AWS config documentation change
Summary
Updated AWS resource configuration reference with new services, resource relationships, and organizational changes
Security assessment
Changes primarily involve adding new AWS services (e.g., AWS Entity Resolution, AWS Billing and Cost Management) and updating resource relationships. No direct security vulnerabilities or security features are mentioned in the changes. The note about AWS Service Catalog tracking relates to resource identification, not security controls.
Diff
diff --git a/config/latest/developerguide/resource-config-reference.md b/config/latest/developerguide/resource-config-reference.md index b281b9f0b..947d24552 100644 --- a//config/latest/developerguide/resource-config-reference.md +++ b//config/latest/developerguide/resource-config-reference.md @@ -5 +5 @@ -Amazon AppStreamAmazon AppFlowAmazon API GatewayAmazon AthenaAmazon BedrockAmazon CloudFrontAmazon CloudWatchAmazon CodeGuruAmazon CognitoAmazon ConnectAmazon DetectiveAmazon DynamoDBAmazon EC2Amazon ECRAmazon ECSAmazon EFSAmazon EKSAmazon EMRAmazon EventBridgeAmazon ForecastAmazon Fraud DetectorAmazon GuardDutyAmazon InspectorAmazon IVSAmazon KeyspacesAmazon OpenSearch ServiceAmazon PersonalizeAmazon PinpointAmazon QLDBAmazon KendraAmazon KinesisAmazon LexAmazon LightsailAmazon Lookout for MetricsAmazon Lookout for VisionAmazon MacieAmazon Managed GrafanaAmazon Managed Service for PrometheusAmazon MemoryDBAmazon MQAmazon MSKAmazon QuickSightAmazon RedshiftAmazon RDSAmazon Route 53Amazon SageMaker AIAmazon SESAmazon SNSAmazon SQSAmazon S3Amazon WorkSpacesAWS AmplifyAWS AppConfigAWS App RunnerAWS App MeshAWS AppSyncAWS Audit ManagerAWS Auto ScalingAWS BackupAWS BatchAWS BudgetsAWS Certificate ManagerAWS CloudFormationAWS CloudTrailAWS Cloud9AWS Cloud MapAWS CodeArtifactAWS CodeBuildAWS CodeDeployAWS CodePipelineAWS ConfigAWS DMSAWS DataSyncAWS Device FarmAWS Elastic BeanstalkAWS FISAWS Global AcceleratorAWS GlueAWS Ground StationAWS HealthLakeAWS IAMAWS IoTAWS KMSAWS LambdaAWS Mainframe ModernizationAWS Network FirewallAWS Network ManagerAWS PanoramaAWS Private CAAWS Resilience HubAWS Resource ExplorerAWS RoboMakerAWS SignerAWS Secrets ManagerAWS Security HubAWS Service CatalogAWS ShieldAWS Step FunctionsAWS Systems ManagerAWS Transfer FamilyAWS WAFAWS X-RayElastic Load BalancingMediaConnectMediaPackageMediaTailor +Amazon AppStreamAmazon AppFlowAmazon API GatewayAmazon AthenaAmazon BedrockAmazon CloudFrontAmazon CloudWatchAmazon CodeGuruAmazon CognitoAmazon ConnectAmazon DetectiveAmazon DynamoDBAmazon EC2Amazon ECRAmazon ECSAmazon EFSAmazon EKSAmazon EMRAmazon EventBridgeAmazon ForecastAmazon Fraud DetectorAmazon GuardDutyAmazon InspectorAmazon IVSAmazon KeyspacesAmazon OpenSearch ServiceAmazon PersonalizeAmazon PinpointAmazon QLDBAmazon KendraAmazon KinesisAmazon LexAmazon LightsailAmazon Lookout for MetricsAmazon Lookout for VisionAmazon MacieAmazon Managed GrafanaAmazon Managed Service for PrometheusAmazon MemoryDBAmazon MQAmazon MSKAmazon QuickSightAmazon RedshiftAmazon RDSAmazon Route 53Amazon SageMaker AIAmazon SESAmazon SNSAmazon SQSAmazon S3Amazon WorkSpacesAWS AmplifyAWS AppConfigAWS App RunnerAWS App MeshAWS AppSyncAWS Audit ManagerAWS Auto ScalingAWS BackupAWS BatchAWS Billing and Cost ManagementAWS BudgetsAWS Certificate ManagerAWS CloudFormationAWS CloudTrailAWS Cloud9AWS Cloud MapAWS CodeArtifactAWS CodeBuildAWS CodeDeployAWS CodePipelineAWS ConfigAWS DMSAWS DataSyncAWS Device FarmAWS Elastic BeanstalkAWS Entity ResolutionAWS FISAWS Global AcceleratorAWS GlueAWS Ground StationAWS HealthLakeAWS IAMAWS IoTAWS KMSAWS LambdaAWS Mainframe ModernizationAWS Network FirewallAWS Network ManagerAWS PanoramaAWS Private CAAWS Resilience HubAWS Resource ExplorerAWS RoboMakerAWS SignerAWS Secrets ManagerAWS Security HubAWS Service CatalogAWS ShieldAWS Step FunctionsAWS