Menu
AWS Config
Developer Guide

Example Configuration Item Change Notifications

AWS Config uses Amazon SNS to deliver notifications to subscription endpoints. These notifications provide the delivery status for configuration snapshots and configuration histories, and they provide each configuration item that AWS Config creates when the configurations of recorded AWS resources change. AWS Config also sends notifications that show whether your resources are compliant against your rules. If you choose to have notifications sent by email, you can use filters in your email client application based on the subject line and message body of the email.

The following is an example payload of an Amazon SNS notification that is generated when AWS Config detects that the Amazon Elastic Block Store volume vol-ce676ccc is attached to the instance with an ID of i-344c463d. The notification contains the configuration item change for the resource.

Copy
"Type": "Notification", "MessageId": "8b945cb0-db34-5b72-b032-1724878af488", "TopicArn": "arn:aws:sns:us-west-2:123456789012:example", "Message": { "MessageVersion": "1.0", "NotificationCreateTime": "2014-03-18T10:11:00Z", "messageType": "ConfigurationItemChangeNotification", "configurationItems": [ { "configurationItemVersion": "1.0", "configurationItemCaptureTime": "2014-03-07T23:47:08.918Z", "arn": "arn:aws:us-west-2b:123456789012:volume/vol-ce676ccc", "resourceId": "vol-ce676ccc", "accountId": "123456789012", "configurationStateID": "3e660fdf-4e34-4f32-afeb-0ace5bf3d63a", "configuationItemStatus": "OK", "relatedEvents": [ "06c12a39-eb35-11de-ae07-adb69edbb1e4", "c376e30d-71a2-4694-89b7-a5a04ad92281" ], "availibilityZone": "us-west-2b", "resourceType": "AWS::EC2::VOLUME", "resourceCreationTime": "2014-02-27T21:43:53.885Z", "tags": {}, "relationships": [ { "resourceId": "i-344c463d", "resourceType": "AWS::EC2::INSTANCE", "name": "Attached to Instance" } ], "configuration": { "volumeId": "vol-ce676ccc", "size": 1, "snapshotId": "", "availabilityZone": "us-west-2b", "state": "in-use", "createTime": "2014-02-27T21:43:53.0885+0000", "attachments": [ { "volumeId": "vol-ce676ccc", "instanceId": "i-344c463d", "device": "/dev/sdf", "state": "attached", "attachTime": "2014-03-07T23:46:28.0000+0000", "deleteOnTermination": false } ], "tags": [], "volumeType": "standard" } } ], "configurationItemDiff": { "changeType": "UPDATE", "changedProperties": { "Configuration.State": { "previousValue": "available", "updatedValue": "in-use", "changeType": "UPDATE" }, "Configuration.Attachments.0": { "updatedValue": { "VolumeId": "vol-ce676ccc", "InstanceId": "i-344c463d", "Device": "/dev/sdf", "State": "attached", "AttachTime": "FriMar0723: 46: 28UTC2014", "DeleteOnTermination": "false" }, "changeType": "CREATE" } } } }, "Timestamp": "2014-03-07T23:47:10.001Z", "SignatureVersion": "1", "Signature": "LgfJNB5aOk/w3omqsYrv5cUFY8yvIJvO5ZZh46/KGPApk6HXRTBRlkhjacnxIXJEWsGI9mxvMmoWPLJGYEAR5FF/+/Ro9QTmiTNcEjQ5kB8wGsRWVrk/whAzT2lVtofc365En2T1Ncd9iSFFXfJchgBmI7EACZ28t+n2mWFgo57n6eGDvHTedslzC6KxkfWTfXsR6zHXzkB3XuZImktflg3iPKtvBb3Zc9iVbNsBEI4FITFWktSqqomYDjc5h0kgapIo4CtCHGKpALW9JDmP+qZhMzEbHWpzFlEzvFl55KaZXxDbznBD1ZkqPgno/WufuxszCiMrsmV8pUNUnkU1TA==", "SigningCertURL": "https://sns.us-west-2.amazonaws.com/SimpleNotificationService-e372f8ca30337fdb084e8ac449342c77.pem", "UnsubscribeURL": "https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-2:123456789012:example:a6859fee-3638-407c-907e-879651c9d143" }

Configuration Items for Resources with Relationships

If a resource is related to other resources, a change to that resource can result in multiple configuration items. The following example shows how AWS Config creates configuration items for resources with relationships.

  1. You have an Amazon EC2 instance with an ID of i-007d374c8912e3e90, and the instance is associated with an Amazon EC2 security group, sg-c8b141b4.

