AWS Config now supports 191 additional managed rules

AWS Config now supports 191 additional managed rules across key services including Amazon Bedrock, Amazon SageMaker, Amazon ECS, Amazon EKS, Amazon RDS, Amazon Redshift, Amazon S3, and Amazon CloudTrail. This expansion increases built-in governance coverage across AI workloads and core cloud infrastructure. Examples of the new managed rules include evaluating resource configurations for encryption, logging, public access, network security, data protection, and other operational best practices across AWS services. With this launch, you can deploy these new managed rules individually or as part of a conformance pack in the [AWS Regions](https://docs.aws.amazon.com/config/latest/developerguide/what-is-resource-config-coverage.html) where the corresponding AWS services are available. AWS Certificate Manager ACM\_CERTIFICATE\_RSA\_CHECK Amazon API Gateway API\_GWV2\_ACCESS\_LOGS\_ENABLED AWS AppSync APPSYNC\_AUTHORIZATION\_CHECK APPSYNC\_LOGGING\_ENABLED Amazon Athena ATHENA\_WORKGROUP\_ENCRYPTED\_AT\_REST ATHENA\_WORKGROUP\_LOGGING\_ENABLED Amazon Aurora AURORA\_MYSQL\_CLUSTER\_AUDIT\_LOGGING Amazon Bedrock BEDROCKAGENTCORE\_BROWSERCUSTOM\_NETWORK\_MODE\_NOT\_PUBLIC BEDROCKAGENTCORE\_BROWSERCUSTOM\_RECORDING\_ENABLED BEDROCKAGENTCORE\_CODEINTERPRETER\_NETWORKMODE\_CHECK BEDROCKAGENTCORE\_GATEWAY\_AUTHORIZER\_ENABLED BEDROCKAGENTCORE\_GATEWAY\_ENCRYPTION\_ENABLED BEDROCKAGENTCORE\_RUNTIME\_PRIVATE\_NETWORK\_REQUIRED BEDROCK\_AGENTCORE\_MEMORY\_ENCRYPTION\_ENABLED BEDROCK\_AGENTCORE\_MEMORY\_EVENT\_EXPIRY\_DURATION BEDROCK\_DATA\_SOURCE\_ENCRYPTION\_ENABLED AWS CloudFormation CLOUDFORMATION\_STACK\_SERVICE\_ROLE\_CHECK CLOUDFORMATION\_TERMINATION\_PROTECTION\_CHECK AWS CloudTrail CLOUDTRAIL\_ALL\_READ\_S3\_DATA\_EVENT\_CHECK CLOUDTRAIL\_ALL\_WRITE\_S3\_DATA\_EVENT\_CHECK CLOUDTRAIL\_S3\_BUCKET\_ACCESS\_LOGGING CLOUDTRAIL\_S3\_BUCKET\_PUBLIC\_ACCESS\_PROHIBITED EVENT\_DATA\_STORE\_CMK\_ENCRYPTION\_ENABLED Amazon CloudWatch CLOUDWATCH\_ALARM\_ACTION\_ENABLED\_CHECK Amazon Cognito COGNITO\_IDENTITY\_POOL\_UNAUTH\_ACCESS\_CHECK COGNITO\_USERPOOL\_CUST\_AUTH\_THREAT\_FULL\_CHECK COGNITO\_USER\_POOL\_ADVANCED\_SECURITY\_ENABLED COGNITO\_USER\_POOL\_MFA\_ENABLED COGNITO\_USER\_POOL\_PASSWORD\_POLICY\_CHECK AWS CodeBuild CODEBUILD\_PROJECT\_ARTIFACT\_ENCRYPTION