# Notifications that AWS Config Sends to an Amazon SNS topic
**Note**
Before AWS Config can send notifications to an Amazon SNS topic, you must first set up the configuration recorder and the delivery channel. For more information, see [Managing the Configuration Recorder](https://docs.aws.amazon.com/config/latest/developerguide/stop-start-recorder.html) and [Managing the Delivery Channel](https://docs.aws.amazon.com/config/latest/developerguide/manage-delivery-channel.html).
You can configure AWS Config to stream configuration changes and notifications to an Amazon SNS topic. For example, when a resource is updated, you can get a notification sent to your email, so that you can view the changes. You can also be notified when AWS Config evaluates your custom or managed rules against your resources. For more information, see [Logging and Monitoring in AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/security-logging-and-monitoring.html).
AWS Config sends notifications for the following events:
+ Configuration item change for a resource.
+ Configuration history for a resource was delivered for your account.
+ Configuration snapshot for recorded resources was started and delivered for your account.
+ Compliance state of your resources and whether they are compliant with your rules.
+ Evaluation started for a rule against your resources.
+ AWS Config failed to deliver the notification to your account.
**Topics**
+ [Example Configuration Item Change Notifications](example-sns-notification.md)
+ [
# Example Configuration History Delivery Notification
](example-configuration-history-notification.md)
+ [
# Example Configuration Snapshot Delivery Started Notification
](example-configuration-snapshot-notification-started.md)
+ [
# Example Configuration Snapshot Delivery Notification
](example-configuration-snapshot-notification.md)
+ [
# Example Compliance Change Notification
](example-config-rule-compliance-notification.md)
+ [
# Example Rules Evaluation Started Notification
](config-rules-evaluation-started.md)
+ [
# Example Oversized Configuration Item Change Notification
](oversized-notification-example.md)
+ [
# Example Delivery Failed Notification
](notification-delivery-failed.md)
# Example Configuration Item Change Notifications
AWS Config uses Amazon SNS to deliver notifications to subscription endpoints. These notifications provide the delivery status for configuration snapshots and configuration histories, and they provide each configuration item that AWS Config creates when the configurations of recorded AWS resources change. AWS Config also sends notifications that show whether your resources are compliant against your rules. If you choose to have notifications sent by email, you can use filters in your email client application based on the subject line and message body of the email.
The following is an example payload of an Amazon SNS notification that is generated when AWS Config detects that the Amazon Elastic Block Store volume `vol-ce676ccc` is attached to the instance with an ID of `i-344c463d`. The notification contains the configuration item change for the resource.
```
{
"Type": "Notification",
"MessageId": "8b945cb0-db34-5b72-b032-1724878af488",
"TopicArn": "arn:aws:sns:us-west-2:123456789012:example",
"Message": {
"MessageVersion": "1.0",
"NotificationCreateTime": "2014-03-18T10:11:00Z",
"messageType": "ConfigurationItemChangeNotification",
"configurationItem": [
{
"configurationItemVersion": "1.0",
"configurationItemCaptureTime": "2014-03-07T23:47:08.918Z",
"arn": "arn:aws:us-west-2b:123456789012:volume/vol-ce676ccc",
"resourceId": "vol-ce676ccc",
"awsAccountId": "123456789012",
"configurationStateID": "3e660fdf-4e34-4f32-afeb-0ace5bf3d63a",
"configurationItemStatus": "OK",
"relatedEvents": [],
"availabilityZone": "us-west-2b",
"resourceType": "AWS::EC2::VOLUME",
"resourceCreationTime": "2014-02-27T21:43:53.885Z",
"tags": {},
"relationships": [
{
"resourceId": "i-344c463d",
"resourceType": "AWS::EC2::INSTANCE",
"name": "Attached to Instance"
}
],
"configuration": {
"volumeId": "vol-ce676ccc",
"size": 1,
"snapshotId": "",
"availabilityZone": "us-west-2b",
"state": "in-use",
"createTime": "2014-02-27T21:43:53.0885+0000",
"attachments": [
{
"volumeId": "vol-ce676ccc",
"instanceId": "i-344c463d",
"device": "/dev/sdf",
"state": "attached",
"attachTime": "2014-03-07T23:46:28.0000+0000",
"deleteOnTermination": false
}
],
"tags": [],
"volumeType": "standard"
}
}
],
"configurationItemDiff": {
"changeType": "UPDATE",
"changedProperties": {
"Configuration.State": {
"previousValue": "available",
"updatedValue": "in-use",
"changeType": "UPDATE"
},
"Configuration.Attachments.0": {
"updatedValue": {
"VolumeId": "vol-ce676ccc",
"InstanceId": "i-344c463d",
"Device": "/dev/sdf",
"State": "attached",
"AttachTime": "FriMar0723: 46: 28UTC2014",
"DeleteOnTermination": "false"
},
"changeType": "CREATE"
}
}
}
},
"Timestamp": "2014-03-07T23:47:10.001Z",
"SignatureVersion": "1",
"Signature": "LgfJNB5aOk/w3omqsYrv5cUFY8yvIJvO5ZZh46/KGPApk6HXRTBRlkhjacnxIXJEWsGI9mxvMmoWPLJGYEAR5FF/+/Ro9QTmiTNcEjQ5kB8wGsRWVrk/whAzT2lVtofc365En2T1Ncd9iSFFXfJchgBmI7EACZ28t+n2mWFgo57n6eGDvHTedslzC6KxkfWTfXsR6zHXzkB3XuZImktflg3iPKtvBb3Zc9iVbNsBEI4FITFWktSqqomYDjc5h0kgapIo4CtCHGKpALW9JDmP+qZhMzEbHWpzFlEzvFl55KaZXxDbznBD1ZkqPgno/WufuxszCiMrsmV8pUNUnkU1TA==",
"SigningCertURL": "https://sns.us-west-2.amazonaws.com/SimpleNotificationService-e372f8ca30337fdb084e8ac449342c77.pem",
"UnsubscribeURL": "https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-2:123456789012:example:a6859fee-3638-407c-907e-879651c9d143"
}
```
## Configuration Items for Resources with Relationships
If a resource is related to other resources, a change to that resource can result in multiple configuration items. The following example shows how AWS Config creates configuration items for resources with relationships.
