AWS config documentation change
Summary
Updated AWS Config resource configuration reference documentation to add a 'Notes' column to all service tables, include new AWS services and resource types (e.g., Amazon Verified Permissions, AWS Cost Explorer, AWS HealthOmics, AWS Resource Groups, Amazon EventBridge Scheduler, AWS Glue DataBrew, Amazon Q Business), reorder some entries, and add operational notes about delays in recording configuration items (CIs) for resource deletion events (up to 92 hours) for specific resources.
Security assessment
The changes are routine documentation updates to reflect new AWS services supported by AWS Config and add operational clarifications (like CI recording delays). While some added services have security functions (e.g., Amazon Verified Permissions, AWS Security Hub CSPM), the documentation update itself does not address a specific security vulnerability, weakness, or incident. The notes about CI deletion delays are operational, not security fixes. No evidence of a security incident or patch is present in the diff.
Diff
diff --git a/config/latest/developerguide/resource-config-reference.md b/config/latest/developerguide/resource-config-reference.md index 1e56c9b84..d5d2f51e9 100644 --- a//config/latest/developerguide/resource-config-reference.md +++ b//config/latest/developerguide/resource-config-reference.md @@ -5 +5 @@ -Amazon AppStreamAmazon AppFlowAmazon AppIntegrationsAmazon API GatewayAmazon AthenaAmazon BedrockAmazon CloudFrontAmazon CloudWatchAmazon CodeGuruAmazon CognitoAmazon ComprehendAmazon ConnectAmazon DetectiveAmazon DynamoDBAmazon EC2Amazon ECRAmazon ECSAmazon EFSAmazon EKSAmazon EMRAmazon EMR ServerlessAmazon EventBridgeAmazon ForecastAmazon Fraud DetectorAmazon GameLiftAmazon GuardDutyAmazon InspectorAmazon IVSAmazon KeyspacesAmazon Location ServiceAmazon OpenSearch ServiceAmazon PersonalizeAmazon PinpointAmazon QLDBAmazon KendraAmazon KinesisAmazon LexAmazon LightsailAmazon Lookout for MetricsAmazon Lookout for VisionAmazon MacieAmazon Managed GrafanaAmazon Managed Service for PrometheusAmazon MemoryDBAmazon MQAmazon MSKAmazon QuickAmazon RedshiftAmazon RDSAmazon Route 53Amazon SageMaker AIAmazon SESAmazon SNSAmazon SQSAmazon S3Amazon WorkSpacesAWS AmplifyAWS AppConfigAWS App RunnerAWS App MeshAWS AppSyncAWS Audit ManagerAWS Auto ScalingAWS B2B Data InterchangeAWS BackupAWS BatchAWS Billing and Cost ManagementAWS BudgetsAWS Certificate ManagerAWS Clean RoomsAWS CloudFormationAWS CloudTrailAWS Cloud9AWS Cloud MapAWS CodeArtifactAWS CodeBuildAWS CodeDeployAWS CodePipelineAWS ConfigAWS DMSAWS DataSyncAWS Deadline CloudAWS Device FarmAWS Elastic BeanstalkAWS Entity ResolutionAWS FISAWS Global AcceleratorAWS GlueAWS Ground StationAWS HealthLakeAWS IAMAWS IoTAWS KMSAWS LambdaAWS Mainframe ModernizationAWS Network FirewallAWS Network ManagerAWS OrganizationsAWS PanoramaAWS Private CAAWS Resilience HubAWS Resource ExplorerAWS RoboMakerAWS SignerAWS Secrets ManagerAWS Security Hub CSPMAWS Service CatalogAWS ShieldAWS Step FunctionsAWS Systems ManagerAWS