AWS Config now supports 191 additional managed rules - devamazonaws.blogspot.com

AWS Config now supports 191 additional managed rules across key services including Amazon Bedrock, Amazon SageMaker, Amazon ECS, Amazon EKS, Amazon RDS, Amazon Redshift, Amazon S3, and Amazon CloudTrail. This expansion increases built-in governance coverage across AI workloads and core cloud infrastructure. Examples of the new managed rules include evaluating resource configurations for encryption, logging, public access, network security, data protection, and other operational best practices across AWS services. 

With this launch, you can deploy these new managed rules individually or as part of a conformance pack in the AWS Regions where the corresponding AWS services are available. 

 

AWS Certificate Manager 

  • ACM_CERTIFICATE_RSA_CHECK  

Amazon API Gateway 

  • API_GWV2_ACCESS_LOGS_ENABLED  

AWS AppSync 

  • APPSYNC_AUTHORIZATION_CHECK  

  • APPSYNC_LOGGING_ENABLED  

Amazon Athena 

  • ATHENA_WORKGROUP_ENCRYPTED_AT_REST  

  • ATHENA_WORKGROUP_LOGGING_ENABLED  

Amazon Aurora 

  • AURORA_MYSQL_CLUSTER_AUDIT_LOGGING  

Amazon Bedrock 

  • BEDROCKAGENTCORE_BROWSERCUSTOM_NETWORK_MODE_NOT_PUBLIC  

  • BEDROCKAGENTCORE_BROWSERCUSTOM_RECORDING_ENABLED  

  • BEDROCKAGENTCORE_CODEINTERPRETER_NETWORKMODE_CHECK  

  • BEDROCKAGENTCORE_GATEWAY_AUTHORIZER_ENABLED  

  • BEDROCKAGENTCORE_GATEWAY_ENCRYPTION_ENABLED  

  • BEDROCKAGENTCORE_RUNTIME_PRIVATE_NETWORK_REQUIRED  

  • BEDROCK_AGENTCORE_MEMORY_ENCRYPTION_ENABLED  

  • BEDROCK_AGENTCORE_MEMORY_EVENT_EXPIRY_DURATION  

  • BEDROCK_DATA_SOURCE_ENCRYPTION_ENABLED  

AWS CloudFormation 

  • CLOUDFORMATION_STACK_SERVICE_ROLE_CHECK  

  • CLOUDFORMATION_TERMINATION_PROTECTION_CHECK  

AWS CloudTrail 

  • CLOUDTRAIL_ALL_READ_S3_DATA_EVENT_CHECK  

  • CLOUDTRAIL_ALL_WRITE_S3_DATA_EVENT_CHECK  

  • CLOUDTRAIL_S3_BUCKET_ACCESS_LOGGING  

  • CLOUDTRAIL_S3_BUCKET_PUBLIC_ACCESS_PROHIBITED  

  • EVENT_DATA_STORE_CMK_ENCRYPTION_ENABLED  

Amazon CloudWatch 

  • CLOUDWATCH_ALARM_ACTION_ENABLED_CHECK  

Amazon Cognito 

  • COGNITO_IDENTITY_POOL_UNAUTH_ACCESS_CHECK  

  • COGNITO_USERPOOL_CUST_AUTH_THREAT_FULL_CHECK  

  • COGNITO_USER_POOL_ADVANCED_SECURITY_ENABLED  

  • COGNITO_USER_POOL_MFA_ENABLED  

  • COGNITO_USER_POOL_PASSWORD_POLICY_CHECK  

AWS CodeBuild 

  • CODEBUILD_PROJECT_ARTIFACT_ENCRYPTION  

  • CODEBUILD_PROJECT_ENVIRONMENT_PRIVILEGED_CHECK  

  • CODEBUILD_PROJECT_LOGGING_ENABLED  

  • CODEBUILD_PROJECT_S3_LOGS_ENCRYPTED  

AWS DataSync 

  • DATASYNC_TASK_LOGGING_ENABLED  

AWS Database Migration Service (DMS) 

