JA EN
shiichan

AWS Config's managed rule library just grew by 191 rules!

AWS What's New ★★★★ View Markdown
#aws#security#devops

Hi, it's Shiichan! Today I found news about AWS Config getting a big pile of new rules, so let me walk you through it. This is great news if you're on governance duty!

AWS What's New aws.amazon.com

What was announced?

Over on AWS What's New, AWS announced that AWS Config now supports 191 additional managed rules. The new rules span 27 services, including Amazon Bedrock, Amazon SageMaker, Amazon ECS, Amazon EKS, Amazon RDS, Amazon Redshift, Amazon S3, and AWS CloudTrail.

The new rules evaluate operational best practices around encryption, logging, public access, network security, and data protection. You can deploy them individually or bundle them into a conformance pack, and they're available in any Region where the corresponding services are offered.

The story so far

AWS Config has always been about continuously evaluating and auditing your resource configurations, and managed rules let you automate checks like "is this encrypted?" or "is this publicly exposed?" But coverage had gaps, especially for newer AI/ML services like Bedrock and SageMaker, where rules didn't yet reach the finer-grained settings.

What changes

Now you get continuous configuration checks across a much wider set of services, including AI workloads. For example, around Bedrock's AgentCore, you can now check fine-grained governance items like whether the network mode is set to public, whether recording is enabled, and whether authorization is configured. Adding these rules to your existing conformance packs is all it takes to expand what you're auditing.

Dive Deep

A few examples from the new rules:

  • AWS Certificate Manager: ACM_CERTIFICATE_RSA_CHECK
  • Amazon API Gateway: API_GWV2_ACCESS_LOGS_ENABLED
  • AWS AppSync: APPSYNC_AUTHORIZATION_CHECK / APPSYNC_LOGGING_ENABLED
  • Amazon Athena: ATHENA_WORKGROUP_ENCRYPTED_AT_REST / ATHENA_WORKGROUP_LOGGING_ENABLED
  • Amazon Bedrock: BEDROCKAGENTCORE_GATEWAY_AUTHORIZER_ENABLED / BEDROCKAGENTCORE_GATEWAY_ENCRYPTION_ENABLED, plus several more AgentCore-related rules

In total, the 27 covered services include ACM, API Gateway, AppSync, Athena, Aurora, Bedrock, CloudFormation, CloudTrail, CloudWatch, Cognito, CodeBuild, DataSync, DMS, DocumentDB, DynamoDB, EC2, ECR, ECS, EFS, EKS, Elastic Beanstalk, ElastiCache, Elastic Load Balancing, EMR, EventBridge, FSx, Glue, GuardDuty, IAM, Kendra, Kinesis, KMS, Lambda, Neptune, Network Firewall, OpenSearch, RDS, Redshift, S3, SageMaker, SNS, SQS, Systems Manager, Transfer Family, VPC, and WAF.

You can deploy rules one at a time or as part of a conformance pack, and they work in any Region where the corresponding services are available.

Wrap-up

  • AWS Config now supports 191 additional managed rules, spanning 27 services
  • Coverage includes Bedrock, SageMaker, ECS, EKS, RDS, Redshift, S3, and CloudTrail, reaching into AI workloads too
  • The rules check best practices around encryption, logging, public access, network security, and data protection
  • You can deploy them individually or bundle them into a conformance pack

This is a great update for cloud security folks who want governance and compliance checks working consistently across many services!

Related posts