AWS Config now supports 191 additional managed rules
AWS Config now supports 191 additional managed rules across key services including Amazon Bedrock, Amazon SageMaker, Amazon ECS, Amazon EKS, Amazon RDS, Amazon Redshift, Amazon S3, and Amazon CloudTrail. This expansion increases built-in governance coverage across AI workloads and core cloud infrastructure. Examples of the new managed rules include evaluating resource configurations for encryption, logging, public access, network security, data protection, and other operational best practices across AWS services.
With this launch, you can deploy these new managed rules individually or as part of a conformance pack in the AWS Regions where the corresponding AWS services are available.
AWS Certificate Manager
- ACM_CERTIFICATE_RSA_CHECK
Amazon API Gateway
- API_GWV2_ACCESS_LOGS_ENABLED
AWS AppSync
- APPSYNC_AUTHORIZATION_CHECK
- APPSYNC_LOGGING_ENABLED
Amazon Athena
- ATHENA_WORKGROUP_ENCRYPTED_AT_REST
- ATHENA_WORKGROUP_LOGGING_ENABLED
Amazon Aurora
- AURORA_MYSQL_CLUSTER_AUDIT_LOGGING
Amazon Bedrock
- BEDROCKAGENTCORE_BROWSERCUSTOM_NETWORK_MODE_NOT_PUBLIC
- BEDROCKAGENTCORE_BROWSERCUSTOM_RECORDING_ENABLED
- BEDROCKAGENTCORE_CODEINTERPRETER_NETWORKMODE_CHECK
- BEDROCKAGENTCORE_GATEWAY_AUTHORIZER_ENABLED
- BEDROCKAGENTCORE_GATEWAY_ENCRYPTION_ENABLED
- BEDROCKAGENTCORE_RUNTIME_PRIVATE_NETWORK_REQUIRED
- BEDROCK_AGENTCORE_MEMORY_ENCRYPTION_ENABLED
- BEDROCK_AGENTCORE_MEMORY_EVENT_EXPIRY_DURATION
- BEDROCK_DATA_SOURCE_ENCRYPTION_ENABLED
AWS CloudFormation
- CLOUDFORMATION_STACK_SERVICE_ROLE_CHECK
- CLOUDFORMATION_TERMINATION_PROTECTION_CHECK
AWS CloudTrail
- CLOUDTRAIL_ALL_READ_S3_DATA_EVENT_CHECK
- CLOUDTRAIL_ALL_WRITE_S3_DATA_EVENT_CHECK
- CLOUDTRAIL_S3_BUCKET_ACCESS_LOGGING
- CLOUDTRAIL_S3_BUCKET_PUBLIC_ACCESS_PROHIBITED
- EVENT_DATA_STORE_CMK_ENCRYPTION_ENABLED
Amazon CloudWatch
- CLOUDWATCH_ALARM_ACTION_ENABLED_CHECK
Amazon Cognito
- COGNITO_IDENTITY_POOL_UNAUTH_ACCESS_CHECK
- COGNITO_USERPOOL_CUST_AUTH_THREAT_FULL_CHECK
- COGNITO_USER_POOL_ADVANCED_SECURITY_ENABLED
- COGNITO_USER_POOL_MFA_ENABLED
- COGNITO_USER_POOL_PASSWORD_POLICY_CHECK
AWS CodeBuild
- CODEBUILD_PROJECT_ARTIFACT_ENCRYPTION
- CODEBUILD_PROJECT_ENVIRONMENT_PRIVILEGED_CHECK