Transfer FamilyAWS WAFAWS X-RayElastic Load BalancingMediaConnectMediaPackageMediaPackageMediaTailor +Amazon AppStreamAmazon AppFlowAmazon AppIntegrationsAmazon API GatewayAmazon AthenaAmazon BedrockAmazon CloudFrontAmazon CloudWatchAmazon CodeGuruAmazon CognitoAmazon ComprehendAmazon ConnectAmazon DetectiveAmazon DynamoDBAmazon EC2Amazon ECRAmazon ECSAmazon EFSAmazon EKSAmazon EMRAmazon EMR ServerlessAmazon EventBridgeAmazon ForecastAmazon Fraud DetectorAmazon GameLiftAmazon GuardDutyAmazon InspectorAmazon IVSAmazon KeyspacesAmazon Location ServiceAmazon OpenSearch ServiceAmazon PersonalizeAmazon PinpointAmazon QLDBAmazon KendraAmazon KinesisAmazon LexAmazon LightsailAmazon Lookout for MetricsAmazon Lookout for VisionAmazon MacieAmazon Managed GrafanaAmazon Managed Service for PrometheusAmazon MemoryDBAmazon MQAmazon MSKAmazon LexAmazon QuickAmazon RedshiftAmazon RDSAmazon Route 53Amazon SageMaker AIAmazon SESAmazon SNSAmazon SQSAmazon S3Amazon Verified PermissionsAmazon WorkSpacesAWS AmplifyAWS AppConfigAWS App RunnerAWS App MeshAWS AppSyncAWS Audit ManagerAWS Auto ScalingAWS B2B Data InterchangeAWS BackupAWS BatchAWS Billing and Cost ManagementAWS BudgetsAWS Certificate ManagerAWS Clean RoomsAWS CloudFormationAWS CloudTrailAWS Cloud9AWS Cloud MapAWS CodeArtifactAWS CodeBuildAWS CodeDeployAWS CodePipelineAWS ConfigAWS Cost ExplorerAWS DMSAWS DataSyncAWS Deadline CloudAWS Device FarmAWS Elastic BeanstalkAWS Entity ResolutionAWS FISAWS Global AcceleratorAWS GlueAWS Glue DataBrewAWS Ground StationAWS HealthLakeAWS IAMAWS IoTAWS KMSAWS LambdaAWS Mainframe ModernizationAWS Network FirewallAWS Network ManagerAWS OrganizationsAWS HealthOmicsAWS PanoramaAWS Private CAAWS Resilience HubAWS Resource ExplorerAWS Resource GroupsAWS RoboMakerAWS SignerAWS Secrets ManagerAWS Security Hub CSPMAWS Service CatalogAWS ShieldAWS Step FunctionsAmazon EventBridge SchedulerAWS Systems ManagerAWS Transfer FamilyAWS WAFAWS X-RayElastic Load BalancingMediaConnectMediaPackageMediaPackageMediaTailor @@ -42,7 +42,7 @@ If a resource type does not support tagging or does not include tag information -AWS Service | Resource Type Value | Relationship | Related Resource ----|---|---|--- -Amazon AppStream | `AWS::AppStream::Application` | NA | NA -`AWS::AppStream::AppBlockBuilder` | NA | NA -`AWS::AppStream::DirectoryConfig` | NA | NA -`AWS::AppStream::Fleet` | NA | NA -`AWS::AppStream::Stack` | NA | NA +AWS Service | Resource Type Value | Relationship | Related Resource | Notes +---|---|---|---|--- +Amazon AppStream | `AWS::AppStream::Application` | NA | NA | +`AWS::AppStream::AppBlockBuilder` | NA | NA | +`AWS::AppStream::DirectoryConfig` | NA | NA | +`AWS::AppStream::Fleet` | NA | NA | +`AWS::AppStream::Stack` | NA | NA | @@ -52,3 +52,3 @@ Amazon AppStream | `AWS::AppStream::Application` | NA | NA -AWS Service | Resource Type Value | Relationship | Related Resource ----|---|---|--- -Amazon AppFlow | `AWS::AppFlow::Flow` | NA | NA +AWS Service | Resource Type Value | Relationship | Related Resource | Notes +---|---|---|---|--- +Amazon