I think it's better in any case to pull the config values from your actual live resources in some sort of read-only view.

This is the only way to be sure you're auditing what you think you're auditing, and it doesn't matter what kind of provisioning tool you've used.