Lista deAWS ConfigRegras gerenciadas por tipo de acionador

AWS Configatualmente oferece suporte às seguintes regras gerenciadas.

nota

Os valores padrão especificados para regras gerenciadas são pré-preenchidos somente quando se usa oAWSconsole. Os valores padrão não são fornecidos para a API, CLI ou SDK.

Alterações de configuração

Regras acionadas por mudançassão regras queAWS Configavalia em resposta às mudanças de configuração.

Alterações de configuração

• acm-certificate-expiration-check

• acm-certificate-rsa-check

• alb-desync-mode-check

• alb-http-drop-invalid-habilitado para cabeçalho

• alb-waf-enabled

• api-gwv2-access-logs-enabled

• api-gw-associated-with-guerra

• api-gw-cache-enabled-e criptografado

• api-gw-endpoint-type-check

• api-gw-execution-logging-ativado

• api-gw-ssl-enabled

• api-gw-xray-enabled

• approved-amis-by-id

• approved-amis-by-tag

• appsync-logging-enabled

• athena-workgroup-encrypted-at-descansar

• aurora-mysql-backtracking-enabled

• autoscaling-capacity-rebalancing

• autoscaling-group-elb-healthcheck-obrigatório

• autoscaling-launchconfig-requires-imdsv2

• autoscaling-launch-config-hop-limite

• autoscaling-launch-config-public-ip desativado

• autoscaling-launch-template

• autoscaling-multiple-az

• autoscaling-multiple-instance-types

• backup-plan-min-frequency-and-min-retention-check

• backup-recovery-point-encrypted

• backup-recovery-point-manual-exclusão desativada

• backup-recovery-point-minimum-verificação de retenção

• beanstalk-enhanced-health-reporting-ativado

• clb-desync-mode-check

• clb-multiple-az

• cloudformation-stack-drift-detection-verifique

• cloudformation-stack-notification-check

• cloudfront-accesslogs-enabled

• cloudfront-associated-with-waf

• cloudfront-custom-ssl-certificate

• cloudfront-default-root-object-configurado

• cloudfront-no-deprecated-ssl-protocolos

• cloudfront-origin-access-identity-ativado

• cloudfront-origin-failover-enabled

• front-s3-origin-access-control-enabled

• cloudfront-security-policy-check

• cloudfront-sni-enabled

• cloudfront-traffic-to-origin-criptografado

• cloudfront-viewer-policy-https

• cloudwatch-alarm-action-check

• cloudwatch-alarm-action-enabled-verifique

• cloudwatch-alarm-settings-check

• codebuild-project-artifact-encryption

• codebuild-project-environment-privileged-verifique

• codebuild-project-envvar-awscred-verifique

• codebuild-project-logging-enabled

• codebuild-project-sCriptografado em 3 registros

• codebuild-project-source-repo-verificação de URL

• codedeploy-auto-rollback-monitor-ativado

• codedeploy-ec2-minimum-healthy-hosts-configured

• codedeploy-lambda-allatonce-traffic-Shift desativado

• codepipeline-deployment-count-check

• codepipeline-region-fanout-check

• db-instance-backup-enabled

• desired-instance-tenancy

• desired-instance-type

• docdb-cluster-backup-retention-verifique

• docdb-cluster-encrypted

• dynamodb-pitr-enabled

• dynamodb-table-encrypted-kms

• dynamodb-table-encryption-enabled

• ebs-optimized-instance

• ec2-imdsv2-check

• ec2-instance-detailed-monitoring-enabled

• ec2-instance-managed-by-ssm

• ec2-instance-multiple-eni-check

• ec2-instance-no-public-ip

• ec2-instance-profile-attached

• ec2-launch-template-public-ip-desativado

• ec2-managedinstance-applications-blacklisted

• ec2-managedinstance-applications-required

• ec2-managedinstance-association-compliance-status-verifique

• ec2-managedinstance-inventory-blacklisted

• ec2-managedinstance-patch-compliance-status-verifique

• ec2-managedinstance-platform-check

• ec2-no-amazon-key-pair

• ec2-paravirtual-instance-check

• ec2-security-group-attached-to-eni

• ec2-token-hop-limit-check

• ec2-transit-gateway-auto-vpc- conexão desativada

• ec2-volume-inuse-check

• ecr-private-lifecycle-policy-configurado

• ecr-private-tag-immutability-ativado

• ecs-awsvpc-networking-enabled

• ecs-containers-nonprivileged

• ecs-containers-readonly-access

• ecs-container-insights-enabled

• ecs-fargate-latest-platform-versão

• ecs-no-environment-secrets

• ecs-task-definition-log-configuração

• ecs-task-definition-memory-limite rígido

• ecs-task-definition-nonroot-usuário

• ecs-task-definition-pid-verificação de modo

• ecs-task-definition-user-for-host-mode-check

• efs-access-point-enforce-diretório-raiz

• efs-access-point-enforce-identidade do usuário

• anexado ao EPI

• eks-cluster-oldest-supported-versão

• eks-cluster-supported-version

• elasticsearch-logs-to-cloudwatch

• elasticsearch-node-to-node-verificação de criptografia

• elastic-beanstalk-logs-to- relógio de nuvem

• elastic-beanstalk-managed-updates-ativado

• elbv2-multiple-az

