Explanation
By default, AWS Config is enabled in continuous recording mode. While this may be justified for production workloads where detailed auditability is critical, it is rarely necessary in non-production environments. Frequent changes in development or testing environments - such as redeploying Lambda functions, ECS tasks, or EC2 instances - generate large volumes of CIRs. This results in disproportionately high costs with minimal benefit to governance or compliance. Switching non-production environments to daily recording reduces CIR volume significantly while maintaining sufficient visibility for tracking changes.
Relevant Billing Model
AWS Config charges per Configuration Item Recorded (CIR). Continuous mode generates a CIR for every resource change, while daily mode generates a maximum of one CIR per resource per day. In non-production environments with frequent deployments or updates, continuous mode creates unnecessary cost without meaningful compliance value.
Detection
- Review whether AWS Config is set to continuous recording in non-production accounts or environments
- Evaluate change frequency in development, QA, and staging systems to estimate unnecessary CIR volume
- Confirm whether governance or compliance requirements justify continuous recording in these environments
- Assess consistency of recording settings across production vs. non-production accounts
Remediation
- Update AWS Config settings in non-production accounts to daily recording frequency instead of continuous
- Apply environment-specific configuration baselines to enforce lower granularity tracking outside of production
- Validate that compliance and auditing needs remain satisfied after reducing recording frequency