AWS securityhub high security documentation change
Summary
Added new control [Glue.4] requiring AWS Glue Spark jobs to run on supported versions, including related NIST requirements, severity level, and remediation guidance
Security assessment
The change explicitly mentions security vulnerabilities and references NIST security controls, indicating it's addressing potential security risks from running unsupported versions
Diff
diff --git a/securityhub/latest/userguide/glue-controls.md index 9cd72e910..bca1ebc59 100644 --- a/securityhub/latest/userguide/glue-controls.md +++ b/securityhub/latest/userguide/glue-controls.md @@ -5 +5 @@ -[Glue.1] AWS Glue jobs should be tagged[Glue.3] AWS Glue machine learning transforms should be encrypted at rest +[Glue.1] AWS Glue jobs should be tagged[Glue.3] AWS Glue machine learning transforms should be encrypted at rest[Glue.4] AWS Glue Spark jobs should run on supported versions of AWS Glue @@ -51 +51 @@ To add tags to a AWS Glue job, see [AWS tags in AWS Glue](https://docs.aws.amazo -**AWS Config rule:** [`glue-ml-transform-encrypted-at-rest`](https://docs.aws.amazon.com/config/latest/developerguide/glue-ml-transform-encrypted-at-rest.html) +**AWS Config rule:** [glue-ml-transform-encrypted-at-rest](https://docs.aws.amazon.com/config/latest/developerguide/glue-ml-transform-encrypted-at-rest.html) @@ -64,0 +65,24 @@ To configure encryption for AWS Glue machine learning transforms, see [Working w +## [Glue.4] AWS Glue Spark jobs should run on supported versions of AWS Glue + +**Related requirements:** NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2), NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5) + +**Category:** Identify > Vulnerability, patch, and version management + +**Severity:** Medium + +**Resource type:** `AWS::Glue::Job` + +**AWS Config rule:** [glue-spark-job-supported-version](https://docs.aws.amazon.com/config/latest/developerguide/glue-spark-job-supported-version.html) + +**Schedule type:** Change triggered + +**Parameters:** `minimumSupportedGlueVersion`: `3.0` (not customizable) + +This control checks whether an AWS Glue for Spark job is configured to run on a supported version of AWS Glue. The control fails if the Spark job is configured to run on a version of AWS Glue that's earlier than the minimum supported version. + +Running AWS Glue Spark jobs on current versions of AWS Glue can optimize performance, security, and access to the latest features of AWS Glue. It can also help safeguard against security vulnerabilities. For example, a new version might be released to provide security updates, address issues, or introduce new features. + +### Remediation + +For information about migrating a Spark job to a supported version of AWS Glue, see [Migrating AWS Glue for Spark jobs](https://docs.aws.amazon.com/glue/latest/dg/migrating-version-40.html) in the _AWS Glue User Guide_. +