1. You have an Amazon EC2 instance with an ID of `i-007d374c8912e3e90`, and the instance is associated with an Amazon EC2 security group, `sg-c8b141b4`.
1. You update your EC2 instance to change the security group to another security group, `sg-3f1fef43`.
1. Because the EC2 instance is related to another resource, AWS Config creates multiple configuration items like the following examples:
This notification contains the configuration item change for the EC2 instance when the security group is replaced.
```
{
"Type": "Notification",
"MessageId": "faeba85e-ef46-570a-b01c-f8b0faae8d5d",
"TopicArn": "arn:aws:sns:us-east-2:123456789012:config-topic-ohio",
"Subject": "[AWS Config:us-east-2] AWS::EC2::Instance i-007d374c8912e3e90 Updated in Account 123456789012",
"Message": {
"configurationItemDiff": {
"changedProperties": {
"Configuration.NetworkInterfaces.0": {
"previousValue": {
"networkInterfaceId": "eni-fde9493f",
"subnetId": "subnet-2372be7b",
"vpcId": "vpc-14400670",
"description": "",
"ownerId": "123456789012",
"status": "in-use",
"macAddress": "0e:36:a2:2d:c5:e0",
"privateIpAddress": "172.31.16.84",
"privateDnsName": "ip-172-31-16-84.ec2.internal",
"sourceDestCheck": true,
"groups": [{
"groupName": "example-security-group-1",
"groupId": "sg-c8b141b4"
}],
"attachment": {
"attachmentId": "eni-attach-85bd89d9",
"deviceIndex": 0,
"status": "attached",
"attachTime": "2017-01-09T19:36:02.000Z",
"deleteOnTermination": true
},
"association": {
"publicIp": "54.175.43.43",
"publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com",
"ipOwnerId": "amazon"
},
"privateIpAddresses": [{
"privateIpAddress": "172.31.16.84",
"privateDnsName": "ip-172-31-16-84.ec2.internal",
"primary": true,
"association": {
"publicIp": "54.175.43.43",
"publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com",
"ipOwnerId": "amazon"
}
}]
},
"updatedValue": null,
"changeType": "DELETE"
},
"Relationships.0": {
"previousValue": {
"resourceId": "sg-c8b141b4",
"resourceName": null,
"resourceType": "AWS::EC2::SecurityGroup",
"name": "Is associated with SecurityGroup"
},
"updatedValue": null,
"changeType": "DELETE"
},
"Configuration.NetworkInterfaces.1": {
"previousValue": null,
"updatedValue": {
"networkInterfaceId": "eni-fde9493f",
"subnetId": "subnet-2372be7b",
"vpcId": "vpc-14400670",
"description": "",
"ownerId": "123456789012",
"status": "in-use",
"macAddress": "0e:36:a2:2d:c5:e0",
"privateIpAddress": "172.31.16.84",
"privateDnsName": "ip-172-31-16-84.ec2.internal",
"sourceDestCheck": true,
"groups": [{
"groupName": "example-security-group-2",
"groupId": "sg-3f1fef43"
}],
"attachment": {
"attachmentId": "eni-attach-85bd89d9",
"deviceIndex": 0,
"status": "attached",
"attachTime": "2017-01-09T19:36:02.000Z",
"deleteOnTermination": true
},
"association": {
"publicIp": "54.175.43.43",
"publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com",
"ipOwnerId": "amazon"
},
"privateIpAddresses": [{
"privateIpAddress": "172.31.16.84",
"privateDnsName": "ip-172-31-16-84.ec2.internal",
"primary": true,
"association": {
"publicIp": "54.175.43.43",
"publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com",
"ipOwnerId": "amazon"
}
}]
},
"changeType": "CREATE"
},
"Relationships.1": {
"previousValue": null,
"updatedValue": {
"resourceId": "sg-3f1fef43",
"resourceName": null,
"resourceType": "AWS::EC2::SecurityGroup",
"name": "Is associated with SecurityGroup"
},
"changeType": "CREATE"
},
"Configuration.SecurityGroups.1": {
"previousValue": null,
"updatedValue": {
"groupName": "example-security-group-2",
"groupId": "sg-3f1fef43"
},
"changeType": "CREATE"
},
"Configuration.SecurityGroups.0": {
"previousValue": {
"groupName": "example-security-group-1",
"groupId": "sg-c8b141b4"
},
"updatedValue": null,
"changeType": "DELETE"
}
},
"changeType": "UPDATE"
},
"configurationItem": {
"relatedEvents": [],
"relationships": [
{
"resourceId": "eni-fde9493f",
"resourceName": null,
"resourceType": "AWS::EC2::NetworkInterface",
"name": "Contains NetworkInterface"
},
{
"resourceId": "sg-3f1fef43",
"resourceName": null,
"resourceType": "AWS::EC2::SecurityGroup",
"name": "Is associated with SecurityGroup"
},
{
"resourceId": "subnet-2372be7b",
"resourceName": null,
"resourceType": "AWS::EC2::Subnet",
"name": "Is contained in Subnet"
},
{
