AWS Config now supports 191 additional managed rules

AWS Config now supports 191 additional managed rules across key services including Amazon Bedrock, Amazon SageMaker, Amazon ECS, Amazon EKS, Amazon RDS, Amazon Redshift, Amazon S3, and Amazon CloudTrail. This expansion increases built-in governance coverage across AI workloads and core cloud infrastructure. Examples of the new managed rules include evaluating resource configurations for encryption, logging, public access, network security, data protection, and other operational best practices across AWS services.

With this launch, you can deploy these new managed rules individually or as part of a conformance pack in the AWS Regions where the corresponding AWS services are available.

AWS Certificate Manager

• ACM_CERTIFICATE_RSA_CHECK

Amazon API Gateway

• API_GWV2_ACCESS_LOGS_ENABLED

AWS AppSync

• APPSYNC_AUTHORIZATION_CHECK

• APPSYNC_LOGGING_ENABLED

Amazon Athena

• ATHENA_WORKGROUP_ENCRYPTED_AT_REST

• ATHENA_WORKGROUP_LOGGING_ENABLED

Amazon Aurora

• AURORA_MYSQL_CLUSTER_AUDIT_LOGGING

Amazon Bedrock

• BEDROCKAGENTCORE_BROWSERCUSTOM_NETWORK_MODE_NOT_PUBLIC

• BEDROCKAGENTCORE_BROWSERCUSTOM_RECORDING_ENABLED

• BEDROCKAGENTCORE_CODEINTERPRETER_NETWORKMODE_CHECK

• BEDROCKAGENTCORE_GATEWAY_AUTHORIZER_ENABLED

• BEDROCKAGENTCORE_GATEWAY_ENCRYPTION_ENABLED

• BEDROCKAGENTCORE_RUNTIME_PRIVATE_NETWORK_REQUIRED

• BEDROCK_AGENTCORE_MEMORY_ENCRYPTION_ENABLED

• BEDROCK_AGENTCORE_MEMORY_EVENT_EXPIRY_DURATION

• BEDROCK_DATA_SOURCE_ENCRYPTION_ENABLED

AWS CloudFormation

• CLOUDFORMATION_STACK_SERVICE_ROLE_CHECK

• CLOUDFORMATION_TERMINATION_PROTECTION_CHECK

AWS CloudTrail

• CLOUDTRAIL_ALL_READ_S3_DATA_EVENT_CHECK

• CLOUDTRAIL_ALL_WRITE_S3_DATA_EVENT_CHECK

• CLOUDTRAIL_S3_BUCKET_ACCESS_LOGGING

• CLOUDTRAIL_S3_BUCKET_PUBLIC_ACCESS_PROHIBITED

• EVENT_DATA_STORE_CMK_ENCRYPTION_ENABLED

Amazon CloudWatch

• CLOUDWATCH_ALARM_ACTION_ENABLED_CHECK

Amazon Cognito

• COGNITO_IDENTITY_POOL_UNAUTH_ACCESS_CHECK

• COGNITO_USERPOOL_CUST_AUTH_THREAT_FULL_CHECK

• COGNITO_USER_POOL_ADVANCED_SECURITY_ENABLED

• COGNITO_USER_POOL_MFA_ENABLED

• COGNITO_USER_POOL_PASSWORD_POLICY_CHECK

AWS CodeBuild

• CODEBUILD_PROJECT_ARTIFACT_ENCRYPTION

• CODEBUILD_PROJECT_ENVIRONMENT_PRIVILEGED_CHECK

• CODEBUILD_PROJECT_LOGGING_ENABLED

• CODEBUILD_PROJECT_S3_LOGS_ENCRYPTED

AWS DataSync

• DATASYNC_TASK_LOGGING_ENABLED

AWS Database Migration Service (DMS)

