AWS Config now supports 9 new resource types
AWS Config now tracks Bedrock, AgentCore, and SageMaker resources — bringing compliance and drift detection to your AI/ML infrastructure.
View original announcement →Visual Summary
graph TD
A{{AWS Config New Resource Types}}:::announced
B(Amazon Bedrock):::compute
C(Amazon SageMaker):::compute
D(Bedrock AgentCore):::compute
E([Config Rules]):::feature
F([Config Aggregators]):::feature
G([Change Notifications]):::feature
H(Amazon S3):::storage
I((Security Teams)):::external
I ==>|"govern"| A
A -->|"tracks"| B
A -->|"tracks"| C
A -->|"tracks"| D
A -->|"evaluates via"| E
A -->|"centralizes via"| F
A -.->|"triggers"| G
G -->|"stores history"| H
E -.->|"remediates"| C
classDef announced fill:#ff9900,stroke:#ec7211,color:#fff,font-weight:bold
classDef compute fill:#e3f2fd,stroke:#1565c0,color:#1565c0
classDef storage fill:#e8f5e9,stroke:#2e7d32,color:#2e7d32
classDef feature fill:#fff3e0,stroke:#e65100,color:#e65100
classDef external fill:#f5f5f5,stroke:#616161,color:#616161
What's New
AWS Config has expanded its resource coverage to include 9 new resource types spanning Amazon Bedrock, Amazon Bedrock AgentCore, and Amazon SageMaker, announced on June 3, 2026. The newly supported types cover generative AI infrastructure such as Bedrock flow aliases, AgentCore evaluators and runtime endpoints, and SageMaker clusters, endpoints, model package groups, and pipelines. Organizations with "record all resource types" enabled will automatically begin tracking these resources without any additional configuration.
How It Works
- Automatic Recording: If AWS Config is already configured to record all resource types, the 9 new resource types are tracked automatically upon launch — no manual opt-in required.
- Configuration Items: Config captures configuration snapshots (Configuration Items) for each new resource type, recording attributes, relationships, and change history over time.
- Config Rules Integration: The new resource types can be targeted by AWS Config Rules, allowing you to define compliance checks (e.g., ensuring SageMaker endpoints have encryption enabled or Bedrock flows are properly aliased).
- Config Aggregators: Multi-account and multi-region aggregators will include these resource types, enabling centralized governance views across your entire AWS organization.
- Resource Relationships: Config maps relationships between these new resources and other AWS resources, providing a dependency graph useful for impact analysis and auditing.
- Change Notifications: Configuration changes to these resources trigger Config change notifications, which can be routed to SNS, EventBridge, or S3 for downstream automation and alerting.
Why It's Important
- Closing the GenAI Governance Gap: As organizations rapidly adopt Amazon Bedrock and AgentCore for generative AI workloads, the lack of Config coverage created a blind spot in compliance and audit postures — this update closes that gap.
- SageMaker MLOps Visibility: SageMaker Clusters, Endpoints, Pipelines, and Model Package Groups are core MLOps primitives; tracking their configuration drift is critical for maintaining reproducible, compliant ML workflows.
- Regulatory and Audit Readiness: Regulated industries (finance, healthcare) can now include AI/ML infrastructure in Config-based audit trails, satisfying requirements for configuration history and change accountability.
- Automated Remediation: With Config Rules support, teams can trigger automated remediation actions (via SSM Automation or Lambda) when these resources fall out of compliance, reducing manual toil.
- Unified Governance: Security and platform teams can now manage AI/ML resource compliance alongside traditional infrastructure in a single pane of glass, reducing tooling sprawl.
How It's Different
- First-Class AgentCore Support: AWS::BedrockAgentCore resource types (Evaluator, GatewayTarget, OnlineEvaluationConfig, RuntimeEndpoint) represent some of the earliest governance tooling for the newly launched AgentCore service, giving early adopters immediate compliance coverage.
- Beyond Basic Bedrock Coverage: Prior Config support for Bedrock was limited; adding FlowAlias specifically addresses multi-version flow management, which is a common pattern in production prompt engineering workflows.
- SageMaker Depth: Unlike third-party monitoring tools that may only surface SageMaker endpoints, Config now tracks the full MLOps lifecycle — from Model Package Groups (versioning) through Pipelines (orchestration) to Clusters (compute) and Endpoints (inference).
- Native Integration vs. Third-Party: Compared to custom Lambda-based resource recorders or third-party CSPM tools, native Config support provides lower latency change detection, tighter IAM integration, and no additional agent deployment.
- Aggregator-Ready from Day One: The new types are immediately available in Config Aggregators, unlike some third-party solutions that require separate configuration per account/region.
When to Prefer It
- Compliance-Driven AI Deployments: Use this when your organization must demonstrate configuration history and change accountability for AI/ML resources to auditors or regulators.
- Multi-Account GenAI Platforms: When running Bedrock or SageMaker workloads across many AWS accounts, leverage Config Aggregators with these new types to get a centralized compliance dashboard.
- Drift Detection for MLOps Pipelines: Use Config Rules against SageMaker::Pipeline and SageMaker::Endpoint to detect unauthorized changes to production inference infrastructure or pipeline definitions.
- AgentCore Early Adopters: Teams building agentic AI applications on BedrockAgentCore should enable Config recording immediately to establish a configuration baseline as the service evolves.
- Security Posture Reviews: When conducting periodic security reviews, use Config's configuration history for Bedrock FlowAlias and SageMaker ModelPackageGroup to verify that only approved model versions are deployed.
- FinOps and Resource Inventory: Use Config's resource inventory capabilities to discover and catalog all SageMaker Clusters and Endpoints across regions, supporting cost attribution and rightsizing efforts.
Availability
- GA Status: Generally Available as of June 3, 2026; no preview or beta limitations noted.
- Regional Availability: Supported in all AWS Regions where the underlying resources (Bedrock, BedrockAgentCore, SageMaker) are available; coverage varies by region per the AWS Config resource coverage documentation.
- Automatic Enablement: Organizations with "record all resource types" enabled will have these resources tracked automatically; those using selective recording must explicitly add the new resource types.
- Pricing: Standard AWS Config pricing applies — charges are based on the number of configuration items recorded and Config Rule evaluations; no additional premium for these new resource types.
- Config Rules and Aggregators: All 9 new resource types are immediately usable in Config Rules and Config Aggregators without any additional setup.
- Limitation: Availability of specific BedrockAgentCore resource types is contingent on BedrockAgentCore service availability in a given region, which may be more limited than core Bedrock regions.