- CODEBUILD_PROJECT_LOGGING_ENABLED
- CODEBUILD_PROJECT_S3_LOGS_ENCRYPTED
AWS DataSync
- DATASYNC_TASK_LOGGING_ENABLED
AWS Database Migration Service (DMS)
- DMS_REPLICATION_TASK_SOURCEDB_LOGGING
- DMS_REPLICATION_TASK_TARGETDB_LOGGING
Amazon DocumentDB
- DOCDB_CLUSTER_AUDIT_LOGGING_ENABLED
- DOCDB_CLUSTER_DELETION_PROTECTION_ENABLED
- DOCDB_CLUSTER_ENCRYPTED_IN_TRANSIT
- DOCDB_CLUSTER_SNAPSHOT_PUBLIC_PROHIBITED
Amazon DynamoDB
- DYNAMODB_TABLE_DELETION_PROTECTION_ENABLED
Amazon EC2
- EC2_ENIS_SOURCE_DESTINATION_CHECK_ENABLED
- EC2_INSTANCE_LAUNCHED_WITH_ALLOWED_AMI
- EC2_LAUNCH_TEMPLATES_EBS_VOLUME_ENCRYPTED
- EC2_LAUNCH_TEMPLATE_IMDSV2_CHECK
- EC2_LAUNCH_TEMPLATE_PUBLIC_IP_DISABLED
- EC2_SECURITY_GROUP_ATTACHED_TO_ENI
- EC2_SPOT_FLEET_REQUEST_CT_ENCRYPTION_AT_REST
- EC2_STOPPED_INSTANCE_DAYS_CHECK_PVT
- EC2_TRANSIT_GATEWAY_AUTO_VPC_ATTACH_DISABLED
- EC2_VPN_CONNECTION_IKE_VERSION_CHECK
- EC2_VPN_CONNECTION_LOGGING_ENABLED
- INSTANCES_IN_VPC
Amazon EC2 Auto Scaling
- AUTOSCALING_LAUNCH_TEMPLATE
- AUTOSCALING_MULTIPLE_AZ
- AUTOSCALING_MULTIPLE_INSTANCE_TYPES
Amazon ECR
- ECR_PRIVATE_IMAGE_SCANNING_ENABLED
- ECR_PRIVATE_LIFECYCLE_POLICY_CONFIGURED
- ECR_PRIVATE_TAG_IMMUTABILITY_ENABLED
- ECR_REPOSITORY_CMK_ENCRYPTION_ENABLED
Amazon ECS
- ECS_CONTAINERS_NONPRIVILEGED
- ECS_CONTAINERS_READONLY_ACCESS
- ECS_CONTAINER_INSIGHTS_ENABLED
- ECS_FARGATE_LATEST_PLATFORM_VERSION
- ECS_NO_ENVIRONMENT_SECRETS
- ECS_TASK_DEFINITION_EFS_ENCRYPTION_ENABLED
- ECS_TASK_DEFINITION_LINUX_USER_NON_ROOT
- ECS_TASK_DEFINITION_LOG_CONFIGURATION
- ECS_TASK_DEFINITION_NETWORK_MODE_NOT_HOST
- ECS_TASK_DEFINITION_PID_MODE_CHECK
- ECS_TASK_DEFINITION_USER_FOR_HOST_MODE_CHECK
- ECS_TASK_DEFINITION_WINDOWS_USER_NON_ADMIN
Amazon EFS
- EFS_ACCESS_POINT_ENFORCE_ROOT_DIRECTORY
- EFS_ACCESS_POINT_ENFORCE_USER_IDENTITY
- EFS_AUTOMATIC_BACKUPS_ENABLED
- EFS_FILESYSTEM_CT_ENCRYPTED
- EFS_MOUNT_TARGET_PUBLIC_ACCESSIBLE
Amazon EKS
- EKS_NODEGROUP_SUPPORTED_VERSION_CHECK
AWS Elastic Beanstalk
- BEANSTALK_ENHANCED_HEALTH_REPORTING_ENABLED
Amazon ElastiCache
- ELASTICACHE_AUTOMATIC_BACKUP_CHECK_ENABLED
- ELASTICACHE_AUTO_MINOR_VERSION_UPGRADE_CHECK
- ELASTICACHE_REPL_GRP_AUTO_FAILOVER_ENABLED
- ELASTICACHE_REPL_GRP_ENCRYPTED_AT_REST