CODEBUILD\_PROJECT\_ENVIRONMENT\_PRIVILEGED\_CHECK CODEBUILD\_PROJECT\_LOGGING\_ENABLED CODEBUILD\_PROJECT\_S3\_LOGS\_ENCRYPTED AWS DataSync DATASYNC\_TASK\_LOGGING\_ENABLED AWS Database Migration Service (DMS) DMS\_REPLICATION\_TASK\_SOURCEDB\_LOGGING DMS\_REPLICATION\_TASK\_TARGETDB\_LOGGING Amazon DocumentDB DOCDB\_CLUSTER\_AUDIT\_LOGGING\_ENABLED DOCDB\_CLUSTER\_DELETION\_PROTECTION\_ENABLED DOCDB\_CLUSTER\_ENCRYPTED\_IN\_TRANSIT DOCDB\_CLUSTER\_SNAPSHOT\_PUBLIC\_PROHIBITED Amazon DynamoDB DYNAMODB\_TABLE\_DELETION\_PROTECTION\_ENABLED Amazon EC2 EC2\_ENIS\_SOURCE\_DESTINATION\_CHECK\_ENABLED EC2\_INSTANCE\_LAUNCHED\_WITH\_ALLOWED\_AMI EC2\_LAUNCH\_TEMPLATES\_EBS\_VOLUME\_ENCRYPTED EC2\_LAUNCH\_TEMPLATE\_IMDSV2\_CHECK EC2\_LAUNCH\_TEMPLATE\_PUBLIC\_IP\_DISABLED EC2\_SECURITY\_GROUP\_ATTACHED\_TO\_ENI EC2\_SPOT\_FLEET\_REQUEST\_CT\_ENCRYPTION\_AT\_REST EC2\_STOPPED\_INSTANCE\_DAYS\_CHECK\_PVT EC2\_TRANSIT\_GATEWAY\_AUTO\_VPC\_ATTACH\_DISABLED EC2\_VPN\_CONNECTION\_IKE\_VERSION\_CHECK EC2\_VPN\_CONNECTION\_LOGGING\_ENABLED INSTANCES\_IN\_VPC Amazon EC2 Auto Scaling AUTOSCALING\_LAUNCH\_TEMPLATE AUTOSCALING\_MULTIPLE\_AZ AUTOSCALING\_MULTIPLE\_INSTANCE\_TYPES Amazon ECR ECR\_PRIVATE\_IMAGE\_SCANNING\_ENABLED ECR\_PRIVATE\_LIFECYCLE\_POLICY\_CONFIGURED ECR\_PRIVATE\_TAG\_IMMUTABILITY\_ENABLED ECR\_REPOSITORY\_CMK\_ENCRYPTION\_ENABLED Amazon ECS ECS\_CONTAINERS\_NONPRIVILEGED ECS\_CONTAINERS\_READONLY\_ACCESS ECS\_CONTAINER\_INSIGHTS\_ENABLED ECS\_FARGATE\_LATEST\_PLATFORM\_VERSION ECS\_NO\_ENVIRONMENT\_SECRETS ECS\_TASK\_DEFINITION\_EFS\_ENCRYPTION\_ENABLED ECS\_TASK\_DEFINITION\_LINUX\_USER\_NON\_ROOT ECS\_TASK\_DEFINITION\_LOG\_CONFIGURATION ECS\_TASK\_DEFINITION\_NETWORK\_MODE\_NOT\_HOST ECS\_TASK\_DEFINITION\_PID\_MODE\_CHECK ECS\_TASK\_DEFINITION\_USER\_FOR\_HOST\_MODE\_CHECK ECS\_TASK\_DEFINITION\_WINDOWS\_USER\_NON\_ADMIN Amazon EFS EFS\_ACCESS\_POINT\_ENFORCE\_ROOT\_DIRECTORY EFS\_ACCESS\_POINT\_ENFORCE\_USER\_IDENTITY EFS\_AUTOMATIC\_BACKUPS\_ENABLED EFS\_FILESYSTEM\_CT\_ENCRYPTED EFS\_MOUNT\_TARGET\_PUBLIC\_ACCESSIBLE Amazon EKS EKS\_NODEGROUP\_SUPPORTED\_VERSION\_CHECK AWS Elastic Beanstalk BEANSTALK\_ENHANCED\_HEALTH\_REPORTING\_ENABLED Amazon ElastiCache ELASTICACHE\_AUTOMATIC\_BACKUP\_CHECK\_ENABLED ELASTICACHE\_AUTO\_MINOR\_VERSION\_UPGRADE\_CHECK ELASTICACHE\_REPL\_GRP\_AUTO\_FAILOVER\_ENABLED