• DMS_REPLICATION_TASK_SOURCEDB_LOGGING

• DMS_REPLICATION_TASK_TARGETDB_LOGGING

Amazon DocumentDB

• DOCDB_CLUSTER_AUDIT_LOGGING_ENABLED

• DOCDB_CLUSTER_DELETION_PROTECTION_ENABLED

• DOCDB_CLUSTER_ENCRYPTED_IN_TRANSIT

• DOCDB_CLUSTER_SNAPSHOT_PUBLIC_PROHIBITED

Amazon DynamoDB

• DYNAMODB_TABLE_DELETION_PROTECTION_ENABLED

Amazon EC2

• EC2_ENIS_SOURCE_DESTINATION_CHECK_ENABLED

• EC2_INSTANCE_LAUNCHED_WITH_ALLOWED_AMI

• EC2_LAUNCH_TEMPLATES_EBS_VOLUME_ENCRYPTED

• EC2_LAUNCH_TEMPLATE_IMDSV2_CHECK

• EC2_LAUNCH_TEMPLATE_PUBLIC_IP_DISABLED

• EC2_SECURITY_GROUP_ATTACHED_TO_ENI

• EC2_SPOT_FLEET_REQUEST_CT_ENCRYPTION_AT_REST

• EC2_STOPPED_INSTANCE_DAYS_CHECK_PVT

• EC2_TRANSIT_GATEWAY_AUTO_VPC_ATTACH_DISABLED

• EC2_VPN_CONNECTION_IKE_VERSION_CHECK

• EC2_VPN_CONNECTION_LOGGING_ENABLED

• INSTANCES_IN_VPC

Amazon EC2 Auto Scaling

• AUTOSCALING_LAUNCH_TEMPLATE

• AUTOSCALING_MULTIPLE_AZ

• AUTOSCALING_MULTIPLE_INSTANCE_TYPES

Amazon ECR

• ECR_PRIVATE_IMAGE_SCANNING_ENABLED

• ECR_PRIVATE_LIFECYCLE_POLICY_CONFIGURED

• ECR_PRIVATE_TAG_IMMUTABILITY_ENABLED

• ECR_REPOSITORY_CMK_ENCRYPTION_ENABLED

Amazon ECS

• ECS_CONTAINERS_NONPRIVILEGED

• ECS_CONTAINERS_READONLY_ACCESS

• ECS_CONTAINER_INSIGHTS_ENABLED

• ECS_FARGATE_LATEST_PLATFORM_VERSION

• ECS_NO_ENVIRONMENT_SECRETS

• ECS_TASK_DEFINITION_EFS_ENCRYPTION_ENABLED

• ECS_TASK_DEFINITION_LINUX_USER_NON_ROOT

• ECS_TASK_DEFINITION_LOG_CONFIGURATION

• ECS_TASK_DEFINITION_NETWORK_MODE_NOT_HOST

• ECS_TASK_DEFINITION_PID_MODE_CHECK

• ECS_TASK_DEFINITION_USER_FOR_HOST_MODE_CHECK

• ECS_TASK_DEFINITION_WINDOWS_USER_NON_ADMIN

Amazon EFS

• EFS_ACCESS_POINT_ENFORCE_ROOT_DIRECTORY

• EFS_ACCESS_POINT_ENFORCE_USER_IDENTITY

• EFS_AUTOMATIC_BACKUPS_ENABLED

• EFS_FILESYSTEM_CT_ENCRYPTED

• EFS_MOUNT_TARGET_PUBLIC_ACCESSIBLE

Amazon EKS

• EKS_NODEGROUP_SUPPORTED_VERSION_CHECK

AWS Elastic Beanstalk

• BEANSTALK_ENHANCED_HEALTH_REPORTING_ENABLED

Amazon ElastiCache

• ELASTICACHE_AUTOMATIC_BACKUP_CHECK_ENABLED

• ELASTICACHE_AUTO_MINOR_VERSION_UPGRADE_CHECK

• ELASTICACHE_REPL_GRP_AUTO_FAILOVER_ENABLED

• ELASTICACHE_REPL_GRP_ENCRYPTED_AT_REST

• ELASTICACHE_SUBNET_GROUP_CHECK

• ELASTICACHE_SUPPORTED_ENGINE_VERSION

Elastic Load Balancing

