What's New

AWS Config has expanded its library of managed rules by 191, bringing built-in governance coverage to a broad range of services including Amazon Bedrock, SageMaker, ECS, EKS, RDS, Redshift, S3, and CloudTrail. The new rules evaluate resource configurations across encryption, logging, public access controls, network security, and operational best practices. Organizations can deploy these rules individually or bundle them into conformance packs for systematic compliance enforcement across their AWS environments.

How It Works

• Managed rules as pre-built evaluators: Each new rule is a fully managed AWS Config rule that continuously evaluates the configuration state of a specific AWS resource against a defined compliance criterion (e.g., ECS_CONTAINERS_NONPRIVILEGED checks that ECS containers do not run with elevated privileges).
• Configuration change and periodic triggers: Rules fire either when a relevant resource configuration changes or on a scheduled periodic basis, recording a compliance result (COMPLIANT, NON_COMPLIANT, or NOT_APPLICABLE) in the Config timeline.
• Conformance pack integration: Multiple rules can be grouped into a conformance pack—a YAML/JSON template—allowing teams to deploy a curated set of controls (e.g., a "Bedrock AI Security" pack) across an account or AWS Organization in a single operation.
• Remediation actions: Non-compliant findings can be paired with AWS Systems Manager Automation documents to trigger automatic or manual remediation workflows.
• Regional scoping: Each rule is available only in AWS Regions where the underlying service is supported, ensuring evaluations are contextually valid.
• AI/ML-specific controls: New Bedrock AgentCore rules (e.g., BEDROCKAGENTCORE_RUNTIME_PRIVATE_NETWORK_REQUIRED, BEDROCK_AGENTCORE_MEMORY_ENCRYPTION_ENABLED) evaluate configurations unique to agentic AI workloads, such as browser sandbox network modes and memory store encryption.
• SageMaker depth: Rules cover the full ML lifecycle—notebook instances, feature stores, inference experiments, model registries, and monitoring schedules—checking for KMS encryption, VPC placement, and network isolation.

Why It's Important

• Closes AI/ML governance gaps: As organizations adopt Amazon Bedrock and SageMaker at scale, purpose-built rules for AgentCore, feature groups, and inference experiments provide the first native, codified compliance checks for these newer AI primitives.
• Reduces time-to-compliance: Pre-built rules eliminate the need to author and maintain custom Lambda-backed Config rules for common controls, accelerating security baseline deployment from weeks to minutes.
• Supports regulatory frameworks: Controls covering encryption-at-rest, encryption-in-transit, logging, MFA, and public access directly map to requirements in PCI-DSS, HIPAA, SOC 2, NIST 800-53, and ISO 27001, simplifying audit evidence collection.
• Improves defense-in-depth: Rules spanning network security (e.g., NACL_NO_UNRESTRICTED_SSH_RDP, VPC_SG_PORT_RESTRICTION_CHECK), identity (e.g., COGNITO_USER_POOL_MFA_ENABLED), and data protection create overlapping layers of detective controls.
• Operational resilience coverage: New rules for multi-AZ deployments (ElastiCache, ELB, Redshift, Neptune), deletion protection (DynamoDB, DocumentDB, Neptune), and backup retention enforce resilience best practices automatically.
• Unified visibility: Aggregating 191 additional signals into the Config dashboard and Security Hub gives security and platform teams a single pane of glass for compliance posture across a significantly larger resource footprint.

How It's Different

• Breadth vs. prior state: This single release adds 191 rules, representing one of the largest single expansions to the AWS Config managed rule library, substantially increasing out-of-the-box coverage without custom development.
• First-party AI governance rules: Unlike third-party CSPM tools that may lag behind new AWS service launches, these managed rules are authored and maintained by AWS, ensuring accuracy for cutting-edge services like Bedrock AgentCore that have no equivalent coverage elsewhere.
• Serverless and container parity: The expansion brings ECS, EKS, ECR, and Lambda rule depth closer to parity with EC2-centric controls, addressing a historical gap in container and serverless governance.
• Redshift Serverless coverage: New rules explicitly target Redshift Serverless (CMK encryption, public access, VPC routing, logging), distinguishing governance of the serverless tier from the provisioned cluster tier.
• Admin credential hygiene rules: Rules like RDS_CLUSTER_DEFAULT_ADMIN_CHECK, REDSHIFT_DEFAULT_ADMIN_CHECK, and REDSHIFT_SERVERLESS_DEFAULT_ADMIN_CHECK enforce credential hygiene at the configuration level—a control type not previously available as a managed rule for these services.
• No additional tooling required: Unlike custom rules requiring Lambda function deployment and maintenance, managed rules are zero-infrastructure—AWS handles execution, scaling, and rule logic updates.

When to Prefer It

• Deploying AI/ML workloads on Bedrock or SageMaker: Use the new Bedrock AgentCore and SageMaker rules immediately to establish a security baseline for agentic applications, feature stores, and ML pipelines before they reach production.
• Accelerating a compliance audit: When facing an upcoming PCI, HIPAA, or SOC 2 audit, deploy the relevant managed rules as a conformance pack to generate continuous compliance evidence without writing custom evaluation logic.
• Establishing a new AWS account baseline: Use these rules as part of an Account Factory or Control Tower customization to enforce encryption, logging, and network security standards from day one across all new accounts.
• Replacing aging custom Config rules: If your organization maintains Lambda-backed custom rules for services now covered by managed rules (e.g., ECS task definition checks, RDS encryption-in-transit), migrate to managed rules to reduce operational overhead.
• Multi-account governance at scale: When managing dozens or hundreds of accounts via AWS Organizations, deploy conformance packs containing these rules organization-wide to enforce consistent controls without per-account configuration.
• Container and Kubernetes security programs: Teams running ECS or EKS workloads should enable the new container-specific rules (non-root users, read-only filesystems, non-privileged containers, Container Insights) as detective controls complementing preventive guardrails.
• Incident response hardening: After a security incident involving public S3 access, exposed RDS instances, or weak Cognito policies, use the corresponding new rules to continuously monitor for recurrence of the misconfiguration class.

Availability

• General Availability: All 191 managed rules are generally available as of July 9, 2026—no preview or opt-in required.
• Regional availability: Each rule is available in the AWS Regions where the corresponding underlying service is supported; consult the AWS Config Resource Coverage by Region page for per-service, per-region details.
• Deployment modes: Rules can be deployed individually via the AWS Config console, CLI, CloudFormation, or Terraform, or grouped into conformance packs for bulk deployment.
• Pricing model: Standard AWS Config pricing applies—charges are based on the number of active Config rules per account per region (currently $0.001 per evaluation) plus configuration item recording costs; no additional premium for managed vs. custom rules.
• AWS Organizations support: Conformance packs containing these rules can be deployed organization-wide using delegated administrator accounts, enabling centralized governance across all member accounts.
• Limitations: Rules evaluate only resources that AWS Config is actively recording; services or resource types not enabled in the Config recorder will not generate evaluations. Some rules require specific resource types to be enabled in the recorder configuration.

Related Resources

• https://docs.aws.amazon.com/config/latest/developerguide/what-is-resource-config-coverage.html