AWS controltower medium security documentation change
Summary
Updated AWS Config controls count from 200 to 500, added documentation about service-linked Config rules drift behavior, and warned about removal of external remediations
Security assessment
The change introduces stricter governance by treating external modifications to service-linked Config rules as drift and automatically removing them. This prevents unauthorized configuration changes that could weaken security posture. The explicit warning about remediation removal indicates security implications of misconfigured rules.
Diff
diff --git a/controltower/latest/controlreference/config-controls.md b/controltower/latest/controlreference/config-controls.md index e3df221d7..916219f00 100644 --- a//controltower/latest/controlreference/config-controls.md +++ b//controltower/latest/controlreference/config-controls.md @@ -4,0 +5,2 @@ +Change in drift behavior with service-linked AWS Config rules + @@ -7 +9 @@ -AWS Control Tower is integrated with AWS Config to provide over 200 selected additional detective controls that help you monitor and manage your AWS environment. These AWS Config controls are available in the AWS Control Tower console and the Control Catalog APIs. The **Control owner** or **Implementation** field for these controls is displayed as AWS Config or `AWS::Config::ConfigRule`. +AWS Control Tower is integrated with AWS Config to provide over 500 selected additional detective controls that help you monitor and manage your AWS environment. These AWS Config controls are available in the AWS Control Tower console and the Control Catalog APIs. The **Control owner** or **Implementation** field for these controls is displayed as AWS Config or `AWS::Config::ConfigRule`. @@ -10,0 +13,2 @@ You can use AWS Control Tower to search and discover the AWS Config rules that y +The AWS Control Tower console and AWS Config console each display the same metqdata for these controls. + @@ -25,0 +30,19 @@ AWS Control Tower documentation does not provide a comprehensive list of integra +## Change in drift behavior with service-linked AWS Config rules + +Before the introduction of service-linked Config rules in AWS Control Tower, you could modify AWS Config rule configurations or add remediations outside of AWS Control Tower. With the release of service-linked Config rules, this behavior has changed: + + * Modifications made to Config rule settings outside of AWS Control Tower are treated as drift. + + * External remediation configurations added to these Config rules are treated as drift. + + * AWS Control Tower automatically removes these external modifications with the adoption of service-linked Config rules. + + * To maintain consistent governance, all updates that AWS Control Tower supports for your service-linked Config rules must be managed through AWS Control Tower. + + + + +###### Important + +Before you adopt service-linked Config rules, review the existing customizations, such as remediations, that you have made to Config rules outside of AWS Control Tower, because these customizations will be removed during the transition. The AWS Config APIs do not support adding remediation configurations for service-linked AWS Config rules. See [`PutRemediationConfigurations`](https://docs.aws.amazon.com/config/latest/APIReference/API_PutRemediationConfigurations.html). +