AWS Config compliance results plus the State Manager association list proving a defined configuration is actually applied and re-applied to every managed node — instances are under SSM management, and the associations that carry your baseline report COMPLIANT on a schedule rather than drifting
The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.
Fetch
$ aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-instance-managed-by-systems-manager --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-managedinstance-association-compliance-status-check --compliance-types NON_COMPLIANT$ aws ssm list-associations --query 'Associations[].{Name:Name,AssociationId:AssociationId,Schedule:ScheduleExpression,Targets:Targets,Status:Overview.Status,LastRun:LastExecutionDate}'Expected output
Two EvaluationResults arrays plus an Associations list. Empty NON_COMPLIANT sets mean every running EC2 instance has a running SSM Agent and every SSM association compliance record reads COMPLIANT after execution; the Associations list names the documents, schedules, and targets that carry the baseline, with Overview.Status and LastExecutionDate showing it ran. Managed rule identifiers: EC2_INSTANCE_MANAGED_BY_SSM (rule name ec2-instance-managed-by-systems-manager), EC2_MANAGEDINSTANCE_ASSOCIATION_COMPLIANCE_STATUS_CHECK
Map — what it proves
- recipe2
- recipe— an authored recipe collects evidence for this control
- KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
- orphan— no Key Security Indicator reaches it — a person writes it up instead
What else these families can fetch:CM 14/34 →
GovCloud
AWS Config and Systems Manager are available in AWS GovCloud (US); instance, document, and association ARNs use partition arn:aws-us-gov
Notes & assertions
The telemetry proves a configuration is being enforced and drift corrected — it does not prove the enforced content IS your approved baseline. That the association's SSM document encodes the hardened settings you baselined (CIS/STIG content, approved through your change process) is the human judgement half; keep the document version and its approval record alongside this output. Two limits to state plainly: EC2_INSTANCE_MANAGED_BY_SSM does not flag a stopped instance whose agent is running, and this whole recipe is EC2-only — container images, Lambda, and managed-service settings need their own baseline evidence. CM-08 inventory is a separate recipe, not this one.
References
- AWS Config managed rule: ec2-instance-managed-by-systems-manager https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-managed-by-systems-manager.html
- AWS Config managed rule: ec2-managedinstance-association-compliance-status-check https://docs.aws.amazon.com/config/latest/developerguide/ec2-managedinstance-association-compliance-status-check.html
- AWS Systems Manager State Manager (associations define the state to maintain) https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-state.html
- AWS CLI: ssm list-associations https://docs.aws.amazon.com/cli/latest/reference/ssm/list-associations.html
This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.
The Service Configuration run (10)
- automatable
- partial — needs judgement
- narrative — no API proves this
Every authored recipe filed under SVC, in the order the plan works them. The mark says how much of the evidence the command produces on its own.
- partialAWS Config compliance results across the storage services proving customer data is encrypted at rest — S3 buckets with default server-side encryption, EBS volumes encrypted, and RDS storage encrypted, all backed by KMScontinuousconfig-encryption-at-restAWS Config · Amazon S3 · Amazon EBS · Amazon RDS · AWS KMS
- partialAWS Config compliance results proving data in transit is protected by TLS — S3 bucket policies denying non-TLS requests, load-balancer listeners restricted to SSL/HTTPS, and Redshift clusters requiring SSLcontinuousconfig-encryption-in-transitAWS Config · Amazon S3 · Elastic Load Balancing · Amazon Redshift
- partialAWS Config compliance results proving KMS customer-managed keys are lifecycle-managed — automatic annual rotation enabled and no active key scheduled for deletion — the key-hygiene half of the cryptographic-protection controlcontinuousconfig-kms-key-managementAWS Config · AWS KMS
- partialAWS Config compliance results plus the State Manager association list proving a defined configuration is actually applied and re-applied to every managed node — instances are under SSM management, and the associations that carry your baseline report COMPLIANT on a schedule rather than driftingyou are herecontinuousssm-configuration-baseline-enforcedAWS Config · AWS Systems Manager
- partialCryptographic proof that the audit trail CloudTrail delivered has not been altered or deleted, plus the compliance state of the write-once controls that make stored records and container images tamper-evidentweeklyintegrity-verification-and-immutabilityAWS CloudTrail · AWS Config · Amazon S3 · AWS Backup · Amazon ECR
- partialDNSSEC signing status of every public hosted zone, with the key-signing key state and the DS record that carries the chain of trust to the parentweeklyroute53-dnssec-signingAmazon Route 53 · AWS KMS
- partialPer-VPC DNSSEC validation status of the Route 53 Resolver, joined against the full VPC inventory so that a VPC which never enabled validation is visible rather than absentweeklyroute53-resolver-dnssec-validationAmazon Route 53 · Amazon VPC
- partialEvery place a client session terminates, with the protocol and negotiated policy it terminates under: listener protocol and SslPolicy on each load balancer, HTTP listeners that redirect rather than serve, an ACM certificate behind each one, and CloudFront viewer policies that refuse plain HTTPquarterlysession-authenticity-tls-terminationElastic Load Balancing · Amazon CloudFront · AWS Certificate Manager · AWS Config
- partialThe hosted zones that serve name resolution, each marked private or public so internal and external resolution can be shown to be served by separate zones, and the Resolver endpoints that carry queries across the VPC boundary with their direction and operational statuscontinuousname-resolution-role-separationAmazon Route 53 · Amazon Route 53 Resolver
- partialWhether secret scanning, push protection and validity checking are switched on in this organization and which repositories those settings actually reach, together with the alerts themselves — each carrying the kind of credential found, whether the credential was confirmed to still work, how it was closed and by whom, and whether a push containing it was blocked or waved through. The settings are the population; the alerts are what was found in it, and an alert list read without the settings beside it cannot be told apart from a list produced by scanning nothing.continuoussecret-exposure-detection-and-push-protectionGitHub secret scanning · GitHub code security configurations