"resourceId": "vol-0a2d63a256bce35c5",
"resourceName": null,
"resourceType": "AWS::EC2::Volume",
"name": "Is attached to Volume"
},
{
"resourceId": "vpc-14400670",
"resourceName": null,
"resourceType": "AWS::EC2::VPC",
"name": "Is contained in Vpc"
}
],
"configuration": {
"instanceId": "i-007d374c8912e3e90",
"imageId": "ami-9be6f38c",
"state": {
"code": 16,
"name": "running"
},
"privateDnsName": "ip-172-31-16-84.ec2.internal",
"publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com",
"stateTransitionReason": "",
"keyName": "ec2-micro",
"amiLaunchIndex": 0,
"productCodes": [],
"instanceType": "t2.micro",
"launchTime": "2017-01-09T20:13:28.000Z",
"placement": {
"availabilityZone": "us-east-2c",
"groupName": "",
"tenancy": "default",
"hostId": null,
"affinity": null
},
"kernelId": null,
"ramdiskId": null,
"platform": null,
"monitoring": {"state": "disabled"},
"subnetId": "subnet-2372be7b",
"vpcId": "vpc-14400670",
"privateIpAddress": "172.31.16.84",
"publicIpAddress": "54.175.43.43",
"stateReason": null,
"architecture": "x86_64",
"rootDeviceType": "ebs",
"rootDeviceName": "/dev/xvda",
"blockDeviceMappings": [{
"deviceName": "/dev/xvda",
"ebs": {
"volumeId": "vol-0a2d63a256bce35c5",
"status": "attached",
"attachTime": "2017-01-09T19:36:03.000Z",
"deleteOnTermination": true
}
}],
"virtualizationType": "hvm",
"instanceLifecycle": null,
"spotInstanceRequestId": null,
"clientToken": "bIYqA1483990561516",
"tags": [{
"key": "Name",
"value": "value"
}],
"securityGroups": [{
"groupName": "example-security-group-2",
"groupId": "sg-3f1fef43"
}],
"sourceDestCheck": true,
"hypervisor": "xen",
"networkInterfaces": [{
"networkInterfaceId": "eni-fde9493f",
"subnetId": "subnet-2372be7b",
"vpcId": "vpc-14400670",
"description": "",
"ownerId": "123456789012",
"status": "in-use",
"macAddress": "0e:36:a2:2d:c5:e0",
"privateIpAddress": "172.31.16.84",
"privateDnsName": "ip-172-31-16-84.ec2.internal",
"sourceDestCheck": true,
"groups": [{
"groupName": "example-security-group-2",
"groupId": "sg-3f1fef43"
}],
"attachment": {
"attachmentId": "eni-attach-85bd89d9",
"deviceIndex": 0,
"status": "attached",
"attachTime": "2017-01-09T19:36:02.000Z",
"deleteOnTermination": true
},
"association": {
"publicIp": "54.175.43.43",
"publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com",
"ipOwnerId": "amazon"
},
"privateIpAddresses": [{
"privateIpAddress": "172.31.16.84",
"privateDnsName": "ip-172-31-16-84.ec2.internal",
"primary": true,
"association": {
"publicIp": "54.175.43.43",
"publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com",
"ipOwnerId": "amazon"
}
}]
}],
"iamInstanceProfile": null,
"ebsOptimized": false,
"sriovNetSupport": null,
"enaSupport": true
},
"supplementaryConfiguration": {},
"tags": {"Name": "value"},
"configurationItemVersion": "1.2",
"configurationItemCaptureTime": "2017-01-09T22:50:14.328Z",
"configurationStateId": 1484002214328,
"awsAccountId": "123456789012",
"configurationItemStatus": "OK",
"resourceType": "AWS::EC2::Instance",
"resourceId": "i-007d374c8912e3e90",
"resourceName": null,
"ARN": "arn:aws:ec2:us-east-2:123456789012:instance/i-007d374c8912e3e90",
"awsRegion": "us-east-2",
"availabilityZone": "us-east-2c",
"configurationStateMd5Hash": "8d0f41750f5965e0071ae9be063ba306",
"resourceCreationTime": "2017-01-09T20:13:28.000Z"
},
"notificationCreationTime": "2017-01-09T22:50:15.928Z",
"messageType": "ConfigurationItemChangeNotification",
"recordVersion": "1.2"
},
"Timestamp": "2017-01-09T22:50:16.358Z",
"SignatureVersion": "1",
"Signature": "lpJTEYOSr8fUbiaaRNw1ECawJFVoD7I67mIeEkfAWJkqvvpak1ULHLlC+I0sS/01A4P1Yci8GSK/cOEC/O2XBntlw4CAtbMUgTQvb345Z2YZwcpK0kPNi6v6N51DuZ/6DZA8EC+gVTNTO09xtNIH8aMlvqyvUSXuh278xayExC5yTRXEg+ikdZRd4QzS7obSK1kgRZWI6ipxPNL6rd56/VvPxyhcbS7Vm40/2+e0nVb3bjNHBxjQTXSs1Xhuc9eP2gEsC4Sl32bGqdeDU1Y4dFGukuzPYoHuEtDPh+GkLUq3KeiDAQshxAZLmOIRcQ7iJ/bELDJTN9AcX6lqlDZ79w==",
"SigningCertURL": "https://sns.us-east-2.amazonaws.com/SimpleNotificationService-b95095beb82e8f6a046b3aafc7f4149a.pem",
"UnsubscribeURL": "https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:123456789012:config-topic-ohio:956fe658-0ce3-4fb3-b409-a45f22a3c3d4"
}
```
This notification contains the configuration item change for the EC2 security group, `sg-3f1fef43`, which is associated with the instance.