• elb-acm-certificate-required

• elb-cross-zone-load-balanceamento ativado

• elb-custom-security-policy-ssl-check

• elb-deletion-protection-enabled

• elb-logging-enabled

• elb-predefined-security-policy-ssl-check

• elb-tls-https-listeners-somente

• volumes criptografados

• fms-shield-resource-policy-verifique

• fms-webacl-resource-policy-verifique

• fms-webacl-rulegroup-association-verifique

• iam-customer-policy-blocked-kms - ações

• iam-group-has-users-verifique

• iam-inline-policy-blocked-kms - ações

• iam-no-inline-policy-verifique

• iam-policy-blacklisted-check

• iam-policy-no-statements-with-admin-access

• iam-policy-no-statements-with-full-access

• iam-role-managed-policy-verifique

• iam-user-group-membership-verifique

• iam-user-no-policies-verifique

• incoming-ssh-disabled

• instances-in-vpc

• internet-gateway-authorized-vpc-somente

• kinesis-stream-encrypted

• lambda-concurrency-check

• lambda-dlq-check

• lambda-function-public-access-proibido

• lambda-function-settings-check

• lambda-inside-vpc

• lambda-vpc-multi-az-verifique

• nacl-no-unrestricted-ssh-rdp

• neptune-cluster-backup-retention-verifique

• neptune-cluster-cloudwatch-log- habilitado para exportação

• neptune-cluster-copy-tags-to-snapshot-enabled

• neptune-cluster-deletion-protection-ativado

• neptune-cluster-encrypted

• neptune-cluster-iam-database-autenticação

• neptune-cluster-snapshot-encrypted

• neptune-cluster-snapshot-public-proibido

• netfw-multi-az-enabled

• netfw-policy-default-action-pacotes de fragmentos

• netfw-policy-default-action-pacotes completos

• netfw-policy-rule-group-associado

• netfw-stateless-rule-group-não vazio

• nlb-cross-zone-load-balanceamento ativado

• no-unrestricted-route-to-igw

• opensearch-access-control-enabled

• opensearch-audit-logging-enabled

• opensearch-data-node-fault-tolerância

• opensearch-encrypted-at-rest

• opensearch-https-required

• opensearch-in-vpc-only

• opensearch-logs-to-cloudwatch

• opensearch-node-to-node-verificação de criptografia

• rds-automatic-minor-version-habilitado para atualização

• rds-cluster-default-admin-verifique

• rds-cluster-deletion-protection-ativado

• rds-cluster-encrypted-at-descansar

• rds-cluster-iam-authentication-ativado

• rds-cluster-multi-az-ativado

• rds-db-security-group-não permitido

• rds-enhanced-monitoring-enabled

• rds-instance-default-admin-verifique

• rds-instance-deletion-protection-ativado

• rds-instance-iam-authentication-ativado

• rds-instance-public-access-verifique

• rds-logging-enabled

• rds-multi-az-support

• rds-snapshots-public-prohibited

• rds-snapshot-encrypted

• rds-storage-encrypted

• redshift-audit-logging-enabled

• redshift-backup-enabled

• redshift-cluster-configuration-check

• redshift-cluster-kms-enabled

• redshift-cluster-maintenancesettings-check

• redshift-cluster-public-access-verifique

• redshift-default-admin-check

• redshift-default-db-name-verifique

• redshift-enhanced-vpc-routing-ativado

• redshift-require-tls-ssl

• etiquetas obrigatórias

• restricted-incoming-traffic

• s3-account-level-public-access-blocos

• s3-bucket-acl-prohibited

• s3-bucket-blacklisted-actions-prohibited

• s3-bucket-default-lock-enabled

• s3-bucket-level-public-access-proibido

• s3-bucket-logging-enabled

• s3-bucket-policy-grantee-check

• s3-bucket-policy-not-more-permissivo

• s3-bucket-public-read-prohibited

• s3-bucket-public-write-prohibited

• s3-bucket-replication-enabled

• s3-bucket-server-side-encryption-ativado

• s3-bucket-ssl-requests-only

• s3-bucket-versioning-enabled

• s3-default-encryption-kms

• s3-event-notifications-enabled

• s3-lifecycle-policy-check

• s3-version-lifecycle-policy-check

• sagemaker-notebook-instance-inside-PVC

• sagemaker-notebook-instance-root-verificação de acesso

• secretsmanager-rotation-enabled-check

• secretsmanager-scheduled-rotation-success-verifique

• secretsmanager-using-cmk

• sns-encrypted-kms

• sns-topic-message-delivery-notificação ativada

• step-functions-state-machine-registro ativado

• subnet-auto-assign-public-ip desativado

• vpc-default-security-group-fechado

• vpc-network-acl-unused-verifique

• vpc-peering-dns-resolution-verifique

• vpc-sg-open-only-to-authorized-ports

• vpc-vpn-2-tunnels-up

• wafv2-rulegroup-not-empty

• wafv2-webacl-not-empty

• waf-global-rulegroup-not-vazio

• waf-global-rule-not-vazio

• waf-global-webacl-not-vazio

• waf-regional-rulegroup-not-vazio

• waf-regional-rule-not-vazio

• waf-regional-webacl-not-vazio

Periódico

Regras periódicassão regras queAWS Configavalia periodicamente em uma frequência especificada por você; por exemplo, a cada 24 horas.

