Reading-path month: October 2026. Collection published on September 12, 2026 and updated on October 26, 2026. Months organize the reading path; they are not earlier publication dates.
AWS Config: new resources need a coverage matrix
Expanded inventory requires separate tests for collection, evaluation and response, without confusing discovered resources with effective controls.
Content produced with AI assistance for Thiago Silva’s website. Independent editorial analysis; it does not represent clients or employers.
Reading context
On October 7, 2026, AWS announced Config support for 77 additional resource types. The analysis below proposes acceptance criteria for that expansion.
Original source ↗Define what covered means
A team can expand its inventory and still lack a clear answer about its most important risk. The architecture decision is to define a coverage unit: resource, account, region, expected control, owner and evidence. A discovered record represents discovery. An executed rule represents evaluation. A confirmed action represents response. These stages need separate dashboard states.
This is editorial guidance, not a description of controls deployed by Thiago Silva. The vendor announcement starts a review; it does not demonstrate that a particular environment is protected or that every new resource automatically receives the controls the organization requires.
Build an acceptance test for each type
In a hypothetical organization, a collector feeds a posture dashboard. When new types arrive, select authorized samples in a test environment, record their initial configuration and perform a reversible change. Follow the path from source through capture, transformation and evaluation to display. Each stage should produce a correlatable identifier and timestamp.
Acceptance must include failures: a parser that does not recognize a type, an account without collection and an evaluation that never finishes. None should appear as compliant or zero risk. Prefer explicit states for not evaluated, stale and collection error. Finding severity and confidence in coverage answer different questions.
Keep trends from hiding the change
Adding resources changes the measured population. More findings may reflect improved visibility rather than a deteriorating environment. Preserve the date each type entered coverage and compare a stable cohort alongside the expanded total. Show resources observed, resources evaluated and resources outside scope.
Apply the same discipline to cost. Before expanding collection, estimate change volume, processing, storage and retention. Assign budget owners and criteria for reviewing noise. Silently removing a source to save money creates a blind spot; document exclusions and use compensating controls when appropriate.
Promote with evidence and a rollback path
Start with a limited set of accounts and types. Require each finding to retain its source, resource, observation time and applied rule. Test reprocessing without duplicates and make date filters explicit about which time they represent: resource state, evaluation or ingestion.
The promotion checklist is short: identified sample, proven collection, applicable rule, visible failures, named owner, observed cost and rollback procedure. Leadership receives coverage and gaps in context, while engineers can reproduce the conclusion. The intended outcome is a defensible exposure decision, not merely a larger inventory.