AppFlow | `AWS::AppFlow::Flow` | NA | NA | @@ -58,4 +58,4 @@ Amazon AppFlow | `AWS::AppFlow::Flow` | NA | NA -AWS Service | Resource Type Value | Relationship | Related Resource ----|---|---|--- -Amazon AppIntegrations | `AWS::AppIntegrations::EventIntegration` | NA | NA -`AWS::AppIntegrations::Application` | NA | NA +AWS Service | Resource Type Value | Relationship | Related Resource | Notes +---|---|---|---|--- +Amazon AppIntegrations | `AWS::AppIntegrations::EventIntegration` | NA | NA | +`AWS::AppIntegrations::Application` | NA | NA | @@ -65,11 +65,11 @@ Amazon AppIntegrations | `AWS::AppIntegrations::EventIntegration` | NA | NA -AWS Service | Resource Type Value | Relationship | Related Resource ----|---|---|--- -API Gateway | `AWS::ApiGateway::DomainName` | NA | NA -`AWS::ApiGateway::Stage` | is contained in | ApiGateway Rest Api -is associated with | WAFRegional WebACL -`AWS::ApiGateway::Method` | NA | NA Stage -`AWS::ApiGateway::RestApi` | contains | ApiGateway Stage -`AWS::ApiGateway::UsagePlan` | NA | NA -API Gateway V2 | `AWS::ApiGatewayV2::Stage` | is contained in | ApiGatewayV2 Api -`AWS::ApiGatewayV2::Api` | contains | ApiGatewayV2 Stage -`AWS::ApiGatewayV2::Integration` | NA | NA +AWS Service | Resource Type Value | Relationship | Related Resource | Notes +---|---|---|---|--- +API Gateway | `AWS::ApiGateway::DomainName` | NA | NA | +`AWS::ApiGateway::Stage` | is contained in | ApiGateway Rest Api | +is associated with | WAFRegional WebACL | +`AWS::ApiGateway::Method` | NA | NA Stage | +`AWS::ApiGateway::RestApi` | contains | ApiGateway Stage | +`AWS::ApiGateway::UsagePlan` | NA | NA | +API Gateway V2 | `AWS::ApiGatewayV2::Stage` | is contained in | ApiGatewayV2 Api | +`AWS::ApiGatewayV2::Api` | contains | ApiGatewayV2 Stage | +`AWS::ApiGatewayV2::Integration` | NA | NA | @@ -81,5 +81,5 @@ To learn more about how AWS Config integrates with Amazon API Gateway, see [Moni -AWS Service | Resource Type Value | Relationship | Related Resource ----|---|---|--- -Amazon Athena | `AWS::Athena::WorkGroup` | NA | NA -`AWS::Athena::DataCatalog` | NA | NA -`AWS::Athena::PreparedStatement` | NA | NA +AWS Service | Resource Type Value | Relationship | Related Resource | Notes +---|---|---|---|--- +Amazon Athena | `AWS::Athena::WorkGroup` | NA | NA | +`AWS::Athena::DataCatalog` | NA | NA | +`AWS::Athena::PreparedStatement` | NA | NA | @@ -89,9 +89,12 @@ Amazon Athena | `AWS::Athena::WorkGroup` | NA | NA -AWS Service | Resource Type Value | Relationship | Related Resource ----|---|---|--- -Amazon Bedrock | `AWS::Bedrock::ApplicationInferenceProfile` | NA | NA -`AWS::Bedrock::Guardrail` | NA | NA -`AWS::Bedrock::KnowledgeBase` | NA | NA -`AWS::Bedrock::Prompt` | NA | NA -`AWS::BedrockAgentCore::BrowserCustom` | NA | NA -`AWS::BedrockAgentCore::CodeInterpreterCustom` | NA | NA -`AWS::BedrockAgentCore::Runtime` | NA | NA +AWS Service | Resource Type Value | Relationship | Related Resource | Notes +---|---|---|---|--- +Amazon Bedrock | `AWS::Bedrock::ApplicationInferenceProfile` | NA | NA | +`AWS::Bedrock::DataSource` | NA | NA | Recording CIs for resource deletion events may take up to 92 hours to reflect in AWS Config +`AWS::Bedrock::Guardrail` | NA | NA | +`AWS::Bedrock::KnowledgeBase` | NA | NA | +`AWS::Bedrock::Prompt` | NA | NA | +`AWS::BedrockAgentCore::BrowserCustom` | NA | NA | +`AWS::BedrockAgentCore::CodeInterpreterCustom` | NA | NA | +`AWS::BedrockAgentCore::Gateway` | NA | NA | +`AWS::BedrockAgentCore::Memory` | NA | NA | +`AWS::BedrockAgentCore::Runtime` | NA | NA | @@ -101,13 +104,13 @@ Amazon Bedrock | `AWS::Bedrock::ApplicationInferenceProfile` | NA | NA -AWS Service | Resource Type Value | Relationship | Related Resource ----|---|---|--- -Amazon CloudFront | `AWS::CloudFront::Distribution` | is associated with | AWS WAF WebACL -ACM Certificate -S3 Bucket -IAM Server Certificate -`AWS::CloudFront::KeyValueStore` | NA | NA -`AWS::CloudFront::PublicKey` | NA | NA -`AWS::CloudFront::StreamingDistribution` | is associated with | AWS WAF WebACL -ACM Certificate -S3 Bucket -IAM Server Certificate -`AWS::CloudFront::RealtimeLogConfig` | NA | NA +AWS Service | Resource Type Value | Relationship | Related Resource | Notes +---|---|---|---|--- +Amazon CloudFront | `AWS::CloudFront::Distribution` | is associated with | AWS WAF WebACL | +ACM Certificate | +S3 Bucket | +IAM Server Certificate | +`AWS::CloudFront::KeyValueStore` | NA | NA | +`AWS::CloudFront::PublicKey` | NA | NA | +`AWS::CloudFront::StreamingDistribution` | is associated with | AWS WAF WebACL | +ACM Certificate | +S3 Bucket | +IAM Server Certificate | +`AWS::CloudFront::RealtimeLogConfig` | NA | NA | @@ -117,9 +120,11 @@ IAM Server Certificate -AWS Service | Resource Type Value | Relationship | Related Resource ----|---|---|--- -Amazon CloudWatch | `AWS::CloudWatch::Alarm` | NA | NA -`AWS::CloudWatch::MetricStream` | NA | NA -Amazon CloudWatch Logs | `AWS::Logs::Destination` | NA | NA -Amazon CloudWatch RUM | `AWS::RUM::AppMonitor` | NA | NA -Amazon CloudWatch Evidently | `AWS::Evidently::Project` | NA | NA -`AWS::Evidently::Launch` | NA | NA -`AWS::Evidently::Segment` | NA | NA +AWS Service | Resource Type Value | Relationship | Related Resource | Notes +---|---|---|---|--- +Amazon CloudWatch | `AWS::CloudWatch::Alarm` | NA | NA | +`AWS::CloudWatch::MetricStream` | NA | NA | +Amazon CloudWatch Application Signals | `AWS::ApplicationSignals::ServiceLevelObjective` | NA | NA | +Amazon CloudWatch Internet Monitor | `AWS::InternetMonitor::Monitor` | NA | NA | +Amazon CloudWatch Logs | `AWS::Logs::Destination` | NA | NA | +Amazon CloudWatch RUM | `AWS::RUM::AppMonitor` | NA | NA | +Amazon CloudWatch Evidently | `AWS::Evidently::Project` | NA | NA | +`AWS::Evidently::Launch` | NA | NA | +`AWS::Evidently::Segment` | NA | NA | @@ -129,4 +134,4 @@ Amazon CloudWatch Evidently | `AWS::Evidently::Project` | NA | NA -AWS Service | Resource Type Value | Relationship | Related Resource ----|---|---|--- -Amazon CodeGuru Reviewer | `AWS::CodeGuruReviewer::RepositoryAssociation` | NA | NA -Amazon CodeGuru Profiler | `AWS::CodeGuruProfiler::ProfilingGroup` | NA | NA +AWS Service | Resource Type Value | Relationship | Related Resource | Notes +---|---|---|---|--- +Amazon CodeGuru Reviewer | `AWS::CodeGuruReviewer::RepositoryAssociation` | NA | NA | +Amazon CodeGuru Profiler | `AWS::CodeGuruProfiler::ProfilingGroup` | NA | NA | @@ -136,6 +141,9 @@ Amazon CodeGuru Profiler | `AWS::CodeGuruProfiler::ProfilingGroup` | NA | NA -AWS Service | Resource Type Value | Relationship | Related Resource ----|---|---|--- -Amazon Cognito | `AWS::Cognito::UserPool` | NA | NA -`AWS::Cognito::UserPoolClient` | NA | NA -`AWS::Cognito::UserPoolGroup` | NA | NA -`AWS::Cognito::IdentityPool` | NA | NA +AWS Service | Resource Type Value | Relationship | Related Resource | Notes +---|---|---|---|--- +Amazon Cognito | `AWS::Cognito::IdentityPool` | NA | NA | +`AWS::Cognito::IdentityPoolRoleAttachment` | NA | NA | +`AWS::Cognito::LogDeliveryConfiguration` | NA | NA | +`AWS::Cognito::UserPool` | NA | NA | +`AWS::Cognito::UserPoolClient` | NA | NA | +`AWS::Cognito::UserPoolGroup` | NA | NA | +`AWS::Cognito::UserPoolUICustomizationAttachment` | NA | NA | @@ -145,3 +153,3 @@ Amazon Cognito | `AWS::Cognito::UserPool` | NA | NA -AWS Service | Resource Type Value | Relationship | Related Resource ----|---|---|--- -Amazon Comprehend | `AWS::Comprehend::Flywheel` | NA | NA +AWS Service | Resource Type Value | Relationship | Related Resource | Notes +---|---|---|---|--- +Amazon Comprehend | `AWS::Comprehend::Flywheel` | NA | NA | @@ -151,10 +159,13 @@ Amazon Comprehend | `AWS::Comprehend::Flywheel` | NA | NA -AWS Service | Resource Type Value | Relationship | Related Resource ----|---|---|--- -Amazon Connect | `AWS::Connect::PhoneNumber` | NA | NA -`AWS::Connect::QuickConnect` | NA | NA -`AWS::Connect::Instance` | NA | NA -`AWS::Connect::Rule` | NA | NA -`AWS::Connect::SecurityProfile` | NA | NA -`AWS::Connect::User` | NA | NA -Amazon Connect Customer Profiles | `AWS::CustomerProfiles::Domain` | NA | NA -`AWS::CustomerProfiles::ObjectType` | NA | NA +AWS Service | Resource Type Value | Relationship | Related Resource | Notes +---|---|---|---|--- +Amazon Connect | `AWS::Connect::Instance` | NA | NA | +`AWS::Connect::PhoneNumber` | NA | NA | +`AWS::Connect::Prompt` | NA | NA | Recording CIs for resource deletion events may take up to 92 hours to reflect in AWS Config +`AWS::Connect::QuickConnect` | NA | NA | +`AWS::Connect::RoutingProfile` | NA | NA | Recording CIs for resource deletion events may take up to 92 hours to reflect in AWS Config +`AWS::Connect::Rule` | NA | NA | +`AWS::Connect::SecurityProfile` | NA | NA | +`AWS::Connect::TaskTemplate` | NA | NA | Recording CIs for resource deletion events may take up to 92 hours to reflect in AWS Config +`AWS::Connect::User` | NA | NA | +Amazon Connect Customer Profiles | `AWS::CustomerProfiles::Domain` | NA | NA | +`AWS::CustomerProfiles::ObjectType` | NA | NA | @@ -164,3 +175,4 @@ Amazon Connect Customer Profiles | `AWS::CustomerProfiles::Domain` | NA | NA -AWS Service | Resource Type Value | Relationship | Related Resource