• ALB_DESYNC_MODE_CHECK

• CLB_DESYNC_MODE_CHECK

• CLB_MULTIPLE_AZ

• ELBV2_LISTENER_ENCRYPTION_IN_TRANSIT

• ELBV2_MULTIPLE_AZ

• ELBV2_PREDEFINED_SECURITY_POLICY_SSL_CHECK

• NLB_CROSS_ZONE_LOAD_BALANCING_ENABLED

Amazon EMR

• EMR_BLOCK_PUBLIC_ACCESS

Amazon EventBridge

• CUSTOM_EVENTBUS_POLICY_ATTACHED

Amazon FSx

• FSX_LUSTRE_COPY_TAGS_TO_BACKUPS

• FSX_OPENZFS_COPY_TAGS_ENABLED

• FSX_OPENZFS_DEPLOYMENT_TYPE_CHECK

• FSX_WINDOWS_AUDIT_LOG_CONFIGURED

• FSX_WINDOWS_DEPLOYMENT_TYPE_CHECK

AWS Glue

• GLUE_ML_TRANSFORM_ENCRYPTED_AT_REST

Amazon GuardDuty

• GUARDDUTY_ECS_PROTECTION_RUNTIME_ENABLED

• GUARDDUTY_EKS_PROTECTION_AUDIT_ENABLED

• GUARDDUTY_LAMBDA_PROTECTION_ENABLED

• GUARDDUTY_MALWARE_PROTECTION_ENABLED

• GUARDDUTY_RUNTIME_MONITORING_ENABLED

• GUARDDUTY_S3_PROTECTION_ENABLED

IAM

• IAM_EXTERNAL_ACCESS_ANALYZER_ENABLED

• IAM_SERVER_CERTIFICATE_EXPIRATION_CHECK

Amazon Kendra

• KENDRA_INDEX_TAGGED

Amazon Kinesis

• KINESIS_FIREHOSE_DELIVERY_STREAM_ENCRYPTED

• KINESIS_STREAM_BACKUP_RETENTION_CHECK

• KINESIS_STREAM_ENCRYPTED

AWS KMS

• KMS_KEY_POLICY_NO_PUBLIC_ACCESS

AWS Lambda

• LAMBDA_FUNCTION_XRAY_ENABLED

• LAMBDA_VPC_MULTI_AZ_CHECK

Amazon Neptune

• NEPTUNE_CLUSTER_BACKUP_RETENTION_CHECK

• NEPTUNE_CLUSTER_COPY_TAGS_TO_SNAPSHOT_ENABLED

• NEPTUNE_CLUSTER_DELETION_PROTECTION_ENABLED

• NEPTUNE_CLUSTER_ENCRYPTED

• NEPTUNE_CLUSTER_IAM_DATABASE_AUTHENTICATION

• NEPTUNE_CLUSTER_MULTI_AZ_ENABLED

• NEPTUNE_CLUSTER_SNAPSHOT_ENCRYPTED

• NEPTUNE_CLUSTER_SNAPSHOT_PUBLIC_PROHIBITED

AWS Network Firewall

• NETFW_LOGGING_ENABLED

• NETFW_SUBNET_CHANGE_PROTECTION_ENABLED

Amazon OpenSearch Service

• OPENSEARCH_ENCRYPTED_AT_REST

• OPENSEARCH_HTTPS_REQUIRED

• OPENSEARCH_NODE_TO_NODE_ENCRYPTION_CHECK

Amazon RDS

• MARIADB_PUBLISH_LOGS_TO_CLOUDWATCH_LOGS

• RDS_AURORA_MYSQL_AUDIT_LOGGING_ENABLED

• RDS_AURORA_POSTGRESQL_LOGS_TO_CLOUDWATCH

• RDS_CLUSTER_DEFAULT_ADMIN_CHECK

• RDS_CLUSTER_ENCRYPTED_AT_REST

• RDS_GLOBAL_CLUSTER_AURORA_POSTGRESQL_SUPPORTED_VERSION

• RDS_INSTANCE_DEFAULT_ADMIN_CHECK

• RDS_INSTANCE_SUBNET_IGW_CHECK

• RDS_MARIADB_INSTANCE_ENCRYPTED_IN_TRANSIT

• RDS_MYSQL_INSTANCE_ENCRYPTED_IN_TRANSIT

• RDS_PGSQL_CLUSTER_COPY_TAGS_TO_SNAPSHOT_CHECK

• RDS_POSTGRESQL_LOGS_TO_CLOUDWATCH