ELASTICACHE\_REPL\_GRP\_ENCRYPTED\_AT\_REST ELASTICACHE\_SUBNET\_GROUP\_CHECK ELASTICACHE\_SUPPORTED\_ENGINE\_VERSION Elastic Load Balancing ALB\_DESYNC\_MODE\_CHECK CLB\_DESYNC\_MODE\_CHECK CLB\_MULTIPLE\_AZ ELBV2\_LISTENER\_ENCRYPTION\_IN\_TRANSIT ELBV2\_MULTIPLE\_AZ ELBV2\_PREDEFINED\_SECURITY\_POLICY\_SSL\_CHECK NLB\_CROSS\_ZONE\_LOAD\_BALANCING\_ENABLED Amazon EMR EMR\_BLOCK\_PUBLIC\_ACCESS Amazon EventBridge CUSTOM\_EVENTBUS\_POLICY\_ATTACHED Amazon FSx FSX\_LUSTRE\_COPY\_TAGS\_TO\_BACKUPS FSX\_OPENZFS\_COPY\_TAGS\_ENABLED FSX\_OPENZFS\_DEPLOYMENT\_TYPE\_CHECK FSX\_WINDOWS\_AUDIT\_LOG\_CONFIGURED FSX\_WINDOWS\_DEPLOYMENT\_TYPE\_CHECK AWS Glue GLUE\_ML\_TRANSFORM\_ENCRYPTED\_AT\_REST Amazon GuardDuty GUARDDUTY\_ECS\_PROTECTION\_RUNTIME\_ENABLED GUARDDUTY\_EKS\_PROTECTION\_AUDIT\_ENABLED GUARDDUTY\_LAMBDA\_PROTECTION\_ENABLED GUARDDUTY\_MALWARE\_PROTECTION\_ENABLED GUARDDUTY\_RUNTIME\_MONITORING\_ENABLED GUARDDUTY\_S3\_PROTECTION\_ENABLED IAM IAM\_EXTERNAL\_ACCESS\_ANALYZER\_ENABLED IAM\_SERVER\_CERTIFICATE\_EXPIRATION\_CHECK Amazon Kendra KENDRA\_INDEX\_TAGGED Amazon Kinesis KINESIS\_FIREHOSE\_DELIVERY\_STREAM\_ENCRYPTED KINESIS\_STREAM\_BACKUP\_RETENTION\_CHECK KINESIS\_STREAM\_ENCRYPTED AWS KMS KMS\_KEY\_POLICY\_NO\_PUBLIC\_ACCESS AWS Lambda LAMBDA\_FUNCTION\_XRAY\_ENABLED LAMBDA\_VPC\_MULTI\_AZ\_CHECK Amazon Neptune NEPTUNE\_CLUSTER\_BACKUP\_RETENTION\_CHECK NEPTUNE\_CLUSTER\_COPY\_TAGS\_TO\_SNAPSHOT\_ENABLED NEPTUNE\_CLUSTER\_DELETION\_PROTECTION\_ENABLED NEPTUNE\_CLUSTER\_ENCRYPTED NEPTUNE\_CLUSTER\_IAM\_DATABASE\_AUTHENTICATION NEPTUNE\_CLUSTER\_MULTI\_AZ\_ENABLED NEPTUNE\_CLUSTER\_SNAPSHOT\_ENCRYPTED NEPTUNE\_CLUSTER\_SNAPSHOT\_PUBLIC\_PROHIBITED AWS Network Firewall NETFW\_LOGGING\_ENABLED NETFW\_SUBNET\_CHANGE\_PROTECTION\_ENABLED Amazon OpenSearch Service OPENSEARCH\_ENCRYPTED\_AT\_REST OPENSEARCH\_HTTPS\_REQUIRED OPENSEARCH\_NODE\_TO\_NODE\_ENCRYPTION\_CHECK Amazon RDS MARIADB\_PUBLISH\_LOGS\_TO\_CLOUDWATCH\_LOGS RDS\_AURORA\_MYSQL\_AUDIT\_LOGGING\_ENABLED RDS\_AURORA\_POSTGRESQL\_LOGS\_TO\_CLOUDWATCH RDS\_CLUSTER\_DEFAULT\_ADMIN\_CHECK RDS\_CLUSTER\_ENCRYPTED\_AT\_REST RDS\_GLOBAL\_CLUSTER\_AURORA\_POSTGRESQL\_SUPPORTED\_VERSION RDS\_INSTANCE\_DEFAULT\_ADMIN\_CHECK RDS\_INSTANCE\_SUBNET\_IGW\_CHECK RDS\_MARIADB\_INSTANCE\_ENCRYPTED\_IN\_TRANSIT RDS\_MYSQL\_INSTANCE\_ENCRYPTED\_IN\_TRANSIT