  2. You update your EC2 instance to change the security group to another security group, sg-3f1fef43.

  3. Because the EC2 instance is related to another resource, AWS Config creates multiple configuration items like the following examples:

This notification contains the configuration item change for the EC2 instance when the security group is replaced.

Copy
{ "Type": "Notification", "MessageId": "faeba85e-ef46-570a-b01c-f8b0faae8d5d", "TopicArn": "arn:aws:sns:us-east-2:123456789012:config-topic-ohio", "Subject": "[AWS Config:us-east-2] AWS::EC2::Instance i-007d374c8912e3e90 Updated in Account 123456789012", "Message": { "configurationItemDiff": { "changedProperties": { "Configuration.NetworkInterfaces.0": { "previousValue": { "networkInterfaceId": "eni-fde9493f", "subnetId": "subnet-2372be7b", "vpcId": "vpc-14400670", "description": "", "ownerId": "123456789012", "status": "in-use", "macAddress": "0e:36:a2:2d:c5:e0", "privateIpAddress": "172.31.16.84", "privateDnsName": "ip-172-31-16-84.ec2.internal", "sourceDestCheck": true, "groups": [{ "groupName": "example-security-group-1", "groupId": "sg-c8b141b4" }], "attachment": { "attachmentId": "eni-attach-85bd89d9", "deviceIndex": 0, "status": "attached", "attachTime": "2017-01-09T19:36:02.000Z", "deleteOnTermination": true }, "association": { "publicIp": "54.175.43.43", "publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com", "ipOwnerId": "amazon" }, "privateIpAddresses": [{ "privateIpAddress": "172.31.16.84", "privateDnsName": "ip-172-31-16-84.ec2.internal", "primary": true, "association": { "publicIp": "54.175.43.43", "publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com", "ipOwnerId": "amazon" } }] }, "updatedValue": null, "changeType": "DELETE" }, "Relationships.0": { "previousValue": { "resourceId": "sg-c8b141b4", "resourceName": null, "resourceType": "AWS::EC2::SecurityGroup", "name": "Is associated with SecurityGroup" }, "updatedValue": null, "changeType": "DELETE" }, "Configuration.NetworkInterfaces.1": { "previousValue": null, "updatedValue": { "networkInterfaceId": "eni-fde9493f", "subnetId": "subnet-2372be7b", "vpcId": "vpc-14400670", "description": "", "ownerId": "123456789012", "status": "in-use", "macAddress": "0e:36:a2:2d:c5:e0", "privateIpAddress": "172.31.16.84", "privateDnsName": "ip-172-31-16-84.ec2.internal", "sourceDestCheck": true, "groups": [{ "groupName": "example-security-group-2", "groupId": "sg-3f1fef43" }], "attachment": { "attachmentId": "eni-attach-85bd89d9", "deviceIndex": 0, "status": "attached", "attachTime": "2017-01-09T19:36:02.000Z", "deleteOnTermination": true }, "association": { "publicIp": "54.175.43.43", "publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com", "ipOwnerId": "amazon" }, "privateIpAddresses": [{ "privateIpAddress": "172.31.16.84", "privateDnsName": "ip-172-31-16-84.ec2.internal", "primary": true, "association": { "publicIp": "54.175.43.43", "publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com", "ipOwnerId": "amazon" } }] }, "changeType": "CREATE" }, "Relationships.1": { "previousValue": null, "updatedValue": { "resourceId": "sg-3f1fef43", "resourceName": null, "resourceType": "AWS::EC2::SecurityGroup", "name": "Is associated with SecurityGroup" }, "changeType": "CREATE" }, "Configuration.SecurityGroups.1": { "previousValue": null, "updatedValue": { "groupName": "example-security-group-2", "groupId": "sg-3f1fef43" }, "changeType": "CREATE" }, "Configuration.SecurityGroups.0": { "previousValue": { "groupName": "example-security-group-1", "groupId": "sg-c8b141b4" }, "updatedValue": null, "changeType": "DELETE" } }, "changeType": "UPDATE" }, "configurationItem": { "relatedEvents": ["e61e1419-7cb0-477f-8dde-bbfe27467a96"], "relationships": [ { "resourceId": "eni-fde9493f", "resourceName": null, "resourceType": "AWS::EC2::NetworkInterface", "name": "Contains NetworkInterface" }, { "resourceId": "sg-3f1fef43", "resourceName": null, "resourceType": "AWS::EC2::SecurityGroup", "name": "Is associated with SecurityGroup" }, { "resourceId": "subnet-2372be7b", "resourceName": null, "resourceType": "AWS::EC2::Subnet", "name": "Is contained in