```
{
"Type": "Notification",
"MessageId": "564d873e-711e-51a3-b48c-d7d064f65bf4",
"TopicArn": "arn:aws:sns:us-east-2:123456789012:config-topic-ohio",
"Subject": "[AWS Config:us-east-2] AWS::EC2::SecurityGroup sg-3f1fef43 Created in Account 123456789012",
"Message": {
"configurationItemDiff": {
"changedProperties": {},
"changeType": "CREATE"
},
"configurationItem": {
"relatedEvents": [],
"relationships": [{
"resourceId": "vpc-14400670",
"resourceName": null,
"resourceType": "AWS::EC2::VPC",
"name": "Is contained in Vpc"
}],
"configuration": {
"ownerId": "123456789012",
"groupName": "example-security-group-2",
"groupId": "sg-3f1fef43",
"description": "This is an example security group.",
"ipPermissions": [],
"ipPermissionsEgress": [{
"ipProtocol": "-1",
"fromPort": null,
"toPort": null,
"userIdGroupPairs": [],
"ipRanges": ["0.0.0.0/0"],
"prefixListIds": []
}],
"vpcId": "vpc-14400670",
"tags": []
},
"supplementaryConfiguration": {},
"tags": {},
"configurationItemVersion": "1.2",
"configurationItemCaptureTime": "2017-01-09T22:50:15.156Z",
"configurationStateId": 1484002215156,
"awsAccountId": "123456789012",
"configurationItemStatus": "ResourceDiscovered",
"resourceType": "AWS::EC2::SecurityGroup",
"resourceId": "sg-3f1fef43",
"resourceName": null,
"ARN": "arn:aws:ec2:us-east-2:123456789012:security-group/sg-3f1fef43",
"awsRegion": "us-east-2",
"availabilityZone": "Not Applicable",
"configurationStateMd5Hash": "7399608745296f67f7fe1c9ca56d5205",
"resourceCreationTime": null
},
"notificationCreationTime": "2017-01-09T22:50:16.021Z",
"messageType": "ConfigurationItemChangeNotification",
"recordVersion": "1.2"
},
"Timestamp": "2017-01-09T22:50:16.413Z",
"SignatureVersion": "1",
"Signature": "GocX31Uu/zNFo85hZqzsNy30skwmLnjPjj+UjaJzkih+dCP6gXYGQ0bK7uMzaLL2C/ibYOOsT7I/XY4NW6Amc5T46ydyHDjFRtQi8UfUQTqLXYRTnpOO/hyK9lMFfhUNs4NwQpmx3n3mYEMpLuMs8DCgeBmB3AQ+hXPhNuNuR3mJVgo25S8AqphN9O0okZ2MKNUQy8iJm/CVAx70TdnYsfUMZ24n88bUzAfiHGzc8QTthMdrFVUwXxa1h/7Zl8+A7BwoGmjo7W8CfLDVwaIQv1Uplgk3qd95Z0AXOzXVxNBQEi4k8axcknwjzpyO1g3rKzByiQttLUQwkgF33op9wg==",
"SigningCertURL": "https://sns.us-east-2.amazonaws.com/SimpleNotificationService-b95095beb82e8f6a046b3aafc7f4149a.pem",
"UnsubscribeURL": "https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:123456789012:config-topic-ohio:956fe658-0ce3-4fb3-b409-a45f22a3c3d4"
}
```
## Understanding the `configurationItemDiff` field in Amazon SNS `ConfigurationItemChangeNotification` notifications
AWS Config creates a configuration item whenever the configuration of a resource changes (create/update/delete). For a list of supported resource types that AWS Config can record, see [Supported Resource Types for AWS Config](resource-config-reference.md). AWS Config uses Amazon SNS to deliver a notification as the changes occur. The Amazon SNS notification payload includes fields to help you track the resource changes in a given AWS Region.
To understand why you receive a `ConfigurationItemChangeNotification` notification, review the `configurationItemDiff` details. The fields vary depending on the change type and can form different combinations such as UPDATE-UPDATE, UPDATE-CREATE, and DELETE-DELETE. The following are explanations of some common combinations.
### UPDATE-CREATE and UPDATE-UPDATE
The following example includes changes in the resource direct relationships and resource configurations. The `configurationItemDiff` details reveal the following information:
**Action performed**: A managed policy present in the account was attached to an AWS Identity and Access Management (IAM) role.
**Basic operation performed**: UPDATE (updating the number of associations of the resource type `AWS::IAM::Policy` in an account).
**Change type combinations**:
1. Resource direct relationship change UPDATE-CREATE. A new attachment or association was created between an IAM policy and an IAM role.
1. Resource configuration change UPDATE-UPDATE. The number IAM policy associations increased from 2 to 3 when the policy was attached to the IAM role.
Example UPDATE-CREATE and UPDATE-UPDATE `configurationItemDiff` notification:
```
{
"configurationItemDiff": {
"changedProperties": {
"Relationships.0": {
"previousValue": null,
"updatedValue": {
"resourceId": "AROA6D3M4S53*********",
"resourceName": "Test1",
"resourceType": "AWS::IAM::Role",
"name": "Is attached to Role"
},
"changeType": "CREATE" >>>>>>>>>>>>>>>>>>>> 1
},
"Configuration.AttachmentCount": {
"previousValue": 2,
"updatedValue": 3,
"changeType": "UPDATE" >>>>>>>>>>>>>>>>>>>> 2
}
},
"changeType": "UPDATE"
}
}
```
### UPDATE-DELETE
The following example includes changes in the resource direct relationships and resource configurations. The `configurationItemDiff` details reveal the following information:
**Action performed**: A managed policy present in the account was detached from an IAM user.
**Basic operation performed**: UPDATE (updating the permissions policy associated with the resource type `AWS::IAM::User`).