RDS\_PGSQL\_CLUSTER\_COPY\_TAGS\_TO\_SNAPSHOT\_CHECK RDS\_POSTGRESQL\_LOGS\_TO\_CLOUDWATCH RDS\_POSTGRES\_INSTANCE\_ENCRYPTED\_IN\_TRANSIT RDS\_PROXY\_TLS\_ENCRYPTION RDS\_SNAPSHOT\_ENCRYPTED RDS\_SQLSERVER\_ENCRYPTED\_IN\_TRANSIT RDS\_SQL\_SERVER\_LOGS\_TO\_CLOUDWATCH Amazon Redshift REDSHIFT\_CLUSTER\_MULTI\_AZ\_ENABLED REDSHIFT\_CLUSTER\_SUBNET\_GROUP\_MULTI\_AZ REDSHIFT\_DEFAULT\_ADMIN\_CHECK REDSHIFT\_SERVERLESS\_DEFAULT\_ADMIN\_CHECK REDSHIFT\_SERVERLESS\_NAMESPACE\_CMK\_ENCRYPTION REDSHIFT\_SERVERLESS\_PUBLISH\_LOGS\_TO\_CLOUDWATCH REDSHIFT\_SERVERLESS\_WORKGROUP\_ENCRYPTED\_IN\_TRANSIT REDSHIFT\_SERVERLESS\_WORKGROUP\_NO\_PUBLIC\_ACCESS REDSHIFT\_SERVERLESS\_WORKGROUP\_ROUTES\_WITHIN\_VPC REDSHIFT\_UNRESTRICTED\_PORT\_ACCESS Amazon S3 S3\_ACCESS\_POINT\_IN\_VPC\_ONLY S3\_ACCESS\_POINT\_PUBLIC\_ACCESS\_BLOCKS S3\_BUCKET\_ACL\_PROHIBITED S3\_BUCKET\_CROSS\_REGION\_REPLICATION\_ENABLED S3\_BUCKET\_MFA\_DELETE\_ENABLED S3\_EVENT\_NOTIFICATIONS\_ENABLED S3\_LIFECYCLE\_POLICY\_CHECK S3\_VERSION\_LIFECYCLE\_POLICY\_CHECK Amazon SageMaker SAGEMAKER\_ENDPOINT\_CONFIG\_KMS\_KEY\_REQUIRED SAGEMAKER\_FEATUREGROUP\_ENCRYPTION\_AT\_REST SAGEMAKER\_FEATUREGROUP\_ONLINE\_STORE\_ENCRYPTION SAGEMAKER\_INF\_EXPERIMENT\_DATA\_STORAGE\_KMS\_ENCRYPTED SAGEMAKER\_INF\_EXPERIMENT\_INSTANCE\_STORAGE\_KMS\_ENCRYPTED SAGEMAKER\_MODEL\_EXPLAINABILITY\_JOB\_NETWORK\_ISOLATION SAGEMAKER\_MODEL\_MULTICONTAINER\_PRIVATE\_REGISTRY SAGEMAKER\_MODEL\_PRIVATE\_REGISTRY\_REQUIRED SAGEMAKER\_MODEL\_QUALITY\_JOB\_DEFINITION\_ISOLATION SAGEMAKER\_MONITORING\_SCHEDULE\_TRAFFIC\_ENCRYPTION SAGEMAKER\_NOTEBOOK\_INSTANCE\_INSIDE\_VPC SAGEMAKER\_NOTEBOOK\_INSTANCE\_ROOT\_ACCESS\_CHECK SAGEMAKER\_NOTEBOOK\_INSTANCE\_STORAGE\_VOL\_KMS\_ENCRYPTED AWS Account Management SECURITY\_ACCOUNT\_INFORMATION\_PROVIDED Amazon SNS SNS\_TOPIC\_MESSAGE\_DELIVERY\_NOTIFICATION\_ENABLED SNS\_TOPIC\_NO\_PUBLIC\_ACCESS Amazon SQS SQS\_QUEUE\_DLQ\_CHECK SQS\_QUEUE\_NO\_PUBLIC\_ACCESS SQS\_QUEUE\_POLICY\_FULL\_ACCESS\_CHECK AWS Systems Manager SSM\_AUTOMATION\_BLOCK\_PUBLIC\_SHARING SSM\_AUTOMATION\_LOGGING\_ENABLED AWS Transfer Family TRANSFER\_CONNECTOR\_LOGGING\_ENABLED Amazon VPC NACL\_NO\_UNRESTRICTED\_SSH\_RDP VPC\_ENDPOINT\_ENABLED VPC\_PEERING\_DNS\_RESOLUTION\_CHECK VPC\_SG\_PORT\_RESTRICTION\_CHECK AWS WAF WAFV2\_RULEGROUP\_LOGGING\_ENABLED WAFV2\_WEBACL\_NOT\_EMPTY