  • DMS_REPLICATION_TASK_SOURCEDB_LOGGING  

  • DMS_REPLICATION_TASK_TARGETDB_LOGGING  

Amazon DocumentDB 

  • DOCDB_CLUSTER_AUDIT_LOGGING_ENABLED  

  • DOCDB_CLUSTER_DELETION_PROTECTION_ENABLED  

  • DOCDB_CLUSTER_ENCRYPTED_IN_TRANSIT  

  • DOCDB_CLUSTER_SNAPSHOT_PUBLIC_PROHIBITED  

Amazon DynamoDB 

  • DYNAMODB_TABLE_DELETION_PROTECTION_ENABLED  

Amazon EC2 

  • EC2_ENIS_SOURCE_DESTINATION_CHECK_ENABLED  

  • EC2_INSTANCE_LAUNCHED_WITH_ALLOWED_AMI  

  • EC2_LAUNCH_TEMPLATES_EBS_VOLUME_ENCRYPTED  

  • EC2_LAUNCH_TEMPLATE_IMDSV2_CHECK  

  • EC2_LAUNCH_TEMPLATE_PUBLIC_IP_DISABLED  

  • EC2_SECURITY_GROUP_ATTACHED_TO_ENI  

  • EC2_SPOT_FLEET_REQUEST_CT_ENCRYPTION_AT_REST  

  • EC2_STOPPED_INSTANCE_DAYS_CHECK_PVT  

  • EC2_TRANSIT_GATEWAY_AUTO_VPC_ATTACH_DISABLED  

  • EC2_VPN_CONNECTION_IKE_VERSION_CHECK  

  • EC2_VPN_CONNECTION_LOGGING_ENABLED  

  • INSTANCES_IN_VPC  

Amazon EC2 Auto Scaling 

  • AUTOSCALING_LAUNCH_TEMPLATE  

  • AUTOSCALING_MULTIPLE_AZ  

  • AUTOSCALING_MULTIPLE_INSTANCE_TYPES  

Amazon ECR 

  • ECR_PRIVATE_IMAGE_SCANNING_ENABLED  

  • ECR_PRIVATE_LIFECYCLE_POLICY_CONFIGURED  

  • ECR_PRIVATE_TAG_IMMUTABILITY_ENABLED  

  • ECR_REPOSITORY_CMK_ENCRYPTION_ENABLED  

Amazon ECS 

  • ECS_CONTAINERS_NONPRIVILEGED  

  • ECS_CONTAINERS_READONLY_ACCESS  

  • ECS_CONTAINER_INSIGHTS_ENABLED  

  • ECS_FARGATE_LATEST_PLATFORM_VERSION  

  • ECS_NO_ENVIRONMENT_SECRETS  

  • ECS_TASK_DEFINITION_EFS_ENCRYPTION_ENABLED  

  • ECS_TASK_DEFINITION_LINUX_USER_NON_ROOT  

  • ECS_TASK_DEFINITION_LOG_CONFIGURATION  

  • ECS_TASK_DEFINITION_NETWORK_MODE_NOT_HOST  

  • ECS_TASK_DEFINITION_PID_MODE_CHECK  

  • ECS_TASK_DEFINITION_USER_FOR_HOST_MODE_CHECK  

  • ECS_TASK_DEFINITION_WINDOWS_USER_NON_ADMIN  

Amazon EFS 

  • EFS_ACCESS_POINT_ENFORCE_ROOT_DIRECTORY  

  • EFS_ACCESS_POINT_ENFORCE_USER_IDENTITY  

  • EFS_AUTOMATIC_BACKUPS_ENABLED  

  • EFS_FILESYSTEM_CT_ENCRYPTED  

  • EFS_MOUNT_TARGET_PUBLIC_ACCESSIBLE  

Amazon EKS 

  • EKS_NODEGROUP_SUPPORTED_VERSION_CHECK  

AWS Elastic Beanstalk  

  • BEANSTALK_ENHANCED_HEALTH_REPORTING_ENABLED 

Amazon ElastiCache 

  • ELASTICACHE_AUTOMATIC_BACKUP_CHECK_ENABLED  

  • ELASTICACHE_AUTO_MINOR_VERSION_UPGRADE_CHECK  

  • ELASTICACHE_REPL_GRP_AUTO_FAILOVER_ENABLED  

  • ELASTICACHE_REPL_GRP_ENCRYPTED_AT_REST  

  • ELASTICACHE_SUBNET_GROUP_CHECK  

  • ELASTICACHE_SUPPORTED_ENGINE_VERSION  

Elastic Load Balancing 

  • ALB_DESYNC_MODE_CHECK  

  • CLB_DESYNC_MODE_CHECK  

  • CLB_MULTIPLE_AZ  

  • ELBV2_LISTENER_ENCRYPTION_IN_TRANSIT  

  • ELBV2_MULTIPLE_AZ  

  • ELBV2_PREDEFINED_SECURITY_POLICY_SSL_CHECK  

  • NLB_CROSS_ZONE_LOAD_BALANCING_ENABLED  