**Change type combinations**: Resource direct relationship change UPDATE-DELETE. The association between an IAM user and an IAM policy in an account was deleted.
### DELETE-DELETE
The following example includes changes in the resource direct relationships and resource configurations. The `configurationItemDiff` details reveal the following information:
**Action performed**: An IAM role present in an account was deleted.
**Basic operation performed**: DELETE (a resource of the resource type `AWS::IAM::Role` was deleted).
**Change type combinations**: Resource direct relationship change and resource configuration change DELETE-DELETE. The deletion of the IAM role also deleted the association of the IAM policy with the IAM role.
# Example Configuration History Delivery Notification
The configuration history is a collection of the configuration items for a resource type over a time period. The following is an example notification that AWS Config sends when the configuration history for a CloudTrail trail resource is delivered for your account.
```
{
"Type": "Notification",
"MessageId": "ce49bf2c-d03a-51b0-8b6a-ef480a8b39fe",
"TopicArn": "arn:aws:sns:us-east-2:123456789012:config-topic-ohio",
"Subject": "[AWS Config:us-east-2] Configuration History Delivery Completed for Account 123456789012",
"Message": {
"s3ObjectKey": "AWSLogs/123456789012/Config/us-east-2/2016/9/27/ConfigHistory/123456789012_Config_us-east-2_ConfigHistory_AWS::CloudTrail::Trail_20160927T195818Z_20160927T195818Z_1.json.gz",
"s3Bucket": "config-bucket-123456789012-ohio",
"notificationCreationTime": "2016-09-27T20:37:05.217Z",
"messageType": "ConfigurationHistoryDeliveryCompleted",
"recordVersion": "1.1"
},
"Timestamp": "2016-09-27T20:37:05.315Z",
"SignatureVersion": "1",
"Signature": "OuIcS5RAKXTR6chQEJp3if4KJQVlBz2kmXh7QE1/RJQiCPsCNfG0J0rUZ1rqfKMqpps/Ka+zF0kg4dUCWV9PF0dliuwnjfbtYmDZpP4EBOoGmxcTliUn1AIe/yeGFDuc6P3EotP3zt02rhmxjezjf3c11urstFZ8rTLVXp0z0xeyk4da0UetLsWZxUFEG0Z5uhk09mBo5dg/4mryIOovidhrbCBgX5marot8TjzNPS9UrKhi2YGUoSQGr4E85EzWqqXdn33GO8dy0DqDfdWBaEr3IWVGtHy3w7oJDMIqW7ENkfML0bJMQjin4P5tYeilNF5XQzhtCkFvFx7JHR97vw==",
"SigningCertURL": "https://sns.us-east-2.amazonaws.com/SimpleNotificationService-b95095beb82e8f6a046b3aafc7f4149a.pem",
"UnsubscribeURL": "https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:123456789012:config-topic-ohio:956fe658-0ce3-4fb3-b409-a45f22a3c3d4"
}
```
# Example Configuration Snapshot Delivery Started Notification
The following is an example notification that AWS Config sends when AWS Config starts delivering the configuration snapshot for your account.
```
{
"Type": "Notification",
"MessageId": "a32d0487-94b1-53f6-b4e6-5407c9c00be6",
"TopicArn": "arn:aws:sns:us-east-2:123456789012:config-topic-ohio",
"Subject": "[AWS Config:us-east-2] Configuration Snapshot Delivery Started for Account 123456789012",
"Message": {
"configSnapshotId": "108e0794-84a7-4cca-a179-76a199ddd11a",
"notificationCreationTime": "2016-10-18T17:26:09.572Z",
"messageType": "ConfigurationSnapshotDeliveryStarted",
"recordVersion": "1.1"
},
"Timestamp": "2016-10-18T17:26:09.840Z",
"SignatureVersion": "1",
"Signature": "BBA0DeKsfteTpYyZH5HPANpOLmW/jumOMBsghRq/kimY9tjNlkF/V3BpLG1HVmDQdQzBh6oKE0h0rxcazbyGf5KF5W5r1zKKlEnS9xugFzALPUx//olSJ4neWalLBKNIq1xvAQgu9qHfDR7dS2aCwe4scQfqOjn1Ev7PlZqxmT+ux3SR/C54cbfcduDpDsPwdo868+TpZvMtaU30ySnX04fmOgxoiA8AJO/EnjduQ08/zd4SYXhm+H9wavcwXB9XECelHhRW70Y+wHQixfx40S1SaSRzvnJE+m9mHphFQs64YraRDRv6tMaenTk6CVPO+81ceAXIg2E1m7hZ7lz4PA==",
"SigningCertURL": "https://sns.us-east-2.amazonaws.com/SimpleNotificationService-b95095beb82e8f6a046b3aafc7f4149a.pem",
"UnsubscribeURL": "https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:123456789012:config-topic-ohio:956fe658-0ce3-4fb3-b409-a45f22a3c3d4"
}
```
# Example Configuration Snapshot Delivery Notification
The configuration snapshot is a collection of configuration items for all recorded resources and their configurations in your account. The following is an example notification that AWS Config sends when the configuration snapshot is delivered for your account.
