You are correct that AWS Config is limited in terms of the resources and services it covers. But it’s also a trustworthy first party service.

Do we get the source code for everything in your package?

Do we at least get object code that we can run behind our “firewall” that doesn’t reach out to your servers, and thus risk exposing sensitive information?

Or are you selling a third-party service that collects all the most sensitive information it can possibly collect about our services, and then stores all that collected information in an opaque database somewhere that we have no direct access to and no control of? What happens when there is a breach in your systems and all your records of all your customers are exposed?