Skip to content

AWS Config Commands

Query AWS Config rules and compliance state, and pull historical Config snapshots out of S3 into a flat CSV or JSON file you can analyze offline.

list-rules and show-rules describe the rules themselves; compliance-status and compliance-checker report on the resources those rules evaluate. download is the odd one out: it reads Config delivery files from an S3 bucket rather than calling the Config API.

Commands

awsconfig compliance-checker

Comprehensive AWS Config compliance checker for various resource types.

aws-cloud-utilities awsconfig compliance-checker [OPTIONS]
Option Value Description
--region TEXT AWS region to check compliance (default: current region)
--all-regions flag Check compliance across all regions
--resource-type TEXT Filter by specific AWS resource type (e.g., AWS::EC2::Instance)
--show-compliant flag Include compliant resources in the output
--show-details flag Show detailed resource information and rule descriptions
--output-file TEXT Output file for compliance report (supports .json, .yaml, .csv)

awsconfig compliance-status

Get compliance status summary across AWS Config rules and resources.

aws-cloud-utilities awsconfig compliance-status [OPTIONS]
Option Value Description
--region TEXT AWS region to check compliance status (default: current region)
--all-regions flag Check compliance status across all regions
--resource-type TEXT Filter by specific AWS resource type (e.g., AWS::EC2::Instance)
--compliance-type COMPLIANT | NON_COMPLIANT | NOT_APPLICABLE | INSUFFICIENT_DATA Filter by compliance type
--output-file TEXT Output file for compliance status (supports .json, .yaml, .csv)

awsconfig download

Download and process AWS Config files from S3 into CSV or JSON format.

aws-cloud-utilities awsconfig download [OPTIONS]
Option Value Description
--bucket TEXT Required. S3 bucket name containing AWS Config files
--prefix TEXT Required. S3 prefix for Config files
--start-date TEXT Required. Start date for download range (YYYY-MM-DD)
--end-date TEXT Required. End date for download range (YYYY-MM-DD)
--output-file TEXT Output CSV file name (default: config_data_.csv)
--region TEXT AWS region for S3 access (default: current region)
--format csv | json Output format (default: csv)
--keep-temp-files flag Keep downloaded temporary JSON files

awsconfig list-rules

List AWS Config rules with basic information.

aws-cloud-utilities awsconfig list-rules [OPTIONS]
Option Value Description
--region TEXT AWS region to list Config rules from (default: current region)
--all-regions flag List Config rules from all regions
--compliance-state COMPLIANT | NON_COMPLIANT | NOT_APPLICABLE | INSUFFICIENT_DATA Filter rules by compliance state
--output-file TEXT Output file for rules list (supports .json, .yaml, .csv)

awsconfig show-rules

Show AWS Config rules with compliance metrics and meaningful statistics.

aws-cloud-utilities awsconfig show-rules [OPTIONS]
Option Value Description
--region TEXT AWS region to analyze Config rules (default: current region)
--all-regions flag Analyze Config rules across all regions
--rule-name TEXT Specific Config rule to analyze
--include-metrics flag Include compliance metrics and statistics
--output-file TEXT Output file for rules analysis (supports .json, .yaml, .csv)

Examples

# Rules in the current region, and across every region
aws-cloud-utilities awsconfig list-rules
aws-cloud-utilities awsconfig list-rules --all-regions

# Only the rules currently reporting non-compliance
aws-cloud-utilities awsconfig list-rules --compliance-state NON_COMPLIANT

# Rule detail with compliance metrics
aws-cloud-utilities awsconfig show-rules --include-metrics
aws-cloud-utilities awsconfig show-rules --rule-name encrypted-volumes

# Compliance summary, filtered to one resource type
aws-cloud-utilities awsconfig compliance-status --resource-type AWS::EC2::Instance
aws-cloud-utilities awsconfig compliance-status --compliance-type NON_COMPLIANT --all-regions

# Full compliance sweep with resource-level detail, saved to a report
aws-cloud-utilities awsconfig compliance-checker --all-regions --show-details --output-file compliance.json

# Pull a date range of Config history out of S3 into CSV
aws-cloud-utilities awsconfig download \
    --bucket my-config-bucket \
    --prefix AWSLogs/123456789012/Config \
    --start-date 2026-07-01 \
    --end-date 2026-07-31 \
    --output-file config-july.csv

Notes

download requires --bucket, --prefix, --start-date, and --end-date. It streams objects to a temporary directory before flattening them; pass --keep-temp-files if you need the raw JSON too.

compliance-checker is the expensive one. It enumerates evaluations per rule per resource, so scope it with --resource-type before running it with --all-regions.