```
{
"Type": "Notification",
"MessageId": "9fc82f4b-397e-5b69-8f55-7f2f86527100",
"TopicArn": "arn:aws:sns:us-east-2:123456789012:config-topic-ohio",
"Subject": "[AWS Config:us-east-2] Configuration Snapshot Delivery Completed for Account 123456789012",
"Message": {
"configSnapshotId": "16da64e4-cb65-4846-b061-e6c3ba43cb96",
"s3ObjectKey": "AWSLogs/123456789012/Config/us-east-2/2016/9/27/ConfigSnapshot/123456789012_Config_us-east-2_ConfigSnapshot_20160927T183939Z_16da64e4-cb65-4846-b061-e6c3ba43cb96.json.gz",
"s3Bucket": "config-bucket-123456789012-ohio",
"notificationCreationTime": "2016-09-27T18:39:39.853Z",
"messageType": "ConfigurationSnapshotDeliveryCompleted",
"recordVersion": "1.1"
},
"Timestamp": "2016-09-27T18:39:40.062Z",
"SignatureVersion": "1",
"Signature": "PMkWfUuj/fKIEXA7s2wTDLbZoF/MDsUkPspYghOpwu9n6m+C+zrm0cEZXPxxJPvhnWozG7SVqkHYf9QgI/diW2twP/HPDn5GQs2rNDc+YlaByEXnKVtHV1Gd4r1kN57E/oOW5NVLNczk5ymxAW+WGdptZJkCgyVuhJ28s08m3Z3Kqz96PPSnXzYZoCfCn/yP6CqXoN7olr4YCbYxYwn8zOUYcPmc45yYNSUTKZi+RJQRnDJkL2qb+s4h9w2fjbBBj8xe830VbFJqbHp7UkSfpc64Y+tRvmMLY5CI1cYrnuPRhTLdUk+R0sshg5G+JMtSLVG/TvWbjz44CKXJprjIQg==",
"SigningCertURL": "https://sns.us-east-2.amazonaws.com/SimpleNotificationService-b95095beb82e8f6a046b3aafc7f4149a.pem",
"UnsubscribeURL": "https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:123456789012:config-topic-ohio:956fe658-0ce3-4fb3-b409-a45f22a3c3d4"
}
```
# Example Compliance Change Notification
When AWS Config evaluates your resources against a custom or managed rule, AWS Config sends a notification that shows whether the resources are compliant against the rule.
The following is an example notification where the CloudTrail trail resource is compliant against the `cloudtrail-enabled `managed rule.
```
{
"Type": "Notification",
"MessageId": "11fd05dd-47e1-5523-bc01-55b988bb9478",
"TopicArn": "arn:aws:sns:us-east-2:123456789012:config-topic-ohio",
"Subject": "[AWS Config:us-east-2] AWS::::Account 123456789012 is COMPLIANT with cloudtrail-enabled in Accoun...",
"Message": {
"awsAccountId": "123456789012",
"configRuleName": "cloudtrail-enabled",
"configRuleARN": "arn:aws:config:us-east-2:123456789012:config-rule/config-rule-9rpvxc",
"resourceType": "AWS::::Account",
"resourceId": "123456789012",
"awsRegion": "us-east-2",
"newEvaluationResult": {
"evaluationResultIdentifier": {
"evaluationResultQualifier": {
"configRuleName": "cloudtrail-enabled",
"resourceType": "AWS::::Account",
"resourceId": "123456789012"
},
"orderingTimestamp": "2016-09-27T19:48:40.619Z"
},
"complianceType": "COMPLIANT",
"resultRecordedTime": "2016-09-27T19:48:41.405Z",
"configRuleInvokedTime": "2016-09-27T19:48:40.914Z",
"annotation": null,
"resultToken": null
},
"oldEvaluationResult": {
"evaluationResultIdentifier": {
"evaluationResultQualifier": {
"configRuleName": "cloudtrail-enabled",
"resourceType": "AWS::::Account",
"resourceId": "123456789012"
},
"orderingTimestamp": "2016-09-27T16:30:49.531Z"
},
"complianceType": "NON_COMPLIANT",
"resultRecordedTime": "2016-09-27T16:30:50.717Z",
"configRuleInvokedTime": "2016-09-27T16:30:50.105Z",
"annotation": null,
"resultToken": null
},
"notificationCreationTime": "2016-09-27T19:48:42.620Z",
"messageType": "ComplianceChangeNotification",
"recordVersion": "1.0"
},
"Timestamp": "2016-09-27T19:48:42.749Z",
"SignatureVersion": "1",
"Signature": "XZ9FfLb2ywkW9yj0yBkNtIP5q7Cry6JtCEyUiHmG9gpOZi3seQ41udhtAqCZoiNiizAEi+6gcttHCRV1hNemzp/YmBmTfO6azYXt0FJDaEvd86k68VCS9aqRlBBjYlNo7ILi4Pqd5rE4BX2YBQSzcQyERGkUfTZ2BIFyAmb1Q/y4/6ez8rDyi545FDSlgcGEb4LKLNR6eDi4FbKtMGZHA7Nz8obqs1dHbgWYnp3c80mVLl7ohP4hilcxdywAgXrbsN32ekYr15gdHozx8YzyjfRSo3SjH0c5PGSXEAGNuC3mZrKJip+BIZ21ZtkcUtY5B3ImgRlUO7Yhn3L3c6rZxQ==",
"SigningCertURL": "https://sns.us-east-2.amazonaws.com/SimpleNotificationService-b95095beb82e8f6a046b3aafc7f4149a.pem",
"UnsubscribeURL": "https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:123456789012:config-topic-ohio:956fe658-0ce3-4fb3-b409-a45f22a3c3d4"
}
```
**Example: Config Configuration Item Change \$1 Amazon EventBridge**
```
{
"version": "0",
"id": "00bdf13e-1111-b2f5-cef0-e9cbbe7cd533",
"detail-type": "Config Configuration Item Change",
"source": "aws.config",
"account": "123456789012",
"time": "2022-03-16T01:10:51Z",
"region": "us-east-1",
"resources": ["arn:aws:elasticfilesystem:us-east-1:123456789012:file-system/fs-01f0d526165b57f95"],
