AWS config medium security documentation change
Summary
Added multiple new AWS Config managed rules related to resource tagging, security checks, and service-specific validations
Security assessment
Several added rules enforce security best practices: 'sqs-queue-policy-full-access-check' prevents overprivileged access, 'elb-internal-scheme-check' ensures internal load balancer configuration, and 'datasync-location-object-storage-using-https' enforces encrypted transfers. These directly address security controls for resource configurations.
Diff
diff --git a/config/latest/developerguide/managed-rules-by-trigger-type.md b/config/latest/developerguide/managed-rules-by-trigger-type.md index 8b8d4163e..40c1007ce 100644 --- a//config/latest/developerguide/managed-rules-by-trigger-type.md +++ b//config/latest/developerguide/managed-rules-by-trigger-type.md @@ -28,0 +29,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [alb-tagged](./alb-tagged.html) + @@ -50,0 +53,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [api-gw-rest-api-tagged](./api-gw-rest-api-tagged.html) + @@ -52,0 +57,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [api-gw-stage-tagged](./api-gw-stage-tagged.html) + @@ -128,0 +135,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [appsync-graphql-api-xray-enabled](./appsync-graphql-api-xray-enabled.html) + @@ -210,0 +219,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [cloudfront-origin-lambda-url-oac-enabled](./cloudfront-origin-lambda-url-oac-enabled.html) + @@ -228,0 +239,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [cloudwatch-metric-stream-tagged](./cloudwatch-metric-stream-tagged.html) + @@ -242,0 +255,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [codebuild-report-group-tagged](./codebuild-report-group-tagged.html) + @@ -274,0 +289,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [datasync-location-object-storage-using-https](./datasync-location-object-storage-using-https.html) + @@ -406,0 +423,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [ec2-vpn-connection-tagged](./ec2-vpn-connection-tagged.html) + @@ -416,0 +435,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [ecs-capacity-provider-tagged](./ecs-capacity-provider-tagged.html) + @@ -446,0 +467,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [efs-file-system-tagged](./efs-file-system-tagged.html) + @@ -448,0 +471,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [eks-addon-tagged](./eks-addon-tagged.html) + @@ -482,0 +507,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [elb-internal-scheme-check](./elb-internal-scheme-check.html) + @@ -486,0 +513,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [elb-tagged](./elb-tagged.html) + @@ -526,0 +555,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [glb-tagged](./glb-tagged.html) + @@ -564,0 +595,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [iotdevicedefender-custom-metric-tagged](./iotdevicedefender-custom-metric-tagged.html) + @@ -598,0 +631,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [iot-job-template-tagged](./iot-job-template-tagged.html) + @@ -612,0 +647,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [kms-key-tagged](./kms-key-tagged.html) + @@ -648,0 +685,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [msk-cluster-tagged](./msk-cluster-tagged.html) + @@ -696,0 +735,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [nlb-tagged](./nlb-tagged.html) + @@ -740,0 +781,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [rds-event-subscription-tagged](./rds-event-subscription-tagged.html) + @@ -752,0 +795,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [rds-option-group-tagged](./rds-option-group-tagged.html) + @@ -790,0 +835,4 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [route53-health-check-tagged](./route53-health-check-tagged.html) + + * [route53-hosted-zone-tagged](./route53-hosted-zone-tagged.html) + @@ -862,0 +911,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [service-catalog-portfolio-tagged](./service-catalog-portfolio-tagged.html) + @@ -870,0 +921,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [sqs-queue-dlq-check](./sqs-queue-dlq-check.html) + @@ -872,0 +925,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [sqs-queue-policy-full-access-check](./sqs-queue-policy-full-access-check.html) + @@ -874,0 +929,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [stepfunctions-state-machine-tagged](./stepfunctions-state-machine-tagged.html) + @@ -922,0 +979,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [workspaces-connection-alias-tagged](./workspaces-connection-alias-tagged.html) + @@ -926,0 +985,2 @@ _Change-triggered rules_ are rules that AWS Config evaluates in response to conf + * [workspaces-workspace-tagged](./workspaces-workspace-tagged.html) +