- ELASTICACHE_SUBNET_GROUP_CHECK
- ELASTICACHE_SUPPORTED_ENGINE_VERSION
Elastic Load Balancing
- ALB_DESYNC_MODE_CHECK
- CLB_DESYNC_MODE_CHECK
- CLB_MULTIPLE_AZ
- ELBV2_LISTENER_ENCRYPTION_IN_TRANSIT
- ELBV2_MULTIPLE_AZ
- ELBV2_PREDEFINED_SECURITY_POLICY_SSL_CHECK
- NLB_CROSS_ZONE_LOAD_BALANCING_ENABLED
Amazon EMR
- EMR_BLOCK_PUBLIC_ACCESS
Amazon EventBridge
- CUSTOM_EVENTBUS_POLICY_ATTACHED
Amazon FSx
- FSX_LUSTRE_COPY_TAGS_TO_BACKUPS
- FSX_OPENZFS_COPY_TAGS_ENABLED
- FSX_OPENZFS_DEPLOYMENT_TYPE_CHECK
- FSX_WINDOWS_AUDIT_LOG_CONFIGURED
- FSX_WINDOWS_DEPLOYMENT_TYPE_CHECK
AWS Glue
- GLUE_ML_TRANSFORM_ENCRYPTED_AT_REST
Amazon GuardDuty
- GUARDDUTY_ECS_PROTECTION_RUNTIME_ENABLED
- GUARDDUTY_EKS_PROTECTION_AUDIT_ENABLED
- GUARDDUTY_LAMBDA_PROTECTION_ENABLED
- GUARDDUTY_MALWARE_PROTECTION_ENABLED
- GUARDDUTY_RUNTIME_MONITORING_ENABLED
- GUARDDUTY_S3_PROTECTION_ENABLED
IAM
- IAM_EXTERNAL_ACCESS_ANALYZER_ENABLED
- IAM_SERVER_CERTIFICATE_EXPIRATION_CHECK
Amazon Kendra
- KENDRA_INDEX_TAGGED
Amazon Kinesis
- KINESIS_FIREHOSE_DELIVERY_STREAM_ENCRYPTED
- KINESIS_STREAM_BACKUP_RETENTION_CHECK
- KINESIS_STREAM_ENCRYPTED
AWS KMS
- KMS_KEY_POLICY_NO_PUBLIC_ACCESS
AWS Lambda
- LAMBDA_FUNCTION_XRAY_ENABLED
- LAMBDA_VPC_MULTI_AZ_CHECK
Amazon Neptune
- NEPTUNE_CLUSTER_BACKUP_RETENTION_CHECK
- NEPTUNE_CLUSTER_COPY_TAGS_TO_SNAPSHOT_ENABLED
- NEPTUNE_CLUSTER_DELETION_PROTECTION_ENABLED
- NEPTUNE_CLUSTER_ENCRYPTED
- NEPTUNE_CLUSTER_IAM_DATABASE_AUTHENTICATION
- NEPTUNE_CLUSTER_MULTI_AZ_ENABLED
- NEPTUNE_CLUSTER_SNAPSHOT_ENCRYPTED
- NEPTUNE_CLUSTER_SNAPSHOT_PUBLIC_PROHIBITED
AWS Network Firewall
- NETFW_LOGGING_ENABLED
- NETFW_SUBNET_CHANGE_PROTECTION_ENABLED
Amazon OpenSearch Service
- OPENSEARCH_ENCRYPTED_AT_REST
- OPENSEARCH_HTTPS_REQUIRED
- OPENSEARCH_NODE_TO_NODE_ENCRYPTION_CHECK
Amazon RDS
- MARIADB_PUBLISH_LOGS_TO_CLOUDWATCH_LOGS
- RDS_AURORA_MYSQL_AUDIT_LOGGING_ENABLED
- RDS_AURORA_POSTGRESQL_LOGS_TO_CLOUDWATCH
- RDS_CLUSTER_DEFAULT_ADMIN_CHECK
- RDS_CLUSTER_ENCRYPTED_AT_REST
- RDS_GLOBAL_CLUSTER_AURORA_POSTGRESQL_SUPPORTED_VERSION
- RDS_INSTANCE_DEFAULT_ADMIN_CHECK
- RDS_INSTANCE_SUBNET_IGW_CHECK
- RDS_MARIADB_INSTANCE_ENCRYPTED_IN_TRANSIT
- RDS_MYSQL_INSTANCE_ENCRYPTED_IN_TRANSIT