"detail": {
"recordVersion": "1.3",
"messageType": "ConfigurationItemChangeNotification",
"configurationItemDiff": {
"changedProperties": {
"Configuration.FileSystemTags.0": {
"updatedValue": {
"Key": "test",
"Value": "me"
},
"changeType": "CREATE"
},
"Tags.2": {
"updatedValue": "me",
"changeType": "CREATE"
}
},
"changeType": "UPDATE"
},
"notificationCreationTime": "2022-03-16T01:10:51.976Z",
"configurationItem": {
"relatedEvents": [],
"relationships": [],
"configuration": {
"FileSystemId": "fs-01f0d526165b57f95",
"Arn": "arn:aws:elasticfilesystem:us-east-1:123456789012:file-system/fs-01f0d526165b57f95",
"Encrypted": true,
"FileSystemTags": [{
"Key": "Name",
"Value": "myname"
}, {
"Key": "test",
"Value": "me"
}],
"PerformanceMode": "generalPurpose",
"ThroughputMode": "bursting",
"LifecyclePolicies": [{
"TransitionToIA": "AFTER_30_DAYS"
}, {
"TransitionToPrimaryStorageClass": "AFTER_1_ACCESS"
}],
"BackupPolicy": {
"Status": "ENABLED"
},
"FileSystemPolicy": {},
"KmsKeyId": "arn:aws:kms:us-east-1:123456789012:key/0e6c91d5-e23b-4ed3-bd36-1561fbbc0a2d"
},
"supplementaryConfiguration": {},
"tags": {
"aws:elasticfilesystem:default-backup": "enabled",
"test": "me",
"Name": "cloudcontroltest1"
},
"configurationItemVersion": "1.3",
"configurationItemCaptureTime": "2022-03-16T01:10:50.837Z",
"configurationStateId": 1647393050837,
"awsAccountId": "123456789012",
"configurationItemStatus": "OK",
"resourceType": "AWS::EFS::FileSystem",
"resourceId": "fs-01f0d526165b57f95",
"resourceName": "fs-01f0d526165b57f95",
"ARN": "arn:aws:elasticfilesystem:us-east-1:123456789012:file-system/fs-01f0d526165b57f95",
"awsRegion": "us-east-1",
"availabilityZone": "Regional",
"configurationStateMd5Hash": ""
}
}
}
```
# Example Rules Evaluation Started Notification
AWS Config sends a notification when it starts to evaluate your custom or managed rule against your resources. The following is an example notification when AWS Config starts to evaluate the `iam-password-policy` managed rule.
```
{
"Type": "Notification",
"MessageId": "358c8e65-e27a-594e-82d0-de1fe77393d7",
"TopicArn": "arn:aws:sns:us-east-2:123456789012:config-topic-ohio",
"Subject": "[AWS Config:us-east-2] Config Rules Evaluation Started for Account 123456789012",
"Message": {
"awsAccountId": "123456789012",
"awsRegion": "us-east-2",
"configRuleNames": ["iam-password-policy"],
"notificationCreationTime": "2016-10-13T21:55:21.339Z",
"messageType": "ConfigRulesEvaluationStarted",
"recordVersion": "1.0"
},
"Timestamp": "2016-10-13T21:55:21.575Z",
"SignatureVersion": "1",
"Signature": "DE431D+24zzFRboyPY2bPTsznJWe8L6TjDC+ItYlLFkE9jACSBl3sQ1uSjYzEhEbN7Cs+wBoHnJ/DxOSpyCxt4giqgKd+H2I636BvrQwHDhJwJm7qI6P8IozEliRvRWbM38zDTvHqkmmXQbdDHRsK/MssMeVTBKuW0x8ivMrj+KpwuF57tE62eXeFhjBeJ0DKQV+aC+i3onsuT7HQvXQDBPdOM+cSuLrJaMQJ6TcMU5G76qg/gl494ilb4Vj4udboGWpHSgUvI3guFsc1SsTrlWXQKXabWtsCQPfdOhkKgmViCfMZrLRp8Pjnu+uspYQELkEfwBchDVVzd15iMrAzQ==",
"SigningCertURL": "https://sns.us-east-2.amazonaws.com/SimpleNotificationService-b95095beb82e8f6a046b3aafc7f4149a.pem",
"UnsubscribeURL": "https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:123456789012:config-topic-ohio:956fe658-0ce3-4fb3-b409-a45f22a3c3d4"
}
```
# Example Oversized Configuration Item Change Notification
When AWS Config detects a configuration change for a resource, it sends a configuration item (CI) notification. If the notification exceeds the maximum size allowed by Amazon Simple Notification Service (Amazon SNS), the notification includes a brief summary of the configuration item.
You can view the complete notification in the Amazon S3 bucket location specified in the `s3BucketLocation` field.
The following example notification shows a CI for an Amazon EC2 instance. The notification includes a summary of the changes and the location of the notification in the Amazon S3 bucket.
```
View the Timeline for this Resource in the Console:
https://console.aws.amazon.com/config/home?region=us-west-2#/timeline/AWS::EC2::Instance/resourceId_14b76876-7969-4097-ab8e-a31942b02e80?time=2016-10-06T16:46:16.261Z
The full configuration item change notification for this resource exceeded the maximum size allowed by Amazon Simple Notification Service (SNS). A summary of the configuration item is provided here. You can view the complete notification in the specified Amazon S3 bucket location.