Amazon EMR 

  • EMR_BLOCK_PUBLIC_ACCESS  

Amazon EventBridge 

  • CUSTOM_EVENTBUS_POLICY_ATTACHED  

Amazon FSx 

  • FSX_LUSTRE_COPY_TAGS_TO_BACKUPS  

  • FSX_OPENZFS_COPY_TAGS_ENABLED  

  • FSX_OPENZFS_DEPLOYMENT_TYPE_CHECK  

  • FSX_WINDOWS_AUDIT_LOG_CONFIGURED  

  • FSX_WINDOWS_DEPLOYMENT_TYPE_CHECK  

AWS Glue 

  • GLUE_ML_TRANSFORM_ENCRYPTED_AT_REST  

Amazon GuardDuty 

  • GUARDDUTY_ECS_PROTECTION_RUNTIME_ENABLED  

  • GUARDDUTY_EKS_PROTECTION_AUDIT_ENABLED  

  • GUARDDUTY_LAMBDA_PROTECTION_ENABLED  

  • GUARDDUTY_MALWARE_PROTECTION_ENABLED  

  • GUARDDUTY_RUNTIME_MONITORING_ENABLED  

  • GUARDDUTY_S3_PROTECTION_ENABLED  

IAM 

  • IAM_EXTERNAL_ACCESS_ANALYZER_ENABLED  

  • IAM_SERVER_CERTIFICATE_EXPIRATION_CHECK  

Amazon Kendra 

  • KENDRA_INDEX_TAGGED  

Amazon Kinesis 

  • KINESIS_FIREHOSE_DELIVERY_STREAM_ENCRYPTED  

  • KINESIS_STREAM_BACKUP_RETENTION_CHECK  

  • KINESIS_STREAM_ENCRYPTED  

AWS KMS 

  • KMS_KEY_POLICY_NO_PUBLIC_ACCESS  

AWS Lambda 

  • LAMBDA_FUNCTION_XRAY_ENABLED  

  • LAMBDA_VPC_MULTI_AZ_CHECK  

Amazon Neptune 

  • NEPTUNE_CLUSTER_BACKUP_RETENTION_CHECK  

  • NEPTUNE_CLUSTER_COPY_TAGS_TO_SNAPSHOT_ENABLED  

  • NEPTUNE_CLUSTER_DELETION_PROTECTION_ENABLED  

  • NEPTUNE_CLUSTER_ENCRYPTED  

  • NEPTUNE_CLUSTER_IAM_DATABASE_AUTHENTICATION  

  • NEPTUNE_CLUSTER_MULTI_AZ_ENABLED  

  • NEPTUNE_CLUSTER_SNAPSHOT_ENCRYPTED  

  • NEPTUNE_CLUSTER_SNAPSHOT_PUBLIC_PROHIBITED  

AWS Network Firewall 

  • NETFW_LOGGING_ENABLED  

  • NETFW_SUBNET_CHANGE_PROTECTION_ENABLED  

Amazon OpenSearch Service 

  • OPENSEARCH_ENCRYPTED_AT_REST  

  • OPENSEARCH_HTTPS_REQUIRED  

  • OPENSEARCH_NODE_TO_NODE_ENCRYPTION_CHECK  

Amazon RDS 

  • MARIADB_PUBLISH_LOGS_TO_CLOUDWATCH_LOGS  

  • RDS_AURORA_MYSQL_AUDIT_LOGGING_ENABLED  

  • RDS_AURORA_POSTGRESQL_LOGS_TO_CLOUDWATCH  

  • RDS_CLUSTER_DEFAULT_ADMIN_CHECK  

  • RDS_CLUSTER_ENCRYPTED_AT_REST  

  • RDS_GLOBAL_CLUSTER_AURORA_POSTGRESQL_SUPPORTED_VERSION  

  • RDS_INSTANCE_DEFAULT_ADMIN_CHECK  

  • RDS_INSTANCE_SUBNET_IGW_CHECK  

  • RDS_MARIADB_INSTANCE_ENCRYPTED_IN_TRANSIT  

  • RDS_MYSQL_INSTANCE_ENCRYPTED_IN_TRANSIT  

  • RDS_PGSQL_CLUSTER_COPY_TAGS_TO_SNAPSHOT_CHECK  

  • RDS_POSTGRESQL_LOGS_TO_CLOUDWATCH  

  • RDS_POSTGRES_INSTANCE_ENCRYPTED_IN_TRANSIT  

  • RDS_PROXY_TLS_ENCRYPTION  

  • RDS_SNAPSHOT_ENCRYPTED 

  • RDS_SQLSERVER_ENCRYPTED_IN_TRANSIT  

  • RDS_SQL_SERVER_LOGS_TO_CLOUDWATCH  

Amazon Redshift 

  • REDSHIFT_CLUSTER_MULTI_AZ_ENABLED  

  • REDSHIFT_CLUSTER_SUBNET_GROUP_MULTI_AZ  

  • REDSHIFT_DEFAULT_ADMIN_CHECK  

  • REDSHIFT_SERVERLESS_DEFAULT_ADMIN_CHECK  

  • REDSHIFT_SERVERLESS_NAMESPACE_CMK_ENCRYPTION  

