AWS config documentation change
Summary
Added multiple new AWS Config managed rules including bedrockagentcore-codeinterpreter-networkmode-check, bedrock-data-source-encryption-enabled, sagemaker-endpoint-config-kms-key-required, sagemaker-inf-experiment-data-storage-kms-encrypted, sagemaker-inf-experiment-instance-storage-kms-encrypted, sagemaker-model-explainability-job-network-isolation, sagemaker-model-quality-job-definition-isolation, sagemaker-monitoring-schedule-traffic-encryption, sagemaker-notebook-instance-storage-vol-kms-encrypted, guardduty-lambda-protection-enabled, rds-aurora-mysql-audit-logging-enabled, rds-cluster-default-admin-check, and others across various service sections.
Security assessment
The changes add documentation for new security-focused Config rules that enforce encryption (KMS), network isolation, audit logging, access controls, and security best practices. Examples include encryption checks for SageMaker/Bedrock data sources, network mode restrictions, GuardDuty protections, and RDS admin validations. These are proactive security controls rather than responses to specific vulnerabilities.
Diff
diff --git a/config/latest/developerguide/managing-rules-by-region-availability.md b/config/latest/developerguide/managing-rules-by-region-availability.md index 75117bd2c..8f3d9945a 100644 --- a//config/latest/developerguide/managing-rules-by-region-availability.md +++ b//config/latest/developerguide/managing-rules-by-region-availability.md @@ -278,0 +279,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [bedrockagentcore-codeinterpreter-networkmode-check](./bedrockagentcore-codeinterpreter-networkmode-check.html) + @@ -284,0 +287,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [bedrock-data-source-encryption-enabled](./bedrock-data-source-encryption-enabled.html) + @@ -1342,0 +1347,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-endpoint-config-kms-key-required](./sagemaker-endpoint-config-kms-key-required.html) + @@ -1358,0 +1365,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-inf-experiment-data-storage-kms-encrypted](./sagemaker-inf-experiment-data-storage-kms-encrypted.html) + + * [sagemaker-inf-experiment-instance-storage-kms-encrypted](./sagemaker-inf-experiment-instance-storage-kms-encrypted.html) + @@ -1364,0 +1375,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-explainability-job-network-isolation](./sagemaker-model-explainability-job-network-isolation.html) + @@ -1372,0 +1385,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-quality-job-definition-isolation](./sagemaker-model-quality-job-definition-isolation.html) + @@ -1376,0 +1391,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-monitoring-schedule-traffic-encryption](./sagemaker-monitoring-schedule-traffic-encryption.html) + @@ -1384,0 +1401,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-notebook-instance-storage-vol-kms-encrypted](./sagemaker-notebook-instance-storage-vol-kms-encrypted.html) + @@ -1785,0 +1804,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [bedrockagentcore-codeinterpreter-networkmode-check](./bedrockagentcore-codeinterpreter-networkmode-check.html) + @@ -1791,0 +1812,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [bedrock-data-source-encryption-enabled](./bedrock-data-source-encryption-enabled.html) + @@ -2935,0 +2958,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-endpoint-config-kms-key-required](./sagemaker-endpoint-config-kms-key-required.html) + @@ -2951,0 +2976,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-inf-experiment-data-storage-kms-encrypted](./sagemaker-inf-experiment-data-storage-kms-encrypted.html) + + * [sagemaker-inf-experiment-instance-storage-kms-encrypted](./sagemaker-inf-experiment-instance-storage-kms-encrypted.html) + @@ -2957,0 +2986,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-explainability-job-network-isolation](./sagemaker-model-explainability-job-network-isolation.html) + @@ -2965,0 +2996,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-quality-job-definition-isolation](./sagemaker-model-quality-job-definition-isolation.html) + @@ -2969,0 +3002,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-monitoring-schedule-traffic-encryption](./sagemaker-monitoring-schedule-traffic-encryption.html) + @@ -2977,0 +3012,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-notebook-instance-storage-vol-kms-encrypted](./sagemaker-notebook-instance-storage-vol-kms-encrypted.html) + @@ -4330,0 +4367,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-endpoint-config-kms-key-required](./sagemaker-endpoint-config-kms-key-required.html) + @@ -4346,0 +4385,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-inf-experiment-data-storage-kms-encrypted](./sagemaker-inf-experiment-data-storage-kms-encrypted.html) + + * [sagemaker-inf-experiment-instance-storage-kms-encrypted](./sagemaker-inf-experiment-instance-storage-kms-encrypted.html) + @@ -4352,0 +4395,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-explainability-job-network-isolation](./sagemaker-model-explainability-job-network-isolation.html) + @@ -4360,0 +4405,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-quality-job-definition-isolation](./sagemaker-model-quality-job-definition-isolation.html) + @@ -4364,0 +4411,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-monitoring-schedule-traffic-encryption](./sagemaker-monitoring-schedule-traffic-encryption.html) + @@ -4372,0 +4421,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-notebook-instance-storage-vol-kms-encrypted](./sagemaker-notebook-instance-storage-vol-kms-encrypted.html) + @@ -4769,0 +4820,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [bedrockagentcore-codeinterpreter-networkmode-check](./bedrockagentcore-codeinterpreter-networkmode-check.html) + @@ -4773,0 +4826,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [bedrock-data-source-encryption-enabled](./bedrock-data-source-encryption-enabled.html) + @@ -5885,0 +5940,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-endpoint-config-kms-key-required](./sagemaker-endpoint-config-kms-key-required.html) + @@ -5901,0 +5958,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-inf-experiment-data-storage-kms-encrypted](./sagemaker-inf-experiment-data-storage-kms-encrypted.html) + + * [sagemaker-inf-experiment-instance-storage-kms-encrypted](./sagemaker-inf-experiment-instance-storage-kms-encrypted.html) + @@ -5907,0 +5968,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-explainability-job-network-isolation](./sagemaker-model-explainability-job-network-isolation.html) + @@ -5915,0 +5978,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-quality-job-definition-isolation](./sagemaker-model-quality-job-definition-isolation.html) + @@ -5927,0 +5992,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-notebook-instance-storage-vol-kms-encrypted](./sagemaker-notebook-instance-storage-vol-kms-encrypted.html) + @@ -7178,0 +7245,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-endpoint-config-kms-key-required](./sagemaker-endpoint-config-kms-key-required.html) + @@ -7194,0 +7263,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-inf-experiment-data-storage-kms-encrypted](./sagemaker-inf-experiment-data-storage-kms-encrypted.html) + + * [sagemaker-inf-experiment-instance-storage-kms-encrypted](./sagemaker-inf-experiment-instance-storage-kms-encrypted.html) + @@ -7210,0 +7283,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-notebook-instance-storage-vol-kms-encrypted](./sagemaker-notebook-instance-storage-vol-kms-encrypted.html) + @@ -8537,0 +8612,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-endpoint-config-kms-key-required](./sagemaker-endpoint-config-kms-key-required.html) + @@ -8553,0 +8630,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-inf-experiment-data-storage-kms-encrypted](./sagemaker-inf-experiment-data-storage-kms-encrypted.html) + + * [sagemaker-inf-experiment-instance-storage-kms-encrypted](./sagemaker-inf-experiment-instance-storage-kms-encrypted.html) + @@ -8559,0 +8640,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-explainability-job-network-isolation](./sagemaker-model-explainability-job-network-isolation.html) + @@ -8567,0 +8650,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-quality-job-definition-isolation](./sagemaker-model-quality-job-definition-isolation.html) + @@ -8571,0 +8656,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-monitoring-schedule-traffic-encryption](./sagemaker-monitoring-schedule-traffic-encryption.html) + @@ -8579,0 +8666,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-notebook-instance-storage-vol-kms-encrypted](./sagemaker-notebook-instance-storage-vol-kms-encrypted.html) + @@ -8842,0 +8931,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [bedrock-data-source-encryption-enabled](./bedrock-data-source-encryption-enabled.html) + @@ -10575,0 +10666,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-endpoint-config-kms-key-required](./sagemaker-endpoint-config-kms-key-required.html) + @@ -10601,0 +10694,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-notebook-instance-storage-vol-kms-encrypted](./sagemaker-notebook-instance-storage-vol-kms-encrypted.html) + @@ -10926,0 +11021,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [guardduty-lambda-protection-enabled](./guardduty-lambda-protection-enabled.html) + @@ -10970,0 +11067,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [rds-aurora-mysql-audit-logging-enabled](./rds-aurora-mysql-audit-logging-enabled.html) + @@ -10974,0 +11073,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [rds-cluster-default-admin-check](./rds-cluster-default-admin-check.html) + @@ -12260,0 +12361,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [bedrockagentcore-codeinterpreter-networkmode-check](./bedrockagentcore-codeinterpreter-networkmode-check.html) + @@ -12266,0 +12369,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [bedrock-data-source-encryption-enabled](./bedrock-data-source-encryption-enabled.html) + @@ -13306,0 +13411,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-endpoint-config-kms-key-required](./sagemaker-endpoint-config-kms-key-required.html) + @@ -13322,0 +13429,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-inf-experiment-data-storage-kms-encrypted](./sagemaker-inf-experiment-data-storage-kms-encrypted.html) + + * [sagemaker-inf-experiment-instance-storage-kms-encrypted](./sagemaker-inf-experiment-instance-storage-kms-encrypted.html) + @@ -13328,0 +13439,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-explainability-job-network-isolation](./sagemaker-model-explainability-job-network-isolation.html) + @@ -13336,0 +13449,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-model-quality-job-definition-isolation](./sagemaker-model-quality-job-definition-isolation.html) + @@ -13340,0 +13455,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-monitoring-schedule-traffic-encryption](./sagemaker-monitoring-schedule-traffic-encryption.html) + @@ -13348,0 +13465,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [sagemaker-notebook-instance-storage-vol-kms-encrypted](./sagemaker-notebook-instance-storage-vol-kms-encrypted.html) + @@ -13483,0 +13602,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [alb-desync-mode-check](./alb-desync-mode-check.html) + @@ -13497,0 +13618,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [autoscaling-multiple-az](./autoscaling-multiple-az.html) + + * [autoscaling-multiple-instance-types](./autoscaling-multiple-instance-types.html) + @@ -13499,0 +13624,4 @@ AWS Config currently supports the following managed rules. Before using these ru + * [clb-desync-mode-check](./clb-desync-mode-check.html) + + * [clb-multiple-az](./clb-multiple-az.html) + @@ -13503,0 +13632,6 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudformation-termination-protection-check](./cloudformation-termination-protection-check.html) + + * [cloudtrail-all-read-s3-data-event-check](./cloudtrail-all-read-s3-data-event-check.html) + + * [cloudtrail-all-write-s3-data-event-check](./cloudtrail-all-write-s3-data-event-check.html) + @@ -13509,0 +13644,2 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cloudwatch-alarm-action-enabled-check](./cloudwatch-alarm-action-enabled-check.html) + @@ -13525,0 +13662,12 @@ AWS Config currently supports the following managed rules. Before using these ru + * [cognito-identity-pool-unauth-access-check](./cognito-identity-pool-unauth-access-check.html) +