# Every running instance built from an image you never approved and every node carrying denylisted software, together with proof that an automated action was configured for those findings and a record of what it did when one fired

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/unauthorized-component-detection-and-response

Recipe id: `unauthorized-component-detection-and-response` · cadence continuous · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-CMT-LMC`
- KSI `KSI-SVC-VRI`
- control `cm-8.3`

## Collection

Kind: `cli`

```sh
# approved-amis-by-tag
aws configservice get-compliance-details-by-config-rule --config-rule-name approved-amis-by-tag --compliance-types NON_COMPLIANT
# ec2-managedinstance-applications-blacklisted
aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-managedinstance-applications-blacklisted --compliance-types NON_COMPLIANT
# approved-amis-by-tag-remediation
aws configservice describe-remediation-configurations --config-rule-names approved-amis-by-tag ec2-managedinstance-applications-blacklisted
# describe-remediation-execution-status
aws configservice describe-remediation-execution-status --config-rule-name approved-amis-by-tag
```

## Expected output

Two EvaluationResults arrays naming each unauthorized component by resource id, then the response half: RemediationConfigurations showing TargetType SSM_DOCUMENT, the TargetId document and version, Automatic true or false, MaximumAutomaticAttempts and RetryAttemptSeconds; and RemediationExecutionStatuses with State QUEUED, IN_PROGRESS, SUCCEEDED, FAILED or UNKNOWN plus per-step StepDetails, InvocationTime and LastUpdatedTime. An empty RemediationConfigurations list is the finding: detection with no configured action does not satisfy CM-8(3)b. Managed rule identifiers: APPROVED_AMIS_BY_TAG, EC2_MANAGEDINSTANCE_APPLICATIONS_BLACKLISTED

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

AWS Config and both managed rules are available in AWS GovCloud (US) — neither rule's Region list excludes a GovCloud Region — and config.us-gov-east-1 and config.us-gov-west-1 are both listed in the Region-support table for Config remediation actions. But the GovCloud user guide states flatly that AWS Systems Manager documents (SSM documents) for AWS Config remediation actions are not available, so expect to author your own SSM Automation document rather than attach an AWS-managed one, and confirm the document resolves in your Region before you claim the automated half. Instance and document ARNs use partition arn:aws-us-gov

## Notes

CM-8(3) has two halves and only one comes free. Detection is genuine: APPROVED_AMIS_BY_TAG is configuration-change triggered, so an instance launched from an unapproved image is flagged as it appears rather than at the next sweep, and the remediation records are real evidence of action — TargetId names the document that ran, Automatic separates auto-remediation from a button a human pressed, and StepDetails timestamps each step and quotes the error when one fails. What telemetry cannot supply is the definition of ‘unauthorized’. APPROVED_AMIS_BY_TAG matches on up to ten AMI tag keys or key:value pairs that you assert mean approved, so it tests your tagging discipline as much as your fleet — tag an unvetted image and it becomes compliant. The applications denylist needs exact application names with no wildcards, and the name differs per distribution; it evaluates AWS::SSM::ManagedInstanceInventory, so a node with no agent or no inventory association is simply not evaluated rather than flagged — read it beside the inventory-coverage recipe or you will mistake blindness for cleanliness. Neither rule sees firmware, and neither sees what a container image runs. The response side also carries a judgement someone must record: CM-8(3)b wants a chosen action — disable network access, isolate the component, notify defined personnel — and choosing to isolate a production instance automatically is a risk decision, not a default. Deliberate overlap: EC2_MANAGEDINSTANCE_APPLICATIONS_BLACKLISTED also carries CM-7 and CM-7.01 in the least-functionality recipe, where it proves prohibited software is absent; here the same signal is read as detection of an unauthorized component, with the remediation record attached.

## References

- {"title":"AWS Config managed rule: approved-amis-by-tag (APPROVED_AMIS_BY_TAG, amisByTagKeyAndValue, up to 10 tags)","url":"https://docs.aws.amazon.com/config/latest/developerguide/approved-amis-by-tag.html"}
- {"title":"AWS Config managed rule: ec2-managedinstance-applications-blacklisted","url":"https://docs.aws.amazon.com/config/latest/developerguide/ec2-managedinstance-applications-blacklisted.html"}
- {"title":"Remediating noncompliant resources with AWS Config (SSM Automation documents; Region support includes both GovCloud Regions)","url":"https://docs.aws.amazon.com/config/latest/developerguide/remediation.html"}
- {"title":"AWS CLI: configservice describe-remediation-configurations (TargetId, TargetType, Automatic, MaximumAutomaticAttempts)","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-remediation-configurations.html"}
- {"title":"AWS CLI: configservice describe-remediation-execution-status (State, StepDetails, InvocationTime)","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-remediation-execution-status.html"}
- {"title":"AWS Config in AWS GovCloud (US) — differences (SSM documents for Config remediation actions not available)","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-config.html"}