Security Group
SSH (port 22) open to 0.0.0.0/0

AWS Config Recorder
Tracks configuration

AWS Config Managed Rule
(restricted-ssh or INCOMING_SSH_DISABLED)
Checks Security Group

AWS Config Evaluation
Marks SG as Compliant or Non-Compliant

Findings Stored
In S3 bucket and shown in AWS Console