• RDS_POSTGRES_INSTANCE_ENCRYPTED_IN_TRANSIT

• RDS_PROXY_TLS_ENCRYPTION

• RDS_SNAPSHOT_ENCRYPTED

• RDS_SQLSERVER_ENCRYPTED_IN_TRANSIT

• RDS_SQL_SERVER_LOGS_TO_CLOUDWATCH

Amazon Redshift

• REDSHIFT_CLUSTER_MULTI_AZ_ENABLED

• REDSHIFT_CLUSTER_SUBNET_GROUP_MULTI_AZ

• REDSHIFT_DEFAULT_ADMIN_CHECK

• REDSHIFT_SERVERLESS_DEFAULT_ADMIN_CHECK

• REDSHIFT_SERVERLESS_NAMESPACE_CMK_ENCRYPTION

• REDSHIFT_SERVERLESS_PUBLISH_LOGS_TO_CLOUDWATCH

• REDSHIFT_SERVERLESS_WORKGROUP_ENCRYPTED_IN_TRANSIT

• REDSHIFT_SERVERLESS_WORKGROUP_NO_PUBLIC_ACCESS

• REDSHIFT_SERVERLESS_WORKGROUP_ROUTES_WITHIN_VPC

• REDSHIFT_UNRESTRICTED_PORT_ACCESS

Amazon S3

• S3_ACCESS_POINT_IN_VPC_ONLY

• S3_ACCESS_POINT_PUBLIC_ACCESS_BLOCKS

• S3_BUCKET_ACL_PROHIBITED

• S3_BUCKET_CROSS_REGION_REPLICATION_ENABLED

• S3_BUCKET_MFA_DELETE_ENABLED

• S3_EVENT_NOTIFICATIONS_ENABLED

• S3_LIFECYCLE_POLICY_CHECK

• S3_VERSION_LIFECYCLE_POLICY_CHECK

Amazon SageMaker

• SAGEMAKER_ENDPOINT_CONFIG_KMS_KEY_REQUIRED

• SAGEMAKER_FEATUREGROUP_ENCRYPTION_AT_REST

• SAGEMAKER_FEATUREGROUP_ONLINE_STORE_ENCRYPTION

• SAGEMAKER_INF_EXPERIMENT_DATA_STORAGE_KMS_ENCRYPTED

• SAGEMAKER_INF_EXPERIMENT_INSTANCE_STORAGE_KMS_ENCRYPTED

• SAGEMAKER_MODEL_EXPLAINABILITY_JOB_NETWORK_ISOLATION

• SAGEMAKER_MODEL_MULTICONTAINER_PRIVATE_REGISTRY

• SAGEMAKER_MODEL_PRIVATE_REGISTRY_REQUIRED

• SAGEMAKER_MODEL_QUALITY_JOB_DEFINITION_ISOLATION

• SAGEMAKER_MONITORING_SCHEDULE_TRAFFIC_ENCRYPTION

• SAGEMAKER_NOTEBOOK_INSTANCE_INSIDE_VPC

• SAGEMAKER_NOTEBOOK_INSTANCE_ROOT_ACCESS_CHECK

• SAGEMAKER_NOTEBOOK_INSTANCE_STORAGE_VOL_KMS_ENCRYPTED

AWS Account Management

• SECURITY_ACCOUNT_INFORMATION_PROVIDED

Amazon SNS

• SNS_TOPIC_MESSAGE_DELIVERY_NOTIFICATION_ENABLED

• SNS_TOPIC_NO_PUBLIC_ACCESS

Amazon SQS

• SQS_QUEUE_DLQ_CHECK

• SQS_QUEUE_NO_PUBLIC_ACCESS

• SQS_QUEUE_POLICY_FULL_ACCESS_CHECK

AWS Systems Manager

• SSM_AUTOMATION_BLOCK_PUBLIC_SHARING

• SSM_AUTOMATION_LOGGING_ENABLED

AWS Transfer Family

• TRANSFER_CONNECTOR_LOGGING_ENABLED

Amazon VPC

• NACL_NO_UNRESTRICTED_SSH_RDP

• VPC_ENDPOINT_ENABLED

• VPC_PEERING_DNS_RESOLUTION_CHECK

• VPC_SG_PORT_RESTRICTION_CHECK

AWS WAF

• WAFV2_RULEGROUP_LOGGING_ENABLED

• WAFV2_WEBACL_NOT_EMPTY