New State Record Summary:
----------------------------
{
"configurationItemSummary": {
"changeType": "UPDATE",
"configurationItemVersion": "1.2",
"configurationItemCaptureTime": "2016-10-06T16:46:16.261Z",
"configurationStateId": 0,
"awsAccountId": "123456789012",
"configurationItemStatus": "OK",
"resourceType": "AWS::EC2::Instance",
"resourceId": "resourceId_14b76876-7969-4097-ab8e-a31942b02e80",
"resourceName": null,
"ARN": "arn:aws:ec2:us-west-2:123456789012:instance/resourceId_14b76876-7969-4097-ab8e-a31942b02e80",
"awsRegion": "us-west-2",
"availabilityZone": null,
"configurationStateMd5Hash": "8f1ee69b287895a0f8bc5753eca68e96",
"resourceCreationTime": "2016-10-06T16:46:10.489Z"
},
"s3DeliverySummary": {
"s3BucketLocation": "amzn-s3-demo-bucket/AWSLogs/123456789012/Config/us-west-2/2016/10/6/OversizedChangeNotification/AWS::EC2::Instance/resourceId_14b76876-7969-4097-ab8e-a31942b02e80/123456789012_Config_us-west-2_ChangeNotification_AWS::EC2::Instance_resourceId_14b76876-7969-4097-ab8e-a31942b02e80_20161006T164616Z_0.json.gz",
"errorCode": null,
"errorMessage": null
},
"notificationCreationTime": "2016-10-06T16:46:16.261Z",
"messageType": "OversizedConfigurationItemChangeNotification",
"recordVersion": "1.0"
}
```
## How to access oversized configuration items
When a configuration item is oversized, only a summary is sent to Amazon SNS. The complete configuration item (CI) is stored in Amazon S3
The following code example shows how to access the the complete CI.
```
import boto3
import json
def handle_oversized_configuration_item(event):
"""
Example of handling an oversized configuration item notification
When a configuration item is oversized:
1. AWS Config sends a summary notification through SNS
2. The complete configuration item is stored in S3
3. Use get_resource_config_history API to retrieve the complete configuration
"""
# Extract information from the summary notification
if event['messageType'] == 'OversizedConfigurationItemChangeNotification':
summary = event['configurationItemSummary']
resource_type = summary['resourceType']
resource_id = summary['resourceId']
# Initialize AWS Config client
config_client = boto3.client('config')
# Retrieve the complete configuration item
response = config_client.get_resource_config_history(
resourceType=resource_type,
resourceId=resource_id
)
if response['configurationItems']:
config_item = response['configurationItems'][0]
# For EC2 instances, the configuration contains instance details
configuration = json.loads(config_item['configuration'])
print(f"Instance Configuration: {configuration}")
# Handle supplementary configuration if present
if 'supplementaryConfiguration' in config_item:
for key, value in config_item['supplementaryConfiguration'].items():
if isinstance(value, str):
config_item['supplementaryConfiguration'][key] = json.loads(value)
print(f"Supplementary Configuration: {config_item['supplementaryConfiguration']}")
return config_item
# If needed, you can also access the complete notification from S3
s3_location = event['s3DeliverySummary']['s3BucketLocation']
print(f"Complete notification available in S3: {s3_location}")
return None
```
## How it works
1. The function accepts an event parameter containing the AWS Config notification.
1. It checks if the message type is an oversized configuration notification.
1. The function extracts the resource type and ID from the summary.
1. Using the AWS Config client, it retrieves the complete configuration history.
1. The function processes both main and supplementary configurations.
1. If needed, you can access the complete notification from the provided S3 location.
# Example Delivery Failed Notification
AWS Config sends a delivery failed notification if AWS Config can't deliver the configuration snapshot or an oversized configuration item change notification to your Amazon S3 bucket. Verify that you specified a valid Amazon S3 bucket.
```
View the Timeline for this Resource in the Console:
https://console.aws.amazon.com/config/home?region=us-west-2#/timeline/AWS::EC2::Instance/test_resourceId_014b953d-75e3-40ce-96b9-c7240b975457?time=2016-10-06T16:46:13.749Z
The full configuration item change notification for this resource exceeded the maximum size allowed by Amazon Simple Notification Service (SNS). A summary of the configuration item is provided here. You can view the complete notification in the specified Amazon S3 bucket location.
New State Record Summary:
----------------------------
{
"configurationItemSummary": {
"changeType": "UPDATE",
"configurationItemVersion": "1.2",
"configurationItemCaptureTime": "2016-10-06T16:46:13.749Z",
"configurationStateId": 0,
"awsAccountId": "123456789012",
"configurationItemStatus": "OK",
"resourceType": "AWS::EC2::Instance",
"resourceId": "test_resourceId_014b953d-75e3-40ce-96b9-c7240b975457",
"resourceName": null,
"ARN": "arn:aws:ec2:us-west-2:123456789012:instance/test_resourceId_014b953d-75e3-40ce-96b9-c7240b975457",
"awsRegion": "us-west-2",
"availabilityZone": null,
"configurationStateMd5Hash": "6de64b95eacd30e7b63d4bba7cd80814",
"resourceCreationTime": "2016-10-06T16:46:10.489Z"
},
"s3DeliverySummary": {
"s3BucketLocation": null,
"errorCode": "NoSuchBucket",
"errorMessage": "Failed to deliver notification to bucket: bucket-example for account 123456789012 in region us-west-2."
},
"notificationCreationTime": "2016-10-06T16:46:13.749Z",
"messageType": "OversizedConfigurationItemChangeDeliveryFailed",
"recordVersion": "1.0"
}
```