AWS config medium security documentation change
Summary
Added multiple AWS Config managed rules including checks for resource tagging compliance, HTTPS usage for DataSync, internal ELB scheme validation, SQS dead-letter queue configuration, and security-focused policies.
Security assessment
Several added rules address security controls: 'datasync-location-object-storage-using-https' enforces HTTPS for data-in-transit encryption (security feature), 'elb-internal-scheme-check' prevents accidental public exposure of load balancers, and 'sqs-queue-policy-full-access-check' mitigates over-permissive access risks. These changes document security best practices.
Diff
diff --git a/config/latest/developerguide/managing-rules-by-region-availability.md b/config/latest/developerguide/managing-rules-by-region-availability.md index 86db6d946..1da071b21 100644 --- a//config/latest/developerguide/managing-rules-by-region-availability.md +++ b//config/latest/developerguide/managing-rules-by-region-availability.md @@ -36,0 +37,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [alb-tagged](./alb-tagged.html) + @@ -60,0 +63,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [api-gw-rest-api-tagged](./api-gw-rest-api-tagged.html) + @@ -62,0 +67,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [api-gw-stage-tagged](./api-gw-stage-tagged.html) + @@ -134,0 +141,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [appsync-graphql-api-xray-enabled](./appsync-graphql-api-xray-enabled.html) + @@ -236,0 +245,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudwatch-metric-stream-tagged](./cloudwatch-metric-stream-tagged.html) + @@ -260,0 +271,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [codebuild-report-group-tagged](./codebuild-report-group-tagged.html) + @@ -290,0 +303,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [datasync-location-object-storage-using-https](./datasync-location-object-storage-using-https.html) + @@ -468,0 +483,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-tagged](./ec2-vpn-connection-tagged.html) + @@ -480,0 +497,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-tagged](./ecs-capacity-provider-tagged.html) + @@ -512,0 +531,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [efs-file-system-tagged](./efs-file-system-tagged.html) + @@ -526,0 +547,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-addon-tagged](./eks-addon-tagged.html) + @@ -594,0 +617,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [elb-internal-scheme-check](./elb-internal-scheme-check.html) + @@ -598,0 +623,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [elb-tagged](./elb-tagged.html) + @@ -664,0 +691,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [glb-tagged](./glb-tagged.html) + @@ -740,0 +769,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [iotdevicedefender-custom-metric-tagged](./iotdevicedefender-custom-metric-tagged.html) + @@ -758,0 +789,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [iot-job-template-tagged](./iot-job-template-tagged.html) + @@ -768,0 +801,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [kms-key-tagged](./kms-key-tagged.html) + @@ -818,0 +853,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [msk-cluster-tagged](./msk-cluster-tagged.html) + @@ -872,0 +909,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [nlb-tagged](./nlb-tagged.html) + @@ -916,0 +955,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [rds-event-subscription-tagged](./rds-event-subscription-tagged.html) + @@ -940,0 +981,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [rds-option-group-tagged](./rds-option-group-tagged.html) + @@ -1110,0 +1153,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [service-catalog-portfolio-tagged](./service-catalog-portfolio-tagged.html) + @@ -1120,0 +1165,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sqs-queue-dlq-check](./sqs-queue-dlq-check.html) + @@ -1122,0 +1169,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sqs-queue-policy-full-access-check](./sqs-queue-policy-full-access-check.html) + @@ -1130,0 +1179,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [stepfunctions-state-machine-tagged](./stepfunctions-state-machine-tagged.html) + @@ -1225,0 +1276,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [alb-tagged](./alb-tagged.html) + @@ -1249,0 +1302,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [api-gw-rest-api-tagged](./api-gw-rest-api-tagged.html) + @@ -1251,0 +1306,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [api-gw-stage-tagged](./api-gw-stage-tagged.html) + @@ -1331,0 +1388,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [appsync-graphql-api-xray-enabled](./appsync-graphql-api-xray-enabled.html) + @@ -1425,0 +1484,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudfront-origin-lambda-url-oac-enabled](./cloudfront-origin-lambda-url-oac-enabled.html) + @@ -1461,0 +1522,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudwatch-metric-stream-tagged](./cloudwatch-metric-stream-tagged.html) + @@ -1485,0 +1548,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [codebuild-report-group-tagged](./codebuild-report-group-tagged.html) + @@ -1521,0 +1586,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [datasync-location-object-storage-using-https](./datasync-location-object-storage-using-https.html) + @@ -1703,0 +1770,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-tagged](./ec2-vpn-connection-tagged.html) + @@ -1715,0 +1784,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-tagged](./ecs-capacity-provider-tagged.html) + @@ -1747,0 +1818,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [efs-file-system-tagged](./efs-file-system-tagged.html) + @@ -1761,0 +1834,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-addon-tagged](./eks-addon-tagged.html) + @@ -1829,0 +1904,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [elb-internal-scheme-check](./elb-internal-scheme-check.html) + @@ -1833,0 +1910,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [elb-tagged](./elb-tagged.html) + @@ -1899,0 +1978,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [glb-tagged](./glb-tagged.html) + @@ -1983,0 +2064,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [iotdevicedefender-custom-metric-tagged](./iotdevicedefender-custom-metric-tagged.html) + @@ -2017,0 +2100,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [iot-job-template-tagged](./iot-job-template-tagged.html) + @@ -2035,0 +2120,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [kms-key-tagged](./kms-key-tagged.html) + @@ -2085,0 +2172,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [msk-cluster-tagged](./msk-cluster-tagged.html) + @@ -2139,0 +2228,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [nlb-tagged](./nlb-tagged.html) + @@ -2185,0 +2276,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [rds-event-subscription-tagged](./rds-event-subscription-tagged.html) + @@ -2209,0 +2302,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [rds-option-group-tagged](./rds-option-group-tagged.html) + @@ -2277,0 +2372,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [route53-health-check-tagged](./route53-health-check-tagged.html) + + * [route53-hosted-zone-tagged](./route53-hosted-zone-tagged.html) + @@ -2381,0 +2480,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [service-catalog-portfolio-tagged](./service-catalog-portfolio-tagged.html) + @@ -2397,0 +2498,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sqs-queue-dlq-check](./sqs-queue-dlq-check.html) + @@ -2399,0 +2502,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sqs-queue-policy-full-access-check](./sqs-queue-policy-full-access-check.html) + @@ -2407,0 +2512,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [stepfunctions-state-machine-tagged](./stepfunctions-state-machine-tagged.html) + @@ -2481,0 +2588,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [workspaces-connection-alias-tagged](./workspaces-connection-alias-tagged.html) + @@ -2485,0 +2594,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [workspaces-workspace-tagged](./workspaces-workspace-tagged.html) + @@ -2514,0 +2625,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [alb-tagged](./alb-tagged.html) + @@ -2538,0 +2651,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [api-gw-rest-api-tagged](./api-gw-rest-api-tagged.html) + @@ -2540,0 +2655,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [api-gw-stage-tagged](./api-gw-stage-tagged.html) + @@ -2600,0 +2717,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [appsync-graphql-api-xray-enabled](./appsync-graphql-api-xray-enabled.html) + @@ -2702,0 +2821,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudwatch-metric-stream-tagged](./cloudwatch-metric-stream-tagged.html) + @@ -2726,0 +2847,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [codebuild-report-group-tagged](./codebuild-report-group-tagged.html) + @@ -2752,0 +2875,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [datasync-location-object-storage-using-https](./datasync-location-object-storage-using-https.html) + @@ -2918,0 +3043,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-tagged](./ec2-vpn-connection-tagged.html) + @@ -2930,0 +3057,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-tagged](./ecs-capacity-provider-tagged.html) + @@ -2962,0 +3091,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [efs-file-system-tagged](./efs-file-system-tagged.html) + @@ -2976,0 +3107,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-addon-tagged](./eks-addon-tagged.html)