AWS Config Rules

This rule reviews AWS Config recorders for high-volume resource types that are recorded continuously when a targeted daily recording override would cost less.

CLDBRN-AWS-CONFIG-1

AWS Config Cost-Inefficient Continuous Recording

Scan type: Discovery

Severity: Medium

What it checks

Flags individual resource types on an AWS Config recorder that are recorded continuously when switching that resource type to daily recording is estimated to save more than $10 per month. CloudBurn reviews one resource type at a time, not the recorder as a whole, so the recommendation is a targeted recording-mode override rather than a change to the recorder's default.

Why it matters

AWS Config bills per configuration item recorded. Continuous recording writes a configuration item on every change, at $0.003 per item, while daily recording writes at most one item per resource per day, at $0.012 per item. For resource types with high change turnover (Auto Scaling groups, network interfaces, security group rule churn), continuous recording produces far more items than the daily equivalent and costs more despite the lower unit price. Resource types that change rarely are cheaper to record continuously, which is why the rule needs a measured estimate before it recommends anything.

What triggers a finding

All of the following must be true for a recorder and resource type pair:

• The resource type is currently recorded with CONTINUOUS frequency
• estimatedMonthlyRecordingCostReductionUsd is not null and is greater than 10
• turnoverEstimateReliable is not false
• firewallManagerDependent is false (AWS Firewall Manager requires continuous recording)
• paidServiceLinkedRecorderDependent is false

The estimate comes from the ConfigurationItemsRecorded CloudWatch metric over a 14-day observation window, compared against the resource count the recorder reports for that type.

Coverage

A review is reported as unknown coverage instead of a pass when its recorded configuration-item count, estimated item reduction, or estimated monthly saving is unavailable, or when the turnover estimate is not reliable. Reviews with a Firewall Manager or paid service-linked recorder dependency are treated as assessed, because that dependency settles the verdict without a metric estimate.

How to remediate

Add a recording-mode override for the flagged resource type rather than changing the recorder default. The override keeps every other resource type on continuous recording. put-configuration-recorder replaces the whole recorder, including any overrides already present, so start from the current definition:

aws configservice describe-configuration-recorders > recorders.json

Copy the recorder object from recorders.json into recorder.json, keep its recordingGroup and every existing entry of recordingMode.recordingModeOverrides, and append an entry with recordingFrequency: DAILY and the flagged resource type in resourceTypes:

{
  "name": "default",
  "roleARN": "arn:aws:iam::123456789012:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig",
  "recordingGroup": { "allSupported": true, "includeGlobalResourceTypes": true },
  "recordingMode": {
    "recordingFrequency": "CONTINUOUS",
    "recordingModeOverrides": [
      {
        "description": "Daily recording for high-churn network interfaces",
        "recordingFrequency": "DAILY",
        "resourceTypes": ["AWS::EC2::NetworkInterface"]
      }
    ]
  }
}

Then apply it:

aws configservice put-configuration-recorder \
  --configuration-recorder file://recorder.json

Before applying the override, confirm no compliance workflow depends on sub-daily configuration history for that resource type. AWS Config rules that evaluate on configuration change still evaluate, but only once the daily configuration item is recorded.

Three resource types cannot use daily recording (AWS::Config::ConfigurationRecorder, AWS::Config::ConformancePackCompliance, and AWS::Config::ResourceCompliance) and are never flagged.

See Also

• CLI discover command — scan live AWS Config recorders
• Understanding Rules — how scan types, severities, and evidence coverage work
• SDK Reference — run discovery programmatically