- RDS_PGSQL_CLUSTER_COPY_TAGS_TO_SNAPSHOT_CHECK
- RDS_POSTGRESQL_LOGS_TO_CLOUDWATCH
- RDS_POSTGRES_INSTANCE_ENCRYPTED_IN_TRANSIT
- RDS_PROXY_TLS_ENCRYPTION
- RDS_SNAPSHOT_ENCRYPTED
- RDS_SQLSERVER_ENCRYPTED_IN_TRANSIT
- RDS_SQL_SERVER_LOGS_TO_CLOUDWATCH
Amazon Redshift
- REDSHIFT_CLUSTER_MULTI_AZ_ENABLED
- REDSHIFT_CLUSTER_SUBNET_GROUP_MULTI_AZ
- REDSHIFT_DEFAULT_ADMIN_CHECK
- REDSHIFT_SERVERLESS_DEFAULT_ADMIN_CHECK
- REDSHIFT_SERVERLESS_NAMESPACE_CMK_ENCRYPTION
- REDSHIFT_SERVERLESS_PUBLISH_LOGS_TO_CLOUDWATCH
- REDSHIFT_SERVERLESS_WORKGROUP_ENCRYPTED_IN_TRANSIT
- REDSHIFT_SERVERLESS_WORKGROUP_NO_PUBLIC_ACCESS
- REDSHIFT_SERVERLESS_WORKGROUP_ROUTES_WITHIN_VPC
- REDSHIFT_UNRESTRICTED_PORT_ACCESS
Amazon S3
- S3_ACCESS_POINT_IN_VPC_ONLY
- S3_ACCESS_POINT_PUBLIC_ACCESS_BLOCKS
- S3_BUCKET_ACL_PROHIBITED
- S3_BUCKET_CROSS_REGION_REPLICATION_ENABLED
- S3_BUCKET_MFA_DELETE_ENABLED
- S3_EVENT_NOTIFICATIONS_ENABLED
- S3_LIFECYCLE_POLICY_CHECK
- S3_VERSION_LIFECYCLE_POLICY_CHECK
Amazon SageMaker
- SAGEMAKER_ENDPOINT_CONFIG_KMS_KEY_REQUIRED
- SAGEMAKER_FEATUREGROUP_ENCRYPTION_AT_REST
- SAGEMAKER_FEATUREGROUP_ONLINE_STORE_ENCRYPTION
- SAGEMAKER_INF_EXPERIMENT_DATA_STORAGE_KMS_ENCRYPTED
- SAGEMAKER_INF_EXPERIMENT_INSTANCE_STORAGE_KMS_ENCRYPTED
- SAGEMAKER_MODEL_EXPLAINABILITY_JOB_NETWORK_ISOLATION
- SAGEMAKER_MODEL_MULTICONTAINER_PRIVATE_REGISTRY
- SAGEMAKER_MODEL_PRIVATE_REGISTRY_REQUIRED
- SAGEMAKER_MODEL_QUALITY_JOB_DEFINITION_ISOLATION
- SAGEMAKER_MONITORING_SCHEDULE_TRAFFIC_ENCRYPTION
- SAGEMAKER_NOTEBOOK_INSTANCE_INSIDE_VPC
- SAGEMAKER_NOTEBOOK_INSTANCE_ROOT_ACCESS_CHECK
- SAGEMAKER_NOTEBOOK_INSTANCE_STORAGE_VOL_KMS_ENCRYPTED
AWS Account Management
- SECURITY_ACCOUNT_INFORMATION_PROVIDED
Amazon SNS
- SNS_TOPIC_MESSAGE_DELIVERY_NOTIFICATION_ENABLED
- SNS_TOPIC_NO_PUBLIC_ACCESS
Amazon SQS
- SQS_QUEUE_DLQ_CHECK
- SQS_QUEUE_NO_PUBLIC_ACCESS
- SQS_QUEUE_POLICY_FULL_ACCESS_CHECK
AWS Systems Manager
- SSM_AUTOMATION_BLOCK_PUBLIC_SHARING
- SSM_AUTOMATION_LOGGING_ENABLED
AWS Transfer Family
- TRANSFER_CONNECTOR_LOGGING_ENABLED
Amazon VPC
- NACL_NO_UNRESTRICTED_SSH_RDP
- VPC_ENDPOINT_ENABLED
- VPC_PEERING_DNS_RESOLUTION_CHECK
- VPC_SG_PORT_RESTRICTION_CHECK
AWS WAF
- WAFV2_RULEGROUP_LOGGING_ENABLED
- WAFV2_WEBACL_NOT_EMPTY