AWS securityhub documentation change
Summary
Updated resource mappings for various AWS services, including adding new controls for Amazon Connect, ECR, ELB, Glue, Network Firewall, RDS, SQS, Transfer Family, and others. Also made minor formatting and wording changes.
Security assessment
The changes primarily update resource mappings and add new controls to the documentation. While some of these controls may have security implications, there is no specific evidence in the diff that these changes address security vulnerabilities or incidents.
Diff
diff --git a/securityhub/latest/userguide/controls-config-resources.md index 68d715e6d..40fa1de44 100644 --- a/securityhub/latest/userguide/controls-config-resources.md +++ b/securityhub/latest/userguide/controls-config-resources.md @@ -36 +36 @@ AWS AppSync | `AWS::AppSync::GraphQLApi` | AppSync.2 AppSync.4 AppSync.5 -AWS Backup (AWS Backup) | `AWS::Backup::BackupPlan` | Backup.5 +AWS Backup | `AWS::Backup::BackupPlan` | Backup.5 @@ -56 +55,0 @@ Amazon Cognito | `AWS::Cognito::UserPool` | Cognito.1 -Amazon Cognito | `AWS::Cognito::UserPool` | Cognito.1 @@ -57,0 +57 @@ Amazon Connect | `AWS::CustomerProfiles::ObjectType` | Connect.1 +`AWS::Connect::Instance` | Connect.2 @@ -61 +61 @@ AWS Database Migration Service (AWS DMS) | `AWS::DMS::Certificate` | DMS.2 -`AWS::DMS::Endpoint` | `DMS.9` `DMS.10` `DMS.11` `DMS.12` +`AWS::DMS::Endpoint` | DMS.9 DMS.10 DMS.11 DMS.12 @@ -96 +96 @@ Amazon Elastic Container Registry (Amazon ECR) | `AWS::ECR::PublicRepository` | -`AWS::ECR::Repository` | ECR.2 ECR.3 +`AWS::ECR::Repository` | ECR.2 ECR.3 ECR.5 @@ -106,0 +107 @@ Elastic Load Balancing | `AWS::ElasticLoadBalancing::LoadBalancer` | ELB.2 ELB. +`AWS::ElasticLoadBalancingV2::Listener` | ELB.17 @@ -117 +118 @@ AWS Global Accelerator | `AWS::GlobalAccelerator::Accelerator` | GlobalAccelera -AWS Glue | `AWS::Glue::Job` | Glue.1 +AWS Glue | `AWS::Glue::Job` | Glue.1 Glue.4 @@ -139,3 +139,0 @@ AWS IoT Events | `AWS::IoTEvents::AlarmModel` | IoTEvents.3 -AWS IoT Events | `AWS::IoTEvents::AlarmModel` | IoTEvents.3 -`AWS::IoTEvents::DetectorModel` | IoTEvents.2 -`AWS::IoTEvents::Input` | IoTEvents.1 @@ -162 +160 @@ Amazon MQ | `AWS::AmazonMQ::Broker` | MQ.2 MQ.3 MQ.4 MQ.5 MQ.6 -AWS Network Firewall | `AWS::NetworkFirewall::Firewall` | NetworkFirewall.1 NetworkFirewall.7 NetworkFirewall.9 +AWS Network Firewall | `AWS::NetworkFirewall::Firewall` | NetworkFirewall.1 NetworkFirewall.7 NetworkFirewall.9 NetworkFirewall.10 @@ -169 +167 @@ Amazon Relational Database Service (Amazon RDS) | `AWS::RDS::DBCluster` | Docum -`AWS::RDS::DBInstance` | RDS.2 RDS.3 RDS.5 RDS.6 RDS.8 RDS.9 RDS.10 RDS.11 RDS.13 RDS.17 RDS.18 RDS.23 RDS.25 RDS.30 RDS.36 +`AWS::RDS::DBInstance` | RDS.2 RDS.3 RDS.5 RDS.6 RDS.8 RDS.9 RDS.10 RDS.11 RDS.13 RDS.17 RDS.18 RDS.23 RDS.25 RDS.30 RDS.36 RDS.40 @@ -192 +190 @@ Amazon Simple Notification Service (Amazon SNS) | `AWS::SNS::Topic` | SNS.1 SN -Amazon Simple Queue Service (Amazon SQS) | `AWS::SQS::Queue` | SQS.1 SQS.2 +Amazon Simple Queue Service (Amazon SQS) | `AWS::SQS::Queue` | SQS.1 SQS.2 SQS.3 @@ -195 +193,2 @@ AWS Step Functions | `AWS::StepFunctions::StateMachine` | StepFunctions.1 -AWS Transfer Family | `AWS::Transfer::Workflow` | Transfer.1 +AWS Transfer Family | `AWS::Transfer::Connector` | Transfer.3 +`AWS::Transfer::Workflow` | Transfer.1 @@ -219,0 +219 @@ Amazon Cognito | `AWS::Cognito::UserPool` +Amazon Connect | `AWS::Connect::Instance` @@ -231 +231 @@ ElasticBeanstalk | `AWS::ElasticBeanstalk::Environment` -Elastic Load Balancing | `AWS::ElasticLoadBalancing::LoadBalancer` `AWS::ElasticLoadBalancingV2::LoadBalancer` +Elastic Load Balancing | `AWS::ElasticLoadBalancing::LoadBalancer` `AWS::ElasticLoadBalancingV2::Listener` `AWS::ElasticLoadBalancingV2::LoadBalancer` @@ -250,0 +251 @@ AWS Step Functions | `AWS::StepFunctions::StateMachine` +AWS Transfer Family | `AWS::Transfer::Connector` @@ -256,3 +257 @@ Amazon WorkSpaces | `AWS::WorkSpaces::WorkSpace` -To run security checks for enabled controls that apply to the Center for Internet Security (CIS) AWS Foundations Benchmark, Security Hub either runs through the exact audit steps prescribed for the checks in [Securing Amazon Web Services](https://www.cisecurity.org/benchmark/amazon_web_services/) or uses specific AWS Config managed rules. - -For more information about this standard, see [CIS AWS Foundations Benchmark](./cis-aws-foundations-benchmark.html). +To run security checks for enabled controls that apply to the Center for Internet Security (CIS) AWS Foundations Benchmark, Security Hub either runs through the exact audit steps prescribed for the checks in [Securing Amazon Web Services](https://www.cisecurity.org/benchmark/amazon_web_services/) or uses specific AWS Config managed rules. For more information about this standard, see [CIS AWS Foundations Benchmark](./cis-aws-foundations-benchmark.html). @@ -293 +292 @@ AWS Identity and Access Management (IAM) | `AWS::IAM::Policy` `AWS::IAM::User` -For Security Hub to accurately report findings for enabled National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 change triggered controls that use an AWS Config rule, you must record these resources in AWS Config. You only have to record resources for controls that have a schedule type of _change triggered_. For more information about this standard, see [NIST SP 800-53 Rev. 5 in Security Hub](./nist-standard.html). +For Security Hub to accurately report findings for enabled National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 change triggered controls that use an AWS Config rule, you must record these resources in AWS Config. You have to record resources only for controls that have a schedule type of _change triggered_. For more information about this standard, see [NIST SP 800-53 Rev. 5 in Security Hub](./nist-standard.html). @@ -314 +313 @@ ElasticBeanstalk | `AWS::ElasticBeanstalk::Environment` -Elastic Load Balancing | `AWS::ElasticLoadBalancing::LoadBalancer` `AWS::ElasticLoadBalancingV2::LoadBalancer` +Elastic Load Balancing | `AWS::ElasticLoadBalancing::LoadBalancer` `AWS::ElasticLoadBalancingV2::Listener` `AWS::ElasticLoadBalancingV2::LoadBalancer` @@ -317,0 +317 @@ Amazon EventBridge | `AWS::Events::Endpoint` `AWS::Events::EventBus` +AWS Glue | `AWS::Glue::Job` @@ -335,0 +336 @@ AWS Secrets Manager | `AWS::SecretsManager::Secret` +AWS Transfer Family | `AWS::Transfer::Connector`