  • REDSHIFT_SERVERLESS_PUBLISH_LOGS_TO_CLOUDWATCH  

  • REDSHIFT_SERVERLESS_WORKGROUP_ENCRYPTED_IN_TRANSIT  

  • REDSHIFT_SERVERLESS_WORKGROUP_NO_PUBLIC_ACCESS  

  • REDSHIFT_SERVERLESS_WORKGROUP_ROUTES_WITHIN_VPC  

  • REDSHIFT_UNRESTRICTED_PORT_ACCESS  

Amazon S3 

  • S3_ACCESS_POINT_IN_VPC_ONLY  

  • S3_ACCESS_POINT_PUBLIC_ACCESS_BLOCKS  

  • S3_BUCKET_ACL_PROHIBITED  

  • S3_BUCKET_CROSS_REGION_REPLICATION_ENABLED  

  • S3_BUCKET_MFA_DELETE_ENABLED  

  • S3_EVENT_NOTIFICATIONS_ENABLED  

  • S3_LIFECYCLE_POLICY_CHECK  

  • S3_VERSION_LIFECYCLE_POLICY_CHECK  

Amazon SageMaker 

  • SAGEMAKER_ENDPOINT_CONFIG_KMS_KEY_REQUIRED  

  • SAGEMAKER_FEATUREGROUP_ENCRYPTION_AT_REST  

  • SAGEMAKER_FEATUREGROUP_ONLINE_STORE_ENCRYPTION  

  • SAGEMAKER_INF_EXPERIMENT_DATA_STORAGE_KMS_ENCRYPTED  

  • SAGEMAKER_INF_EXPERIMENT_INSTANCE_STORAGE_KMS_ENCRYPTED  

  • SAGEMAKER_MODEL_EXPLAINABILITY_JOB_NETWORK_ISOLATION  

  • SAGEMAKER_MODEL_MULTICONTAINER_PRIVATE_REGISTRY  

  • SAGEMAKER_MODEL_PRIVATE_REGISTRY_REQUIRED  

  • SAGEMAKER_MODEL_QUALITY_JOB_DEFINITION_ISOLATION  

  • SAGEMAKER_MONITORING_SCHEDULE_TRAFFIC_ENCRYPTION  

  • SAGEMAKER_NOTEBOOK_INSTANCE_INSIDE_VPC  

  • SAGEMAKER_NOTEBOOK_INSTANCE_ROOT_ACCESS_CHECK  

  • SAGEMAKER_NOTEBOOK_INSTANCE_STORAGE_VOL_KMS_ENCRYPTED  

AWS Account Management 

  • SECURITY_ACCOUNT_INFORMATION_PROVIDED  

Amazon SNS 

  • SNS_TOPIC_MESSAGE_DELIVERY_NOTIFICATION_ENABLED  

  • SNS_TOPIC_NO_PUBLIC_ACCESS  

Amazon SQS 

  • SQS_QUEUE_DLQ_CHECK  

  • SQS_QUEUE_NO_PUBLIC_ACCESS  

  • SQS_QUEUE_POLICY_FULL_ACCESS_CHECK  

AWS Systems Manager 

  • SSM_AUTOMATION_BLOCK_PUBLIC_SHARING  

  • SSM_AUTOMATION_LOGGING_ENABLED  

AWS Transfer Family 

  • TRANSFER_CONNECTOR_LOGGING_ENABLED  

Amazon VPC 

  • NACL_NO_UNRESTRICTED_SSH_RDP  

  • VPC_ENDPOINT_ENABLED  

  • VPC_PEERING_DNS_RESOLUTION_CHECK  

  • VPC_SG_PORT_RESTRICTION_CHECK  

AWS WAF 

  • WAFV2_RULEGROUP_LOGGING_ENABLED  

  • WAFV2_WEBACL_NOT_EMPTY 

Post Updated on July 9, 2026 at 01:00PM

Comments

Post a Comment

Popular posts from this blog

[MS] Pulling a single item from a C++ parameter pack by its index, remarks - devamazonaws.blogspot.com

In my earlier discussion of pulling a single item from a C++ parameter pack by its index , I noted that with the Pack Indexing proposal, you would be able to write this to pull an item from a parameter pack while preserving its reference category. template<int index, typename...Args> void example(Args&&... args) { auto&& arg = (Args...[index]&&)args...[index]; using Arg = Args...[index]&&; } Why did I need to apply the (Args...