AWS config documentation change
Summary
Added multiple new AWS Config managed rules to the documentation across various AWS regions, including rules for VPN IKE version checks, EKS nodegroup version checks, Kendra tagging, SageMaker encryption, S3 event notifications, ACM certificate checks, ALB desync mode, DynamoDB deletion protection, ECR image scanning, ECS container security, Kinesis encryption, Lambda VPC multi-AZ, S3 bucket ACLs, VPC endpoints, DMS logging, Athena logging, EventBridge policies, EFS access point controls, IAM certificate expiration, and S3 lifecycle policies.
Security assessment
The changes document the availability of new AWS Config managed rules that help enforce security and compliance best practices. While many rules address security controls (encryption, access controls, logging, etc.), there is no evidence in the diff that these additions are in direct response to a specific security vulnerability, weakness, or incident. The updates appear to be routine documentation of new feature releases.
Diff
diff --git a/config/latest/developerguide/managing-rules-by-region-availability.md b/config/latest/developerguide/managing-rules-by-region-availability.md index 4fdce193d..19438e796 100644 --- a//config/latest/developerguide/managing-rules-by-region-availability.md +++ b//config/latest/developerguide/managing-rules-by-region-availability.md @@ -580,0 +581,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-ike-version-check](./ec2-vpn-connection-ike-version-check.html) + @@ -672,0 +675,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-nodegroup-supported-version-check](./eks-nodegroup-supported-version-check.html) + @@ -940,0 +945,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [kendra-index-tagged](./kendra-index-tagged.html) + @@ -1332,0 +1339,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-featuregroup-encryption-at-rest](./sagemaker-featuregroup-encryption-at-rest.html) + @@ -1350,0 +1359,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-private-registry-required](./sagemaker-model-private-registry-required.html) + @@ -2113,0 +2124,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-ike-version-check](./ec2-vpn-connection-ike-version-check.html) + @@ -2205,0 +2218,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-nodegroup-supported-version-check](./eks-nodegroup-supported-version-check.html) + @@ -2507,0 +2522,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [kendra-index-tagged](./kendra-index-tagged.html) + @@ -2909,0 +2926,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-featuregroup-encryption-at-rest](./sagemaker-featuregroup-encryption-at-rest.html) + @@ -2927,0 +2946,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-private-registry-required](./sagemaker-model-private-registry-required.html) + @@ -3618,0 +3639,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-ike-version-check](./ec2-vpn-connection-ike-version-check.html) + @@ -3710,0 +3733,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-nodegroup-supported-version-check](./eks-nodegroup-supported-version-check.html) + @@ -4292,0 +4317,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-featuregroup-encryption-at-rest](./sagemaker-featuregroup-encryption-at-rest.html) + @@ -4310,0 +4337,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-private-registry-required](./sagemaker-model-private-registry-required.html) + @@ -5043,0 +5072,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-ike-version-check](./ec2-vpn-connection-ike-version-check.html) + @@ -5135,0 +5166,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-nodegroup-supported-version-check](./eks-nodegroup-supported-version-check.html) + @@ -5427,0 +5460,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [kendra-index-tagged](./kendra-index-tagged.html) + @@ -5833,0 +5868,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-featuregroup-encryption-at-rest](./sagemaker-featuregroup-encryption-at-rest.html) + @@ -5851,0 +5888,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-private-registry-required](./sagemaker-model-private-registry-required.html) + @@ -6486,0 +6525,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-ike-version-check](./ec2-vpn-connection-ike-version-check.html) + @@ -6578,0 +6619,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-nodegroup-supported-version-check](./eks-nodegroup-supported-version-check.html) + @@ -7118,0 +7161,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-featuregroup-encryption-at-rest](./sagemaker-featuregroup-encryption-at-rest.html) + @@ -7130,0 +7175,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-private-registry-required](./sagemaker-model-private-registry-required.html) + @@ -7799,0 +7846,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-ike-version-check](./ec2-vpn-connection-ike-version-check.html) + @@ -7891,0 +7940,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-nodegroup-supported-version-check](./eks-nodegroup-supported-version-check.html) + @@ -8469,0 +8520,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-featuregroup-encryption-at-rest](./sagemaker-featuregroup-encryption-at-rest.html) + @@ -8487,0 +8540,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-private-registry-required](./sagemaker-model-private-registry-required.html) + @@ -8968,0 +9023,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-ike-version-check](./ec2-vpn-connection-ike-version-check.html) + @@ -9050,0 +9107,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-nodegroup-supported-version-check](./eks-nodegroup-supported-version-check.html) + @@ -9925,0 +9984,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-ike-version-check](./ec2-vpn-connection-ike-version-check.html) + @@ -10009,0 +10070,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-nodegroup-supported-version-check](./eks-nodegroup-supported-version-check.html) + @@ -10479,0 +10542,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [s3-event-notifications-enabled](./s3-event-notifications-enabled.html) + @@ -10501,0 +10566,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-featuregroup-encryption-at-rest](./sagemaker-featuregroup-encryption-at-rest.html) + @@ -10628,0 +10695,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [acm-certificate-rsa-check](./acm-certificate-rsa-check.html) + @@ -10630,0 +10699,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [alb-desync-mode-check](./alb-desync-mode-check.html) + @@ -10724,0 +10795,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [dynamodb-table-deletion-protection-enabled](./dynamodb-table-deletion-protection-enabled.html) + @@ -10770,0 +10843,8 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecr-private-image-scanning-enabled](./ecr-private-image-scanning-enabled.html) + + * [ecs-containers-nonprivileged](./ecs-containers-nonprivileged.html) + + * [ecs-containers-readonly-access](./ecs-containers-readonly-access.html) + + * [ecs-container-insights-enabled](./ecs-container-insights-enabled.html) + @@ -10780,0 +10861,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-log-configuration](./ecs-task-definition-log-configuration.html) + @@ -10782,0 +10865,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ecs-task-definition-pid-mode-check](./ecs-task-definition-pid-mode-check.html) + @@ -10794,0 +10879,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-nodegroup-supported-version-check](./eks-nodegroup-supported-version-check.html) + @@ -10846,0 +10933,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [kinesis-firehose-delivery-stream-encrypted](./kinesis-firehose-delivery-stream-encrypted.html) + @@ -10868,0 +10957,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [lambda-vpc-multi-az-check](./lambda-vpc-multi-az-check.html) + @@ -10936,0 +11027,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [s3-bucket-acl-prohibited](./s3-bucket-acl-prohibited.html) + @@ -10938,0 +11031,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [s3-bucket-cross-region-replication-enabled](./s3-bucket-cross-region-replication-enabled.html) + @@ -10962,0 +11057,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [s3-event-notifications-enabled](./s3-event-notifications-enabled.html) + @@ -10964,0 +11061,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [s3-version-lifecycle-policy-check](./s3-version-lifecycle-policy-check.html) + @@ -10986,0 +11085,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [vpc-endpoint-enabled](./vpc-endpoint-enabled.html) + @@ -10992,0 +11093,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [vpc-sg-port-restriction-check](./vpc-sg-port-restriction-check.html) + @@ -11335,0 +11438,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-ike-version-check](./ec2-vpn-connection-ike-version-check.html) + @@ -11417,0 +11522,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-nodegroup-supported-version-check](./eks-nodegroup-supported-version-check.html) + @@ -12460,0 +12567,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-ike-version-check](./ec2-vpn-connection-ike-version-check.html) + @@ -12552,0 +12661,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-nodegroup-supported-version-check](./eks-nodegroup-supported-version-check.html) + @@ -12808,0 +12919,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [kendra-index-tagged](./kendra-index-tagged.html) + @@ -13200,0 +13313,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-featuregroup-encryption-at-rest](./sagemaker-featuregroup-encryption-at-rest.html) + @@ -13218,0 +13333,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-private-registry-required](./sagemaker-model-private-registry-required.html) + @@ -13725,0 +13842,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [dms-replication-task-sourcedb-logging](./dms-replication-task-sourcedb-logging.html) + @@ -13727,0 +13846,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [dms-replication-task-targetdb-logging](./dms-replication-task-targetdb-logging.html) + @@ -13851,0 +13972,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-ike-version-check](./ec2-vpn-connection-ike-version-check.html) + @@ -13935,0 +14058,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-nodegroup-supported-version-check](./eks-nodegroup-supported-version-check.html) + @@ -14473,0 +14598,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-featuregroup-encryption-at-rest](./sagemaker-featuregroup-encryption-at-rest.html) + @@ -14593,0 +14720,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [vpc-endpoint-enabled](./vpc-endpoint-enabled.html) + @@ -15178,0 +15307,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [ec2-vpn-connection-ike-version-check](./ec2-vpn-connection-ike-version-check.html) + @@ -15270,0 +15401,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [eks-nodegroup-supported-version-check](./eks-nodegroup-supported-version-check.html) + @@ -15914,0 +16047,2 @@ AWS Config currently supports the following managed rules. Before using these ru