CER-0135
By default, AWS Config can be set to record changes across all supported resource types, including those that change frequently, such as security group rules, IAM role policies, route tables, or network interfaces frequent ephemeral resources in containerized or auto-scaling setupsThese high-churn resources can generate an outsized number of configuration items and inflate costs — especially in dynamic or large-scale environments.
This inefficiency arises when recording is enabled indiscriminately across all resources without evaluating whether the data is necessary. Without targeted scoping, teams may incur large charges for configuration data that provides minimal value, especially in non-production environments.This can also obscure meaningful compliance signals by introducing noise
AWS Config charges based on:
The number of configuration items recorded per resource
The number of conformance pack evaluations
The number of rule evaluations
Recording costs scale with the volume of configuration changes, which varies significantly by resource type and environment volatility. This means billing can spike unexpectedly in dynamic environments. High-churn resources can generate large volumes of configuration items even if they are not relevant to compliance goals.