[index]&&) cast ? Why can't I just write this: auto&& arg = args...[index]; or possibly decltype(auto) arg = args...[index]; Well, when you write the name of a variable, the result is an lvalue reference, even if the variable is an rvalue reference . Watch: struct S { S(S&); // construct from lvalue S(S&&); // construct from rvalue }; void whathappens(S&& s) { S t = s; // which will it use? } Try it out in your favorite compiler. This code construc...
Read more

[MS] Boosting Azure DevOps Security with GHAS Code Scanning - devamazonaws.blogspot.com

Image
Debjyoti Ganguly shares insights on the security benefits and configuration of GHAS Code Scanning with Azure DevOps. Boosting Azure DevOps Security with GHAS Code Scanning Code scanning, a pipeline-based tool available in GitHub Advanced Security, is designed to detect code vulnerabilities and bugs within the source code of ADO (Azure DevOps) repositories. Utilizing CodeQL as a static analysis tool, it performs query analysis and variant analysis. When vulnerabilities are found, it generates security alerts. CodeQL CodeQL is a powerful static analysis tool used for showing vulnerabilities and bugs in source code. It enables developers to write custom queries that analyze codebases, searching for specific patterns and potential security issues. By converting code into a database format, CodeQL allows for sophisticated, database-like queries to detect flaws. CodeQL in Action 1. Preparing the Code Create a CodeQL Database : Extract and structure the code into a database for analy...
Read more

[MS] How can I check that all the changes in a git branch have been cherry-picked or rebased into its upstream branch? - devamazonaws.blogspot.com

If you try to delete a branch that contains changes that haven't been merged to its upstream, git warns you, the branch is not fully merged. If you are sure you want to delete it, run 'git branch -D xxx' . Suppose you want to check that all of the changes in the branch have been cherry-picked or rebased into the upstream branch. How can you confirm this? How can you do the "If you are sure" step? One way to do this is to merge the branch into its upstream and see if the result produces any changes. # Detach the HEAD from the upstream so we can do some tinkering. $ git checkout --detach featurebranch{@u} # Propose a merge of the feature branch. $ git merge featurebranch $ ⟦ resolve any merge conflicts and commit ⟧ # See if anything would have changed. $ git diff HEAD HEAD~1 # Return to original branch, abandon detached HEAD. $ git checkout - If the git diff produces no output, then everything in your featurebranch is already present in the upstream, so you ...
Read more