AWS config documentation change
Summary
Added multiple new AWS Config managed rules across various services including ECR encryption, ELB security policies, GuardDuty monitoring, network firewall protections, SQS access controls, and logging features
Security assessment
The changes add documentation for new security-focused managed rules related to encryption (CMK), access controls (SQS public access), runtime protection (GuardDuty), network protections, and logging requirements. While these are security features, there is no evidence in the diff of addressing specific vulnerabilities or security incidents.
Diff
diff --git a/config/latest/developerguide/managing-rules-by-region-availability.md index ce1eb7a86..c25552ea0 100644 --- a/config/latest/developerguide/managing-rules-by-region-availability.md +++ b/config/latest/developerguide/managing-rules-by-region-availability.md @@ -442,0 +443,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html) + @@ -546,0 +549,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [elbv2-predefined-security-policy-ssl-check](./elbv2-predefined-security-policy-ssl-check.html) + @@ -624,0 +629,6 @@ AWS Config currently supports the following managed rules. Before using these ru + * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html) + + * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html) + + * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html) + @@ -638,0 +649,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html) + @@ -788,0 +801,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html) + @@ -1000,0 +1015,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sqs-queue-no-public-access](./sqs-queue-no-public-access.html) + @@ -1022,0 +1039,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [transfer-connector-logging-enabled](./transfer-connector-logging-enabled.html) + @@ -1375,0 +1394,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [connect-instance-logging-enabled](./connect-instance-logging-enabled.html) + @@ -1543,0 +1564,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html) + @@ -1647,0 +1670,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [elbv2-predefined-security-policy-ssl-check](./elbv2-predefined-security-policy-ssl-check.html) + @@ -1725,0 +1750,6 @@ AWS Config currently supports the following managed rules. Before using these ru + * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html) + + * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html) + + * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html) + @@ -1739,0 +1770,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html) + @@ -1913,0 +1946,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html) + @@ -2135,0 +2170,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sqs-queue-no-public-access](./sqs-queue-no-public-access.html) + @@ -2157,0 +2194,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [transfer-connector-logging-enabled](./transfer-connector-logging-enabled.html) + @@ -2626,0 +2665,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html) + @@ -2730,0 +2771,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [elbv2-predefined-security-policy-ssl-check](./elbv2-predefined-security-policy-ssl-check.html) + @@ -2788,0 +2831,6 @@ AWS Config currently supports the following managed rules. Before using these ru + * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html) + + * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html) + + * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html) + @@ -2802,0 +2851,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html) + @@ -2932,0 +2983,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html) + @@ -3144,0 +3197,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sqs-queue-no-public-access](./sqs-queue-no-public-access.html) + @@ -3166,0 +3221,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [transfer-connector-logging-enabled](./transfer-connector-logging-enabled.html) + @@ -3489,0 +3546,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [connect-instance-logging-enabled](./connect-instance-logging-enabled.html) + @@ -3657,0 +3716,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html) + @@ -3761,0 +3822,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [elbv2-predefined-security-policy-ssl-check](./elbv2-predefined-security-policy-ssl-check.html) + @@ -3839,0 +3902,6 @@ AWS Config currently supports the following managed rules. Before using these ru + * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html) + + * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html) + + * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html) + @@ -3853,0 +3922,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html) + @@ -4025,0 +4096,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html) + @@ -4241,0 +4314,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sqs-queue-no-public-access](./sqs-queue-no-public-access.html) + @@ -4263,0 +4338,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [transfer-connector-logging-enabled](./transfer-connector-logging-enabled.html) + @@ -4550,0 +4627,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [connect-instance-logging-enabled](./connect-instance-logging-enabled.html) + @@ -4684,0 +4763,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html) + @@ -4786,0 +4867,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [elbv2-predefined-security-policy-ssl-check](./elbv2-predefined-security-policy-ssl-check.html) + @@ -4840,0 +4923,6 @@ AWS Config currently supports the following managed rules. Before using these ru + * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html) + + * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html) + + * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html) + @@ -4854,0 +4943,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html) + @@ -4976,0 +5067,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html) + @@ -5184,0 +5277,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sqs-queue-no-public-access](./sqs-queue-no-public-access.html) + @@ -5206,0 +5301,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [transfer-connector-logging-enabled](./transfer-connector-logging-enabled.html) + @@ -5661,0 +5758,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html) + @@ -5765,0 +5864,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [elbv2-predefined-security-policy-ssl-check](./elbv2-predefined-security-policy-ssl-check.html) + @@ -5821,0 +5922,6 @@ AWS Config currently supports the following managed rules. Before using these ru + * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html) + + * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html) + + * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html) + @@ -5835,0 +5942,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html) + @@ -5965,0 +6074,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html) + @@ -6175,0 +6286,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sqs-queue-no-public-access](./sqs-queue-no-public-access.html) + @@ -6197,0 +6310,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [transfer-connector-logging-enabled](./transfer-connector-logging-enabled.html) + @@ -6478,0 +6593,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html) + @@ -6586,0 +6703,6 @@ AWS Config currently supports the following managed rules. Before using these ru + * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html) + + * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html) + + * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html) + @@ -6600,0 +6723,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html) + @@ -6658,0 +6783,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html) + @@ -7117,0 +7244,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html) + @@ -7237,0 +7366,6 @@ AWS Config currently supports the following managed rules. Before using these ru + * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html) + + * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html) + + * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html) + @@ -7251,0 +7386,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html) + @@ -7351,0 +7488,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html) + @@ -7559,0 +7698,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [transfer-connector-logging-enabled](./transfer-connector-logging-enabled.html) + @@ -8111,0 +8252,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html)