel. CDK has no L2 recorder construct, so use the L1 alongside a CfnDeliveryChannel:
import { aws_config as config } from 'aws-cdk-lib';
new config.CfnConfigurationRecorder(this, 'Recorder', {
roleArn: configRole.roleArn,
recordingMode: {
recordingFrequency: 'CONTINUOUS',
recordingModeOverrides: [
{
description: 'High-churn network interfaces',
recordingFrequency: 'DAILY',
resourceTypes: ['AWS::EC2::NetworkInterface'],
},
],
},
});
In CloudFormation the setting is RecordingMode.RecordingModeOverrides on AWS::Config::ConfigurationRecorder. The array holds one override object, so list every daily type in its ResourceTypes. For the CLI route, start from the current recorder definition and add the type to the existing override's resourceTypes.
Scope is the other lever; AWS's guide to recording AWS resources covers each strategy:
INCLUSION_BY_RESOURCE_TYPESrecords only what you list.EXCLUSION_BY_RESOURCE_TYPESdrops high-volume types, which still get free create and delete records.- Under exclusion,
IncludeGlobalResourceTypes: falsehas no effect. List global IAM types in the exclusion list in every Region except the one that records them. - Record
AWS::RDS::GlobalClusterin one Region and it's recorded in every Region where the recorder runs, unless an inclusion or exclusion strategy stops it. - Run ephemeral workloads in a separate account with Config off.
- Keep periodic rules at 24 hours, the CDK
ManagedRuledefault formaximumExecutionFrequency.
With the recorder in code, you review recorder scope like any other change.
What you give up when you record less
- Rules evaluate only recorded CIs, so an excluded type also goes unchecked.
- Daily recording misses changes shorter than 24 hours.
- Excluding
AWS::Config::ResourceCompliancecuts CIs, but AWS says accurate compliance reporting and the configuration timeline need it. Decide which matters more. - The free
AWS::Config::ConfigurationRecorderCI tracks scope changes, showing when coverage shrank.
Frequently Asked Questions
Is AWS Config free?
Do AWS Config aggregators and advanced queries cost extra?
Has AWS Config pricing changed over time?
Is AWS AppConfig priced the same way as AWS Config?
What AWS Config pricing comes down to
- AWS Config pricing follows change volume, not resource count.
- Daily recording pays off only above 4 CIs per changed resource per day, and only for that type.
- Periodic rule frequency and duplicated conformance pack rules multiply evaluations.
- Security services switch recording on, and they don't all bill the same way.
Next, measure CIs per changed resource per day for your top type and price both modes in the calculator. For the other always-on governance charge, see AWS CloudTrail pricing.
CloudBurn
Price Your AWS Config Recorder Before It Bills
CloudBurn's AWS Config calculator turns configuration items, rule evaluations and conformance pack evaluations into a monthly cost for your Region. Run it once per recording mode to price an override.