Subnet" }, { "resourceId": "vol-0a2d63a256bce35c5", "resourceName": null, "resourceType": "AWS::EC2::Volume", "name": "Is attached to Volume" }, { "resourceId": "vpc-14400670", "resourceName": null, "resourceType": "AWS::EC2::VPC", "name": "Is contained in Vpc" } ], "configuration": { "instanceId": "i-007d374c8912e3e90", "imageId": "ami-9be6f38c", "state": { "code": 16, "name": "running" }, "privateDnsName": "ip-172-31-16-84.ec2.internal", "publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com", "stateTransitionReason": "", "keyName": "ec2-micro", "amiLaunchIndex": 0, "productCodes": [], "instanceType": "t2.micro", "launchTime": "2017-01-09T20:13:28.000Z", "placement": { "availabilityZone": "us-east-2c", "groupName": "", "tenancy": "default", "hostId": null, "affinity": null }, "kernelId": null, "ramdiskId": null, "platform": null, "monitoring": {"state": "disabled"}, "subnetId": "subnet-2372be7b", "vpcId": "vpc-14400670", "privateIpAddress": "172.31.16.84", "publicIpAddress": "54.175.43.43", "stateReason": null, "architecture": "x86_64", "rootDeviceType": "ebs", "rootDeviceName": "/dev/xvda", "blockDeviceMappings": [{ "deviceName": "/dev/xvda", "ebs": { "volumeId": "vol-0a2d63a256bce35c5", "status": "attached", "attachTime": "2017-01-09T19:36:03.000Z", "deleteOnTermination": true } }], "virtualizationType": "hvm", "instanceLifecycle": null, "spotInstanceRequestId": null, "clientToken": "bIYqA1483990561516", "tags": [{ "key": "Name", "value": "value" }], "securityGroups": [{ "groupName": "example-security-group-2", "groupId": "sg-3f1fef43" }], "sourceDestCheck": true, "hypervisor": "xen", "networkInterfaces": [{ "networkInterfaceId": "eni-fde9493f", "subnetId": "subnet-2372be7b", "vpcId": "vpc-14400670", "description": "", "ownerId": "123456789012", "status": "in-use", "macAddress": "0e:36:a2:2d:c5:e0", "privateIpAddress": "172.31.16.84", "privateDnsName": "ip-172-31-16-84.ec2.internal", "sourceDestCheck": true, "groups": [{ "groupName": "example-security-group-2", "groupId": "sg-3f1fef43" }], "attachment": { "attachmentId": "eni-attach-85bd89d9", "deviceIndex": 0, "status": "attached", "attachTime": "2017-01-09T19:36:02.000Z", "deleteOnTermination": true }, "association": { "publicIp": "54.175.43.43", "publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com", "ipOwnerId": "amazon" }, "privateIpAddresses": [{ "privateIpAddress": "172.31.16.84", "privateDnsName": "ip-172-31-16-84.ec2.internal", "primary": true, "association": { "publicIp": "54.175.43.43", "publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com", "ipOwnerId": "amazon" } }] }], "iamInstanceProfile": null, "ebsOptimized": false, "sriovNetSupport": null, "enaSupport": true }, "supplementaryConfiguration": {}, "tags": {"Name": "value"}, "configurationItemVersion": "1.2", "configurationItemCaptureTime": "2017-01-09T22:50:14.328Z", "configurationStateId": 1484002214328, "awsAccountId": "123456789012", "configurationItemStatus": "OK", "resourceType": "AWS::EC2::Instance", "resourceId": "i-007d374c8912e3e90", "resourceName": null, "ARN": "arn:aws:ec2:us-east-2:123456789012:instance/i-007d374c8912e3e90", "awsRegion": "us-east-2", "availabilityZone": "us-east-2c", "configurationStateMd5Hash": "8d0f41750f5965e0071ae9be063ba306", "resourceCreationTime": "2017-01-09T20:13:28.000Z" }, "notificationCreationTime": "2017-01-09T22:50:15.928Z", "messageType": "ConfigurationItemChangeNotification", "recordVersion": "1.2" }, "Timestamp": "2017-01-09T22:50:16.358Z", "SignatureVersion": "1", "Signature": "lpJTEYOSr8fUbiaaRNw1ECawJFVoD7I67mIeEkfAWJkqvvpak1ULHLlC+I0sS/01A4P1Yci8GSK/cOEC/O2XBntlw4CAtbMUgTQvb345Z2YZwcpK0kPNi6v6N51DuZ/6DZA8EC+gVTNTO09xtNIH8aMlvqyvUSXuh278xayExC5yTRXEg+ikdZRd4QzS7obSK1kgRZWI6ipxPNL6rd56/VvPxyhcbS7Vm40/2+e0nVb3bjNHBxjQTXSs1Xhuc9eP2gEsC4Sl32bGqdeDU1Y4dFGukuzPYoHuEtDPh+GkLUq3KeiDAQshxAZLmOIRcQ7iJ/bELDJTN9AcX6lqlDZ79w==", "SigningCertURL": "https://sns.us-east-2.amazonaws.com/SimpleNotificationService-b95095beb82e8f6a046b3aafc7f4149a.pem", "UnsubscribeURL": "https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:123456789012:config-topic-ohio:956fe658-0ce3-4fb3-b409-a45f22a3c3d4" }

