Note: This is the fourth post in my AWS SCS-C03 series. You can see the rest of the posts in the series using the link above.

• AWS Config
  • Records configuration changes over time on AWS resources.
  • It does not actively prevent changes from occurring.
  • When changes do occur, you can use Amazon SNS, EventBridge, and Lambda to notify or run functions in response.
  • All changes are tracked and saved to an S3 bucket.

• Service Catalog
  • Allows your organisation to create and manage catalogs of IT services approved for AWS (incl. servers, VM images¹, software, etc).
  • Using Service Catalog can restrict AWS resources being created in specific regions, prevent specific EC2 instance types being provisioned, and can prevent certain AWS resources being available to users.

• Resource Access Manager (RAM)
  • Allows for secure sharing of resources across AWS accounts within your organisation or organisational units. You can create one resource and then share it with other AWS accounts.
  • Resources can also be shared with other AWS accounts, even if the account is not part of an organisation.
  • This helps reduce your operational overhead², improve security and consistency³, and provides resource visibility⁴.

Thanks for reading!

-J

More reading:

• What is AWS Config? https://docs.aws.amazon.com/config/latest/developerguide/how-does-config-work.html
• What is AWS Service Catalog? https://docs.aws.amazon.com/servicecatalog/latest/adminguide/introduction.html
• What is Resource Access Manager? https://docs.aws.amazon.com/ram/latest/userguide/what-is.html

1. Virtual Machine Images ↩︎
2. Operational overhead is reduced as you don’t need to duplicate resources ↩︎
3. When resources are shared using AWS RAM, it is managed using a single set of policies and permissions ↩︎
4. AWS RAM integrates with Amazon CloudWatch and CloudTrail for comprehensive visibility into shared resources and accounts ↩︎