AWS config documentation change
Summary
Updated the list of AWS Config managed rules by adding multiple new rules (e.g., iam-user-no-policies-check, sagemaker-model-quality-job-encrypt-in-transit, waf-global-rulegroup-not-empty) and removing some outdated rules.
Security assessment
The changes include additions of security-focused AWS Config rules such as checks for IAM inline policies, encryption in transit for SageMaker jobs, and WAF rule validity. These document security best practices but do not explicitly address a disclosed vulnerability or incident.
Diff
diff --git a/config/latest/developerguide/managing-rules-by-region-availability.md b/config/latest/developerguide/managing-rules-by-region-availability.md index 44fb1b482..4fdce193d 100644 --- a//config/latest/developerguide/managing-rules-by-region-availability.md +++ b//config/latest/developerguide/managing-rules-by-region-availability.md @@ -882,0 +883,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [iam-user-no-policies-check](./iam-user-no-policies-check.html) + @@ -1348,0 +1351,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-quality-job-encrypt-in-transit](./sagemaker-model-quality-job-encrypt-in-transit.html) + @@ -1472,0 +1477,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [waf-global-rulegroup-not-empty](./waf-global-rulegroup-not-empty.html) + + * [waf-global-rule-not-empty](./waf-global-rule-not-empty.html) + @@ -2919,0 +2928,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-quality-job-encrypt-in-transit](./sagemaker-model-quality-job-encrypt-in-transit.html) + @@ -3860,0 +3871,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [iam-no-inline-policy-check](./iam-no-inline-policy-check.html) + @@ -3880,0 +3893,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [iam-user-no-policies-check](./iam-user-no-policies-check.html) + @@ -4296,0 +4311,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-quality-job-encrypt-in-transit](./sagemaker-model-quality-job-encrypt-in-transit.html) + @@ -4420,0 +4437,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [waf-global-rulegroup-not-empty](./waf-global-rulegroup-not-empty.html) + + * [waf-global-rule-not-empty](./waf-global-rule-not-empty.html) + @@ -5325,0 +5346,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [iam-user-no-policies-check](./iam-user-no-policies-check.html) + @@ -5829,0 +5852,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-quality-job-encrypt-in-transit](./sagemaker-model-quality-job-encrypt-in-transit.html) + @@ -5955,0 +5980,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [waf-global-rulegroup-not-empty](./waf-global-rulegroup-not-empty.html) + + * [waf-global-rule-not-empty](./waf-global-rule-not-empty.html) + @@ -6349,2 +6376,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [dynamodb-table-encryption-enabled](./dynamodb-table-encryption-enabled.html) - @@ -6417,2 +6442,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [ec2-managedinstance-association-compliance-status-check](./ec2-managedinstance-association-compliance-status-check.html) - @@ -6738,0 +6763,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [iam-user-no-policies-check](./iam-user-no-policies-check.html) + @@ -7226,0 +7253,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [waf-global-rulegroup-not-empty](./waf-global-rulegroup-not-empty.html) + + * [waf-global-rule-not-empty](./waf-global-rule-not-empty.html) + @@ -7650,2 +7679,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [dynamodb-table-encryption-enabled](./dynamodb-table-encryption-enabled.html) - @@ -8043,0 +8072,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [iam-user-no-policies-check](./iam-user-no-policies-check.html) + @@ -8457,0 +8488,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-quality-job-encrypt-in-transit](./sagemaker-model-quality-job-encrypt-in-transit.html) + @@ -8579,0 +8612,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [waf-global-rulegroup-not-empty](./waf-global-rulegroup-not-empty.html) + + * [waf-global-rule-not-empty](./waf-global-rule-not-empty.html) + @@ -8624,0 +8661,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [api-gwv2-access-logs-enabled](./api-gwv2-access-logs-enabled.html) + @@ -8851,2 +8888,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [dynamodb-table-encryption-enabled](./dynamodb-table-encryption-enabled.html) - @@ -8903,2 +8938,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [ec2-managedinstance-association-compliance-status-check](./ec2-managedinstance-association-compliance-status-check.html) - @@ -9206,0 +9241,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [neptune-cluster-deletion-protection-enabled](./neptune-cluster-deletion-protection-enabled.html) + @@ -9363,2 +9398,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [s3-bucket-mfa-delete-enabled](./s3-bucket-mfa-delete-enabled.html) - @@ -9488,0 +9523,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [waf-global-rulegroup-not-empty](./waf-global-rulegroup-not-empty.html) + + * [waf-global-rule-not-empty](./waf-global-rule-not-empty.html) + @@ -9535,0 +9574,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [api-gwv2-access-logs-enabled](./api-gwv2-access-logs-enabled.html) + @@ -9701,0 +9742,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudformation-stack-notification-check](./cloudformation-stack-notification-check.html) + @@ -9794,2 +9835,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [dynamodb-table-encryption-enabled](./dynamodb-table-encryption-enabled.html) - @@ -9856,2 +9895,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [ec2-managedinstance-association-compliance-status-check](./ec2-managedinstance-association-compliance-status-check.html) - @@ -10131,0 +10170,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [iam-user-no-policies-check](./iam-user-no-policies-check.html) + @@ -10221,0 +10262,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [neptune-cluster-deletion-protection-enabled](./neptune-cluster-deletion-protection-enabled.html) + @@ -10418,2 +10459,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [s3-bucket-mfa-delete-enabled](./s3-bucket-mfa-delete-enabled.html) - @@ -10567,0 +10608,8 @@ AWS Config currently supports the following managed rules. Before using these ru + * [wafv2-rulegroup-not-empty](./wafv2-rulegroup-not-empty.html) + + * [wafv2-webacl-not-empty](./wafv2-webacl-not-empty.html) + + * [waf-global-rulegroup-not-empty](./waf-global-rulegroup-not-empty.html) + + * [waf-global-rule-not-empty](./waf-global-rule-not-empty.html) + @@ -10582,0 +10631,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [alb-http-drop-invalid-header-enabled](./alb-http-drop-invalid-header-enabled.html) + @@ -10594,0 +10645,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [api-gwv2-access-logs-enabled](./api-gwv2-access-logs-enabled.html) + @@ -10606,0 +10659,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [api-gw-xray-enabled](./api-gw-xray-enabled.html) + @@ -10610,0 +10665,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [aurora-mysql-backtracking-enabled](./aurora-mysql-backtracking-enabled.html) + @@ -10624,0 +10681,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudformation-stack-notification-check](./cloudformation-stack-notification-check.html) + @@ -10664,0 +10723,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [dynamodb-pitr-enabled](./dynamodb-pitr-enabled.html) + @@ -10666,0 +10727,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [dynamodb-table-encryption-enabled](./dynamodb-table-encryption-enabled.html) + @@ -10678,0 +10741,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-imdsv2-check](./ec2-imdsv2-check.html) + @@ -10695,2 +10758,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [ec2-managedinstance-association-compliance-status-check](./ec2-managedinstance-association-compliance-status-check.html) - @@ -10708,0 +10771,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-fargate-latest-platform-version](./ecs-fargate-latest-platform-version.html) + @@ -10740,0 +10805,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [elasticsearch-node-to-node-encryption-check](./elasticsearch-node-to-node-encryption-check.html) + @@ -10750,0 +10817,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [elb-cross-zone-load-balancing-enabled](./elb-cross-zone-load-balancing-enabled.html) + @@ -10752,0 +10821,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [elb-deletion-protection-enabled](./elb-deletion-protection-enabled.html) + @@ -10802,0 +10873,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [neptune-cluster-deletion-protection-enabled](./neptune-cluster-deletion-protection-enabled.html) + @@ -10804,0 +10877,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [netfw-multi-az-enabled](./netfw-multi-az-enabled.html) + @@ -10806,0 +10881,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [rds-automatic-minor-version-upgrade-enabled](./rds-automatic-minor-version-upgrade-enabled.html) + @@ -10808,0 +10885,6 @@ AWS Config currently supports the following managed rules. Before using these ru + * [rds-cluster-deletion-protection-enabled](./rds-cluster-deletion-protection-enabled.html) + + * [rds-cluster-iam-authentication-enabled](./rds-cluster-iam-authentication-enabled.html) + + * [rds-cluster-multi-az-enabled](./rds-cluster-multi-az-enabled.html) + @@ -10914,0 +10997,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [waf-global-rulegroup-not-empty](./waf-global-rulegroup-not-empty.html) + + * [waf-global-rule-not-empty](./waf-global-rule-not-empty.html) + @@ -10953,0 +11040,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [api-gwv2-access-logs-enabled](./api-gwv2-access-logs-enabled.html) + @@ -11212,2 +11299,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [ec2-managedinstance-association-compliance-status-check](./ec2-managedinstance-association-compliance-status-check.html) - @@ -11523,0 +11610,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [neptune-cluster-deletion-protection-enabled](./neptune-cluster-deletion-protection-enabled.html) + @@ -11564,2 +11651,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [rds-cluster-multi-az-enabled](./rds-cluster-multi-az-enabled.html) - @@ -11680,2 +11765,0 @@ AWS Config currently supports the following managed rules. Before using these ru - * [s3-bucket-mfa-delete-enabled](./s3-bucket-mfa-delete-enabled.html) - @@ -11800 +11884,3 @@ AWS Config currently supports the following managed rules. Before using these ru - * [wafv2-webacl-not-empty](./wafv2-webacl-not-empty.html) + * [waf-global-rulegroup-not-empty](./waf-global-rulegroup-not-empty.html) +