Systems ManagerAWS Transfer FamilyAWS WAFAWS X-RayElastic Load BalancingMediaConnectMediaPackageMediaTailor @@ -96,0 +97 @@ IAM Server Certificate +`AWS::CloudFront::PublicKey` | NA | NA @@ -531 +532,6 @@ AWS Service | Resource Type Value | Relationship | Related Resource -Amazon Relational Database Service | `AWS::RDS::DBInstance` | is associated with | EC2 security group +Amazon Relational Database Service | `AWS::RDS::DBCluster` | contains | RDS DB instance +is associated with | RDS DB subnet group +EC2 security group +`AWS::RDS::DBClusterSnapshot` | is associated with | RDS DB cluster +Virtual private cloud (VPC) +`AWS::RDS::DBInstance` | is associated with | EC2 security group @@ -540,5 +545,0 @@ Virtual private cloud (VPC) -`AWS::RDS::DBCluster` | contains | RDS DB instance -is associated with | RDS DB subnet group -EC2 security group -`AWS::RDS::DBClusterSnapshot` | is associated with | RDS DB cluster -Virtual private cloud (VPC) @@ -545,0 +547 @@ Virtual private cloud (VPC) +`AWS::RDS::Integration` | NA | NA @@ -619,0 +622 @@ Amazon Simple Storage Service | `AWS::S3::Bucket*` | NA | NA +`AWS::S3Tables::TableBucket` | NA | NA @@ -724,0 +728 @@ AWS Backup | `AWS::Backup::BackupPlan` | NA | NA* +AWS Backup Gateway | `AWS::BackupGateway::Hypervisor` | NA | NA @@ -739,0 +744,6 @@ AWS Batch | `AWS::Batch::JobQueue` | NA | NA +## AWS Billing and Cost Management + +AWS Service | Resource Type Value | Relationship | Related Resource +---|---|---|--- +AWS Billing and Cost Management | `AWS::BCMDataExports::Export` | NA | NA + @@ -756 +766,2 @@ AWS Service | Resource Type Value | Relationship | Related Resource -AWS CloudFormation | `AWS::CloudFormation::Stack`* | contains | Supported AWS resource types +AWS CloudFormation | `AWS::CloudFormation::GuardHook` | NA | NA +`AWS::CloudFormation::Stack`* | contains | Supported AWS resource types @@ -885,0 +897,7 @@ contains | CloudFormation Stack +## AWS Entity Resolution + +AWS Service | Resource Type Value | Relationship | Related Resource +---|---|---|--- +AWS Entity Resolution | `AWS::EntityResolution::IdMappingWorkflow` | NA | NA +`AWS::EntityResolution::SchemaMapping` | NA | NA + @@ -946,3 +964,4 @@ AWS Service | Resource Type Value | Relationship | Related Resource -AWS IoT | `AWS::IoT::Authorizer` | NA | NA -`AWS::IoT::SecurityProfile` | NA | NA -`AWS::IoT::RoleAlias` | NA | NA +AWS IoT | `AWS::IoT::AccountAuditConfiguration` | NA | NA +`AWS::IoT::Authorizer` | NA | NA +`AWS::IoT::CACertificate` | NA | NA +`AWS::IoT::CustomMetric` | NA | NA @@ -950 +969,2 @@ AWS IoT | `AWS::IoT::Authorizer` | NA | NA -`AWS::IoT::Policy` | NA | NA +`AWS::IoT::DomainConfiguration` | NA | NA +`AWS::IoT::JobTemplate` | NA | NA @@ -951,0 +972,3 @@ AWS IoT | `AWS::IoT::Authorizer` | NA | NA +`AWS::IoT::Policy` | NA | NA +`AWS::IoT::ProvisioningTemplate` | NA | NA +`AWS::IoT::RoleAlias` | NA | NA @@ -953 +976 @@ AWS IoT | `AWS::IoT::Authorizer` | NA | NA -`AWS::IoT::AccountAuditConfiguration` | NA | NA +`AWS::IoT::SecurityProfile` | NA | NA @@ -955,4 +977,0 @@ AWS IoT | `AWS::IoT::Authorizer` | NA | NA -`AWS::IoT::CustomMetric` | NA | NA -`AWS::IoT::JobTemplate` | NA | NA -`AWS::IoT::ProvisioningTemplate` | NA | NA -`AWS::IoT::CACertificate` | NA | NA @@ -1038,0 +1058 @@ AWS Private Certificate Authority | `AWS::ACMPCA::CertificateAuthority` | NA | N +AWS Private CA Connector for Active Directory | `AWS::PCAConnectorAD::DirectoryRegistration` | NA | NA @@ -1090,0 +1111,4 @@ CloudFormationStack +###### Note + +When you use AWS Service Catalog with AWS Config, configuration items show the child provisioned product's ARN instead of the parent product's ARN. This happens when a AWS Service Catalog provisioned product serves as a resource within a parent provisioned product through CloudFormation. The resource ID remains trackable through the AWS Config interfaces. +