Herion and welcome back now into this video at a high level, or we will be discussing about the AWB
config service.
Now, AWB config is primarily used to record the resource configuration changes over time.
Now, for example, let's see, in week one, you have a specific infrastructure.
You just have a set of two instance.
Now, in week two, what you decide to do, you decide to also have a load balancer that is integrated
with the C2 instance.
In week three, you have a new S3 bucket that they set up.
You have a new ideas database that is set up for your application.
So Eatables Config allows you to go ahead and record the resource configuration changes that are being
made over time.
Now, this is helpful in a lot of scenario.
Let's assume that you have an instance that is hosting a website from past 90 days and everything is
working perfectly well.
Now, suddenly from last one week, there are a lot of issues with the requests that are going to the
website.
Now, the question that comes is what exactly is modified now in case if you have a eatables config
IP infrastructure level, you can easily identify on what are the configuration changes that are being
made to the resources.
So this is one good use case with eatables configures extensively used second use case where Idalis
configures use is associated with the audit and compliance.
So EDNESS config comes with a large set of rules that can continuously monitor your environment and
report the finding.
For an example, let's say that you have a rule of approved EMI Idiz.
So now what idalis config will do any damage?
You see two instances launched if that is doing Stent's is not created from a specific EMI.
Let's say that you have a heightened security aimer that all the users are supposed to use and one developer
who decides to use some different EMI altogether.
Then with the eatables config audit, you can easily identify that.
So you have a one non-compliant resource so you can easily identify, which easy to understand, is
not launched from the approved.
And the second is cloud security will enable.
And there are multiple set of rules and these rules are continuously evaluated based on which a report
is and rightfully so.
Let's do one thing.
Let's go ahead and look into the things that we have discussed in a demo environment to understand things
in a better way.
So currently I am in the management console.
Let's go ahead and go to the config service.
So this is how the new database Convit console looks like now on the right hand side, you see that
there are multiple rules that are created like approved Ismailis, cloud security, enable year one
related to root MFA enabled or not, and many others.
So let's go ahead and quickly look into it.
So let's click on the approve it.
Maybe it will.
And yet if we look into the description, it states sticks with that running instances are using this
specified image and the imagery that we have added as part of the rule is in effect.
One, two, three, four, five.
So any easy to instance that is not running this specific, FEMA will be flagged by this rule.
So currently it states that there is one easy to instance here and the status is noncompliant.
That basically means this easy to instance, is not using this specific email.
Now, do not that established config comes with a lot of rules that you can go ahead and set.
So if I quickly do what I do, Gloria, there are multiple ways so you can have unmanaged rule, you
can create custom rule.
So for manage rule, you have access.
Again, there are a lot of rules you can go to and read a description, if you will.
See it goes into so many pages, AURIER.
So all of these are managed rules that will evaluate your results and will give you the compliance or
noncompliance report similar to what we have seen for the e-mail.
So that is what the audit and compliance is all about.
The primary one that we were discussing is associated with the resource configuration.
And this is where it config really works well.
So let me quickly show you here.
So let's quickly go to the resources here and from here you can go ahead and select the resource and
config will give you the configuration change, if there are any, for a specific resource.
So let me go ahead and copy the instance idea that we have currently running.
So this instance, it is the same one that was non-complying based on the config rule associated with
the emails.
So let's go ahead and open this instead.
So this basically gives you the description.
It also shows you that this specific instance is non-complying.
The one that we are interested right now is the resource timeline.
So from here, it basically gives you the events that have been made to this specific resource.
So, for example, let's open up the configuration changer.
So currently you had this specific configuration and there have been certain new configuration that
had been added here.
For example, let's say that you have a specific security group, so you're using the group names launch
of AZN.
However, in the new configuration, you see a new group was added.
So this group is named as KP LEPs hyphen firewall.
So a new security group was added a year.
So the same thing can be seen.
In fact, let me maximize it in case if this is difficult to read.
So if you see we're under the green, it states that this specific security group is associated here.
Now, you also have certain other configuration changes.
