AWS securityhub documentation change
Summary
Added a new control [Connect.2] requiring Amazon Connect instances to have CloudWatch logging enabled, including details about the control's category, severity, resource type, AWS Config rule, and remediation steps.
Security assessment
The change adds documentation about enabling CloudWatch logging for Amazon Connect instances, which is a security best practice for monitoring and auditing purposes. However, there is no evidence this change addresses a specific security vulnerability or incident.
Diff
diff --git a/securityhub/latest/userguide/connect-controls.md index 9ab7d7acb..ce848ebb5 100644 --- a/securityhub/latest/userguide/connect-controls.md +++ b/securityhub/latest/userguide/connect-controls.md @@ -5 +5 @@ -[Connect.1] Amazon Connect Customer Profiles object types should be tagged +[Connect.1] Amazon Connect Customer Profiles object types should be tagged[Connect.2] Amazon Connect instances should have CloudWatch logging enabled @@ -42,0 +43,22 @@ To add tags to a Customer Profiles object type, see [Add tags to resources in Am +## [Connect.2] Amazon Connect instances should have CloudWatch logging enabled + +**Category:** Identify > Logging + +**Severity:** Medium + +**Resource type:** `AWS::Connect::Instance` + +**AWS Config rule:** [connect-instance-logging-enabled](https://docs.aws.amazon.com/config/latest/developerguide/connect-instance-logging-enabled.html) + +**Schedule type:** Change triggered + +**Parameters:** None + +This control checks whether an Amazon Connect instance is configured to generate and store flow logs in an Amazon CloudWatch log group. The control fails if the Amazon Connect instance isn't configured to generate and store flow logs in a CloudWatch log group. + +Amazon Connect flow logs provide real-time details about events in Amazon Connect flows. A _flow_ defines the customer experience with an Amazon Connect contact center from start to finish. By default, when you create a new Amazon Connect instance, an Amazon CloudWatch log group is created automatically to store flow logs for the instance. Flow logs can help you analyze flows, find errors, and monitor operational metrics. You can also set up alerts for specific events that can occur in a flow. + +### Remediation + +For information about enabling flow logs for an Amazon Connect instance, see [Enable Amazon Connect flow logs in an Amazon CloudWatch log group](https://docs.aws.amazon.com/connect/latest/adminguide/contact-flow-logs.html) in the _Amazon Connect Administrator Guide_. +