Periódico

• access-keys-rotated

• account-part-of-organizations

• alb-http-to-https-verificação de redirecionamento

• api-gwv2-authorization-type-configured

• appsync-associated-with-waf

• appsync-cache-encryption-at-descansar

• aurora-last-backup-recovery-ponto criado

• aurora-resources-protected-by-plano de backup

• front-s3-origin-non-existent-bucket

• cloudtrail-s3 - eventos de dados habilitados

• cloudtrail-security-trail-enabled

• cloudwatch-alarm-resource-check

• cloudwatch-log-group-encrypted

• cloud-trail-cloud-watch-registros habilitados

• cloud-trail-enabled

• cloud-trail-encryption-enabled

• cloud-trail-log-file-validação ativada

• cmk-backing-key-rotation-ativado

• custom-schema-registry-policy-anexado

• cw-loggroup-retention-period-verifique

• dax-encryption-enabled

• dms-replication-not-public

• dynamodb-autoscaling-enabled

• dynamodb-in-backup-plan

• dynamodb-last-backup-recovery-ponto criado

• dynamodb-resources-protected-by-plano de backup

• dynamodb-throughput-limit-check

• ebs-in-backup-plan

• ebs-last-backup-recovery-ponto criado

• ebs-resources-protected-by-plano de backup

• ebs-snapshot-public-restorable-verifique

• ec2-client-vpn-not-authorize-tudo

• ec2-ebs-encryption-by-default

• ec2-last-backup-recovery-point-criado

• ec2-resources-protected-by-backup-plano

• ec2-security-group-attached-to-eni-periódico

• instância ec2 interrompida

• ecr-private-image-scanning-ativado

• efs-encrypted-check

• efs-in-backup-plan

• efs-last-backup-recovery-ponto criado

• efs-resources-protected-by-plano de backup

• eks-cluster-logging-enabled

• eks-endpoint-no-public-acesso

• eks-secrets-encrypted

• elasticache-auto-minor-version-verificação de atualização

• elasticache-rbac-auth-enabled

• elasticache-redis-cluster-automatic-verificação de backup

• elasticache-repl-grp-auto- ativado para failover

• elasticache-repl-grp-encrypted-em repouso

• elasticache-repl-grp-encrypted-em trânsito

• elasticache-repl-grp-redis-habilitado para autenticação

• elasticache-subnet-group-check

• elasticache-supported-engine-version

• elasticsearch-encrypted-at-rest

• elasticsearch-in-vpc-only

• elbv2-acm-certificate-required

• emr-kerberos-enabled

• emr-master-no-public-ip

• fsx-last-backup-recovery-ponto criado

• fsx-resources-protected-by-plano de backup

• guardduty-enabled-centralized

• guardduty-non-archived-findings

• iam-password-policy

• iam-policy-in-use

• iam-root-access-key-verifique

• iam-user-mfa-enabled

• iam-user-unused-credentials-verifique

• kms-cmk-not-scheduled-para exclusão

• macie-status-check

• mfa-enabled-for-iam-acesso ao console

• mq-automatic-minor-version-habilitado para atualização

• mq-cloudwatch-audit-logging-ativado

• mq-no-public-access

• multi-region-cloud-trail-ativado

• netfw-logging-enabled

• rds-in-backup-plan

• rds-last-backup-recovery-ponto criado

• rds-resources-protected-by-plano de backup

• root-account-hardware-mfa-ativado

• root-account-mfa-enabled

• s3-account-level-public-access-blocos periódicos

• s3-last-backup-recovery-point-criado

• s3-resources-protected-by-backup-plano

• sagemaker-endpoint-configuration-kms-configurado por chave

• sagemaker-notebook-instance-kms-configurado por chave

• sagemaker-notebook-no-direct-acesso à internet

• secretsmanager-secret-periodic-rotation

• secretsmanager-secret-unused

• habilitado para hub de segurança

• security-account-information-provided

• habilitado para service-vpc-endpoint

• ses-malware-scanning-enabled

• shield-advanced-enabled-autorenew

• shield-drt-access

• ssm-document-not-public

• storagegateway-last-backup-recovery-ponto criado

• storagegateway-resources-protected-by-plano de backup

• virtualmachine-last-backup-recovery-ponto criado

• virtualmachine-resources-protected-by-plano de backup

• vpc-flow-logs-enabled

• wafv2 ativado para registro

• waf-classic-logging-enabled

Abordagem híbrida

Regras híbridassão regras queAWS Configavalia tanto em resposta às mudanças de configuração quanto periodicamente.

Abordagem híbrida

• acm-certificate-expiration-check

• cloudformation-stack-drift-detection-verifique

• s3-bucket-public-read-prohibited

• s3-bucket-public-write-prohibited