So on the left hand side, the configuration name was running.
On the right hand side, you see it was stopped.
Also on the left hand side, you see configuration, instant status, P2 micro.
On the right hand side it is configuration Instant Stavisky 2.0.
So there have been a lot of changes related to the configuration of instances that were done on the
instance that we were looking into.
And this is the instance idea in a similar way.
There was also a few configurations that were made at a later date.
So this was a 21 57 and this is at 22 00.
So let's look into what is the configuration that was done here.
So the instance was earlier stopped.
Now it is running Aurier, and since the instance was stopped, there was no public DNS name when instanced
was transition, a new set of public IP was assigned and the new set of public DNS name was also Azania.
And also 22, 04, again, you see the instance was stopped again, so earlier it was running.
So on the left side, it was running earlier with this public IP and then it was stopped and the DNS
name and other things were removed.
So this quickly allows you to identify on what was the change that was being made to a specific resource.
In this case, it is easy to instance.
Now, let me give you one more example for us to better understand it.
So under resource this time, let me go ahead and paste the idea associated with the security group.
So basically, I had modified the security group for today's demo.
So let's go ahead and look into the security group.
Let's go to the resource timeline here.
And yet it states that there are multiple configuration changes that have been made, one among them,
you see, is that there was a rule added on the right hand side, you would see a typical addition.
So a rule was added on board 22 on this idea of zero zero zero zero.
So someone has added a suicide spot to be allowed to the entire Internet at a later time.
One more rule was added.
You see the rule of 80 on CAGR of zero zero zero zero.
So someone was modifying the security group.
And we also know what was the exact change that was made to the security group.
So to establish config, it becomes much more easier to see the overall configuration change timeline
that had been made to a specific resource.
So these are the two primary use cases where eatables configures extensively used.
Along with this, you also have a feature of conformance back.
So this feature is basically a collection of eatables, config rules and remediation action that can
be easily deployed.
Now, as we're discussing, if you go to rules, let's click on Add a rule.
There are so many rules that are available so it becomes a little difficult if you want to go ahead
and understand each rule in detail to see what exactly does and achieve a specific use case.
Instead of doing that, what you can do is you can click on the conformance back.
Currently I have one conferment back besoin am that is deployed.
But if you look into the sample template associated with this data available, you have various things
like operational best practices, forestry.
If you go big down your operations, best practices for the BCP and disaster recovery.
Similarly for CIAs benchmark for Ekta instances and various other.
So instead of selecting each rule individually, you can select the entire conformance back.
So let's see if I select this conformance back.
This back in turn comes with a lot of rules that are associated with the best practices of PCI basis,
and then the Eatables config will give you the compliance and non-compliance report.
For example, if you look into the rules over here, if you see there are a lot of rules that are added,
Norwegian's things like router and hardware, MFA, route, account MFA, then you have the same route.
Access to all of these are coming from conformance back, though, only to manual rules that are added
in the cloud security and the approved e-mails.
Apart from that, all the others are coming from the conformance back that is enable.
The name that I have given locally is a template.
However, this intern is using the IAM related conformance back.
That's great.
So I hope at a high level overview you understood the benefits of eatables config for the use case of
the resource configuration change for the use case of audit and compliance, and also the importance
of the feature of conformance back.
Now let's quickly discuss the basics of pricing as well.
In fact, earlier the pricing of eatables config was very high and lot of organizations, they did not
really use idalis config, specifically the config rules.
However, it has now made a lot of changes to the pricing to make it more reasonable.
So depending upon the feature that you use as we are discussing config comes with a lot of features,
depending on the features that you use, the pricing also would change.
So basically you pay zero point zero zero three per configuration item recorded in your database account
bodies and do not config works at a reasonable level.
Then you also have a pricing based on rule evaluation.
So depending on the number of rules that you have added, a number of evaluation that takes place,
you have a pricing based on that and you are also charged by the conformance back evaluation in your
account in case if we have used that, that's great.
So that's the very high level overview about the benefits of the eatables config service.