AWS config documentation change
Summary
Updated the list of AWS Config managed rules by adding new rules (cloudformation-stack-service-role-check, ecs-capacity-provider-termination-check, ecs-task-definition-linux-user-non-root, ecs-task-definition-windows-user-non-admin, cloudfront-distribution-key-group-enabled, ec2-managedinstance-association-compliance-status-check) and removing several existing rules across multiple regions.
Security assessment
The changes add documentation for new security-focused managed rules (e.g., enforcing non-root users in ECS tasks and CloudFront key group requirements) which improve security posture. However, there's no evidence these changes address specific vulnerabilities or incidents. The removals appear to be routine updates without security implications.
Diff
diff --git a/config/latest/developerguide/managing-rules-by-region-availability.md b/config/latest/developerguide/managing-rules-by-region-availability.md index 945b6b0d1..a9310d558 100644 --- a//config/latest/developerguide/managing-rules-by-region-availability.md +++ b//config/latest/developerguide/managing-rules-by-region-availability.md @@ -258,0 +259,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudformation-stack-service-role-check](./cloudformation-stack-service-role-check.html) + @@ -554,0 +557,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-termination-check](./ecs-capacity-provider-termination-check.html) + @@ -566,0 +571,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-linux-user-non-root](./ecs-task-definition-linux-user-non-root.html) + @@ -578,0 +585,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-windows-user-non-admin](./ecs-task-definition-windows-user-non-admin.html) + @@ -1597,0 +1606,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudformation-stack-service-role-check](./cloudformation-stack-service-role-check.html) + @@ -1607,0 +1618,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudfront-distribution-key-group-enabled](./cloudfront-distribution-key-group-enabled.html) + @@ -1935,0 +1948,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-termination-check](./ecs-capacity-provider-termination-check.html) + @@ -1947,0 +1962,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-linux-user-non-root](./ecs-task-definition-linux-user-non-root.html) + @@ -1959,0 +1976,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-windows-user-non-admin](./ecs-task-definition-windows-user-non-admin.html) + @@ -3016,0 +3035,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudformation-stack-service-role-check](./cloudformation-stack-service-role-check.html) + @@ -3296,0 +3317,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-termination-check](./ecs-capacity-provider-termination-check.html) + @@ -3308,0 +3331,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-linux-user-non-root](./ecs-task-definition-linux-user-non-root.html) + @@ -3320,0 +3345,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-windows-user-non-admin](./ecs-task-definition-windows-user-non-admin.html) + @@ -3515,2 +3540,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [iam-no-inline-policy-check](./iam-no-inline-policy-check.html) - @@ -3995,2 +4018,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [vpc-default-security-group-closed](./vpc-default-security-group-closed.html) - @@ -4279,0 +4302,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudformation-stack-service-role-check](./cloudformation-stack-service-role-check.html) + @@ -4587,0 +4612,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-termination-check](./ecs-capacity-provider-termination-check.html) + @@ -4599,0 +4626,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-linux-user-non-root](./ecs-task-definition-linux-user-non-root.html) + @@ -4611,0 +4640,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-windows-user-non-admin](./ecs-task-definition-windows-user-non-admin.html) + @@ -5620,0 +5651,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudformation-stack-service-role-check](./cloudformation-stack-service-role-check.html) + @@ -5822,0 +5855,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-managedinstance-association-compliance-status-check](./ec2-managedinstance-association-compliance-status-check.html) + @@ -5882,0 +5917,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-termination-check](./ecs-capacity-provider-termination-check.html) + @@ -5894,0 +5931,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-linux-user-non-root](./ecs-task-definition-linux-user-non-root.html) + @@ -5906,0 +5945,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-windows-user-non-admin](./ecs-task-definition-windows-user-non-admin.html) + @@ -6539,2 +6578,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [vpc-default-security-group-closed](./vpc-default-security-group-closed.html) - @@ -6799,0 +6838,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudformation-stack-service-role-check](./cloudformation-stack-service-role-check.html) + @@ -7083,0 +7124,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-termination-check](./ecs-capacity-provider-termination-check.html) + @@ -7095,0 +7138,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-linux-user-non-root](./ecs-task-definition-linux-user-non-root.html) + @@ -7107,0 +7152,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-windows-user-non-admin](./ecs-task-definition-windows-user-non-admin.html) + @@ -7774,2 +7819,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [vpc-default-security-group-closed](./vpc-default-security-group-closed.html) - @@ -8104,0 +8149,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-managedinstance-association-compliance-status-check](./ec2-managedinstance-association-compliance-status-check.html) + @@ -8148,0 +8195,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-termination-check](./ecs-capacity-provider-termination-check.html) + @@ -8160,0 +8209,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-linux-user-non-root](./ecs-task-definition-linux-user-non-root.html) + @@ -8168,0 +8219,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-windows-user-non-admin](./ecs-task-definition-windows-user-non-admin.html) + @@ -8627,2 +8678,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [vpc-default-security-group-closed](./vpc-default-security-group-closed.html) - @@ -8985,0 +9036,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-managedinstance-association-compliance-status-check](./ec2-managedinstance-association-compliance-status-check.html) + @@ -9029,0 +9082,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-termination-check](./ecs-capacity-provider-termination-check.html) + @@ -9041,0 +9096,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-linux-user-non-root](./ecs-task-definition-linux-user-non-root.html) + @@ -9049,0 +9106,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-windows-user-non-admin](./ecs-task-definition-windows-user-non-admin.html) + @@ -9628,2 +9685,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [vpc-default-security-group-closed](./vpc-default-security-group-closed.html) - @@ -9683,2 +9738,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [aurora-mysql-backtracking-enabled](./aurora-mysql-backtracking-enabled.html) - @@ -9760,0 +9815,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-managedinstance-association-compliance-status-check](./ec2-managedinstance-association-compliance-status-check.html) + @@ -9774,0 +9831,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-linux-user-non-root](./ecs-task-definition-linux-user-non-root.html) + @@ -9778,0 +9837,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-windows-user-non-admin](./ecs-task-definition-windows-user-non-admin.html) + @@ -9927,2 +9986,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [vpc-default-security-group-closed](./vpc-default-security-group-closed.html) - @@ -10221,0 +10280,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-managedinstance-association-compliance-status-check](./ec2-managedinstance-association-compliance-status-check.html) + @@ -10271,0 +10332,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-termination-check](./ecs-capacity-provider-termination-check.html) + @@ -10283,0 +10346,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-linux-user-non-root](./ecs-task-definition-linux-user-non-root.html) + @@ -10291,0 +10356,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-windows-user-non-admin](./ecs-task-definition-windows-user-non-admin.html) + @@ -10738,2 +10803,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [vpc-default-security-group-closed](./vpc-default-security-group-closed.html) - @@ -11014,0 +11079,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudformation-stack-service-role-check](./cloudformation-stack-service-role-check.html) + @@ -11304,0 +11371,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-termination-check](./ecs-capacity-provider-termination-check.html) + @@ -11316,0 +11385,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-linux-user-non-root](./ecs-task-definition-linux-user-non-root.html) + @@ -11328,0 +11399,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-windows-user-non-admin](./ecs-task-definition-windows-user-non-admin.html) + @@ -12053,2 +12124,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [vpc-default-security-group-closed](./vpc-default-security-group-closed.html) - @@ -12313,0 +12384,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudformation-stack-service-role-check](./cloudformation-stack-service-role-check.html) + @@ -12557,0 +12630,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-termination-check](./ecs-capacity-provider-termination-check.html) + @@ -12569,0 +12644,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-linux-user-non-root](./ecs-task-definition-linux-user-non-root.html) + @@ -12577,0 +12654,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-windows-user-non-admin](./ecs-task-definition-windows-user-non-admin.html) + @@ -13216,2 +13293,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [vpc-default-security-group-closed](./vpc-default-security-group-closed.html) - @@ -13478,0 +13555,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudformation-stack-service-role-check](./cloudformation-stack-service-role-check.html) + @@ -13776,0 +13855,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-capacity-provider-termination-check](./ecs-capacity-provider-termination-check.html) + @@ -13788,0 +13869,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-linux-user-non-root](./ecs-task-definition-linux-user-non-root.html) + @@ -13800,0 +13883,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-windows-user-non-admin](./ecs-task-definition-windows-user-non-admin.html) + @@ -14523,2 +14606,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [vpc-default-security-group-closed](./vpc-default-security-group-closed.html) - @@ -14815,0 +14898,2 @@ AWS Config currently supports the following managed rules. Before using these ru