AWS Security ChangesHomeSearch

AWS config documentation change

Service: config · 2025-03-10 · Documentation low

File: config/latest/developerguide/managing-rules-by-region-availability.md

Summary

Added multiple new AWS Config managed rules across various services including ECR encryption, ELB security policies, GuardDuty monitoring, network firewall protections, SQS access controls, and logging features

Security assessment

The changes add documentation for new security-focused managed rules related to encryption (CMK), access controls (SQS public access), runtime protection (GuardDuty), network protections, and logging requirements. While these are security features, there is no evidence in the diff of addressing specific vulnerabilities or security incidents.

Diff

diff --git a/config/latest/developerguide/managing-rules-by-region-availability.md
index ce1eb7a86..c25552ea0 100644
--- a/config/latest/developerguide/managing-rules-by-region-availability.md
+++ b/config/latest/developerguide/managing-rules-by-region-availability.md
@@ -442,0 +443,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html)
+
@@ -546,0 +549,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [elbv2-predefined-security-policy-ssl-check](./elbv2-predefined-security-policy-ssl-check.html)
+
@@ -624,0 +629,6 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html)
+
+  * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html)
+
+  * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html)
+
@@ -638,0 +649,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html)
+
@@ -788,0 +801,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html)
+
@@ -1000,0 +1015,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [sqs-queue-no-public-access](./sqs-queue-no-public-access.html)
+
@@ -1022,0 +1039,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [transfer-connector-logging-enabled](./transfer-connector-logging-enabled.html)
+
@@ -1375,0 +1394,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [connect-instance-logging-enabled](./connect-instance-logging-enabled.html)
+
@@ -1543,0 +1564,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html)
+
@@ -1647,0 +1670,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [elbv2-predefined-security-policy-ssl-check](./elbv2-predefined-security-policy-ssl-check.html)
+
@@ -1725,0 +1750,6 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html)
+
+  * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html)
+
+  * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html)
+
@@ -1739,0 +1770,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html)
+
@@ -1913,0 +1946,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html)
+
@@ -2135,0 +2170,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [sqs-queue-no-public-access](./sqs-queue-no-public-access.html)
+
@@ -2157,0 +2194,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [transfer-connector-logging-enabled](./transfer-connector-logging-enabled.html)
+
@@ -2626,0 +2665,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html)
+
@@ -2730,0 +2771,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [elbv2-predefined-security-policy-ssl-check](./elbv2-predefined-security-policy-ssl-check.html)
+
@@ -2788,0 +2831,6 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html)
+
+  * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html)
+
+  * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html)
+
@@ -2802,0 +2851,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html)
+
@@ -2932,0 +2983,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html)
+
@@ -3144,0 +3197,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [sqs-queue-no-public-access](./sqs-queue-no-public-access.html)
+
@@ -3166,0 +3221,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [transfer-connector-logging-enabled](./transfer-connector-logging-enabled.html)
+
@@ -3489,0 +3546,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [connect-instance-logging-enabled](./connect-instance-logging-enabled.html)
+
@@ -3657,0 +3716,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html)
+
@@ -3761,0 +3822,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [elbv2-predefined-security-policy-ssl-check](./elbv2-predefined-security-policy-ssl-check.html)
+
@@ -3839,0 +3902,6 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html)
+
+  * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html)
+
+  * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html)
+
@@ -3853,0 +3922,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html)
+
@@ -4025,0 +4096,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html)
+
@@ -4241,0 +4314,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [sqs-queue-no-public-access](./sqs-queue-no-public-access.html)
+
@@ -4263,0 +4338,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [transfer-connector-logging-enabled](./transfer-connector-logging-enabled.html)
+
@@ -4550,0 +4627,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [connect-instance-logging-enabled](./connect-instance-logging-enabled.html)
+
@@ -4684,0 +4763,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html)
+
@@ -4786,0 +4867,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [elbv2-predefined-security-policy-ssl-check](./elbv2-predefined-security-policy-ssl-check.html)
+
@@ -4840,0 +4923,6 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html)
+
+  * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html)
+
+  * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html)
+
@@ -4854,0 +4943,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html)
+
@@ -4976,0 +5067,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html)
+
@@ -5184,0 +5277,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [sqs-queue-no-public-access](./sqs-queue-no-public-access.html)
+
@@ -5206,0 +5301,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [transfer-connector-logging-enabled](./transfer-connector-logging-enabled.html)
+
@@ -5661,0 +5758,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html)
+
@@ -5765,0 +5864,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [elbv2-predefined-security-policy-ssl-check](./elbv2-predefined-security-policy-ssl-check.html)
+
@@ -5821,0 +5922,6 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html)
+
+  * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html)
+
+  * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html)
+
@@ -5835,0 +5942,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html)
+
@@ -5965,0 +6074,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html)
+
@@ -6175,0 +6286,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [sqs-queue-no-public-access](./sqs-queue-no-public-access.html)
+
@@ -6197,0 +6310,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [transfer-connector-logging-enabled](./transfer-connector-logging-enabled.html)
+
@@ -6478,0 +6593,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html)
+
@@ -6586,0 +6703,6 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html)
+
+  * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html)
+
+  * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html)
+
@@ -6600,0 +6723,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html)
+
@@ -6658,0 +6783,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html)
+
@@ -7117,0 +7244,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html)
+
@@ -7237,0 +7366,6 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [glue-spark-job-supported-version](./glue-spark-job-supported-version.html)
+
+  * [guardduty-ec2-protection-runtime-enabled](./guardduty-ec2-protection-runtime-enabled.html)
+
+  * [guardduty-ecs-protection-runtime-enabled](./guardduty-ecs-protection-runtime-enabled.html)
+
@@ -7251,0 +7386,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [guardduty-runtime-monitoring-enabled](./guardduty-runtime-monitoring-enabled.html)
+
@@ -7351,0 +7488,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [netfw-subnet-change-protection-enabled](./netfw-subnet-change-protection-enabled.html)
+
@@ -7559,0 +7698,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [transfer-connector-logging-enabled](./transfer-connector-logging-enabled.html)
+
@@ -8111,0 +8252,2 @@ AWS Config currently supports the following managed rules. Before using these ru
+  * [ecr-repository-cmk-encryption-enabled](./ecr-repository-cmk-encryption-enabled.html)