This notification contains the configuration item change for the EC2 security group, sg-3f1fef43, which is associated with the instance.

Copy
{ "Type": "Notification", "MessageId": "564d873e-711e-51a3-b48c-d7d064f65bf4", "TopicArn": "arn:aws:sns:us-east-2:123456789012:config-topic-ohio", "Subject": "[AWS Config:us-east-2] AWS::EC2::SecurityGroup sg-3f1fef43 Created in Account 123456789012", "Message": { "configurationItemDiff": { "changedProperties": {}, "changeType": "CREATE" }, "configurationItem": { "relatedEvents": ["e61e1419-7cb0-477f-8dde-bbfe27467a96"], "relationships": [{ "resourceId": "vpc-14400670", "resourceName": null, "resourceType": "AWS::EC2::VPC", "name": "Is contained in Vpc" }], "configuration": { "ownerId": "123456789012", "groupName": "example-security-group-2", "groupId": "sg-3f1fef43", "description": "This is an example security group.", "ipPermissions": [], "ipPermissionsEgress": [{ "ipProtocol": "-1", "fromPort": null, "toPort": null, "userIdGroupPairs": [], "ipRanges": ["0.0.0.0/0"], "prefixListIds": [] }], "vpcId": "vpc-14400670", "tags": [] }, "supplementaryConfiguration": {}, "tags": {}, "configurationItemVersion": "1.2", "configurationItemCaptureTime": "2017-01-09T22:50:15.156Z", "configurationStateId": 1484002215156, "awsAccountId": "123456789012", "configurationItemStatus": "ResourceDiscovered", "resourceType": "AWS::EC2::SecurityGroup", "resourceId": "sg-3f1fef43", "resourceName": null, "ARN": "arn:aws:ec2:us-east-2:123456789012:security-group/sg-3f1fef43", "awsRegion": "us-east-2", "availabilityZone": "Not Applicable", "configurationStateMd5Hash": "7399608745296f67f7fe1c9ca56d5205", "resourceCreationTime": null }, "notificationCreationTime": "2017-01-09T22:50:16.021Z", "messageType": "ConfigurationItemChangeNotification", "recordVersion": "1.2" }, "Timestamp": "2017-01-09T22:50:16.413Z", "SignatureVersion": "1", "Signature": "GocX31Uu/zNFo85hZqzsNy30skwmLnjPjj+UjaJzkih+dCP6gXYGQ0bK7uMzaLL2C/ibYOOsT7I/XY4NW6Amc5T46ydyHDjFRtQi8UfUQTqLXYRTnpOO/hyK9lMFfhUNs4NwQpmx3n3mYEMpLuMs8DCgeBmB3AQ+hXPhNuNuR3mJVgo25S8AqphN9O0okZ2MKNUQy8iJm/CVAx70TdnYsfUMZ24n88bUzAfiHGzc8QTthMdrFVUwXxa1h/7Zl8+A7BwoGmjo7W8CfLDVwaIQv1Uplgk3qd95Z0AXOzXVxNBQEi4k8axcknwjzpyO1g3rKzByiQttLUQwkgF33op9wg==", "SigningCertURL": "https://sns.us-east-2.amazonaws.com/SimpleNotificationService-b95095beb82e8f6a046b3aafc7f4149a.pem", "UnsubscribeURL": "https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:123456789012:config-topic-ohio:956fe658-0ce3-4fb3-b409-a45f22a3c3d4" }