AWS Config

Beta

Beta release

This source is currently in beta. It works end to end, but you may still hit rough edges. Let us know if you do.

Let AI connect your sources for you

Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog.

Learn more

Connect AWS Config to PostHog to sync your data into the PostHog data warehouse for analysis and modeling.

Sync resource configurations and their history, rules, compliance status and evaluation results, conformance packs, remediation executions, proactive evaluations, and aggregated resources from one AWS region.

Grant these IAM permissions for the tables you want to sync:

config:SelectResourceConfig
config:DescribeConfigRules
config:DescribeComplianceByConfigRule
config:GetComplianceDetailsByConfigRule
config:DescribeConformancePacks
config:ListConformancePackComplianceScores
config:DescribeConfigurationAggregators and config:SelectAggregateResourceConfig
config:SelectResourceConfig and config:GetResourceConfigHistory
config:DescribeConformancePacks and config:GetConformancePackComplianceDetails
config:DescribeConfigRules and config:DescribeRemediationExecutionStatus
config:ListResourceEvaluations

Enable an AWS Config recorder for resource inventory. The resources table contains current configurations and excludes deleted resources. The aggregated resources table reads every configuration aggregator in the selected region. The resource configuration history table reads the history of each current resource. A full refresh or a first incremental sync reads the last 90 days. Add a session token if you use temporary credentials. Replace temporary credentials when they expire.

Configuration

Option	Description
`AWS access key ID` Type: text Required: True
`AWS secret access key` Type: password Required: True
`AWS session token` Type: password Required: False
`AWS region` Type: text Required: False	Defaults to us-east-1. Only the selected region is synced.

Linking AWS Config to PostHog

Go to the Data pipeline page in PostHog
Click New source and select AWS Config
Fill in the required configuration fields
Click Next, select the tables you want to sync, and then press Import

Supported tables

Table	Description	Sync method	Incremental field	Primary key
`resources`	Current configurations of recorded resources in the selected region. Excludes deleted resources.	Full refresh	—	—
`config_rules`	AWS Config rules, their evaluation settings, and resource scopes.	Full refresh	—	—
`rule_compliance`	Current compliance status and counts of noncompliant resources for each rule.	Full refresh	—	—
`conformance_packs`	Conformance packs and their deployment settings in the selected region.	Full refresh	—	—
`conformance_pack_compliance_scores`	Percentage of compliant rule and resource combinations in each conformance pack.	Full refresh	—	—
`rule_evaluation_results`	Latest evaluation result for each resource that each AWS Config rule evaluated.	Full refresh	—	—
`aggregated_resources`	Current configurations of resources across the accounts and regions of each configuration aggregator in the selected region.	Full refresh	—	—
`resource_config_history`	Configuration items recorded for each current resource in the selected region. Without a saved incremental value, the table reads the last 90 days.	Incremental, Full refresh	configuration_item_capture_time	—
`conformance_pack_evaluation_results`	Latest evaluation result for each rule and resource in each conformance pack.	Full refresh	—	—
`remediation_execution_statuses`	State and step details of the latest remediation execution for each resource and rule.	Full refresh	—	—
`resource_evaluations`	Proactive evaluations of resource configurations, usually run before deployment.	Incremental, Full refresh	evaluation_start_timestamp	—