AWS awssupport documentation change
Summary
Added section documenting deprecated AWS Security Hub checks and updated API error handling instructions
Security assessment
The change adds documentation about deprecated security-related checks (Security Hub controls) but does not indicate any active security vulnerabilities being addressed. The deprecation notice updates security documentation without evidence of resolving a specific security issue.
Diff
diff --git a/awssupport/latest/user/aws-trusted-advisor-change-log.md index e1d192800..aa7acb593 100644 --- a/awssupport/latest/user/aws-trusted-advisor-change-log.md +++ b/awssupport/latest/user/aws-trusted-advisor-change-log.md @@ -5 +5 @@ -New check: Amazon RDS Continuous Backup Not EnabledNew check: AWS CloudTrail Management Events LoggingUpdated the Auto Scaling Group Resources checkUpdated the IAM Access Analyzer External Access checkAdded 1 new checkUpdated 3 checksAdded 4 checksUpdated 3 checksAdded 9 new checksUpdated 1 Security check and added 1 Security checkUpdated 6 Security checksUpdated 1 fault tolerance checksUpdated 9 checksRemoved 5 checks and added 1 checkRemoved fault tolerance checksNew fault tolerance checkUpdated fault tolerance and security checksNew fault tolerance checkUpdated fault tolerance checkUpdated security checkNew security and performance checksNew security checkNew fault tolerance and cost optimization checksNew fault tolerance checksNew checks for Amazon RDSNew AWS Trusted Advisor APITrusted Advisor check removalIntegration of AWS Config checks into Trusted AdvisorNew fault tolerance checksNew service limits checkNew fault tolerance checkNew fault tolerance and performance checksNew fault tolerance checksNew fault tolerance checksRegion Expansion of Amazon ECS Fault Tolerance ChecksNew fault tolerance checksNew fault tolerance checksUpdates to the Trusted Advisor integration with AWS Security HubNew fault tolerance checks for AWS Resilience HubUpdate to the Trusted Advisor consoleNew checks for Amazon EC2Added Security Hub checks to Trusted AdvisorAdded checks from AWS Compute OptimizerUpdates to the Exposed Access Keys checkUpdated checks for AWS Direct ConnectAWS Security Hub controls added to the AWS Trusted Advisor consoleNew checks for Amazon EC2 and AWS Well-ArchitectedUpdated check name for Amazon OpenSearch ServiceAdded checks for Amazon Elastic Block Store volume storageAdded checks for AWS LambdaTrusted Advisor check removalUpdated checks for Amazon Elastic Block StoreTrusted Advisor check removalTrusted Advisor check removal +Deprecated AWS Security Hub checksNew check: Amazon RDS Continuous Backup Not EnabledNew check: AWS CloudTrail Management Events LoggingUpdated the Auto Scaling Group Resources checkUpdated the IAM Access Analyzer External Access checkAdded 1 new checkUpdated 3 checksAdded 4 checksUpdated 3 checksAdded 9 new checksUpdated 1 Security check and added 1 Security checkUpdated 6 Security checksUpdated 1 fault tolerance checksUpdated 9 checksRemoved 5 checks and added 1 checkRemoved fault tolerance checksNew fault tolerance checkUpdated fault tolerance and security checksNew fault tolerance checkUpdated fault tolerance checkUpdated security checkNew security and performance checksNew security checkNew fault tolerance and cost optimization checksNew fault tolerance checksNew checks for Amazon RDSNew AWS Trusted Advisor APITrusted Advisor check removalIntegration of AWS Config checks into Trusted AdvisorNew fault tolerance checksNew service limits checkNew fault tolerance checkNew fault tolerance and performance checksNew fault tolerance checksNew fault tolerance checksRegion Expansion of Amazon ECS Fault Tolerance ChecksNew fault tolerance checksNew fault tolerance checksUpdates to the Trusted Advisor integration with AWS Security HubNew fault tolerance checks for AWS Resilience HubUpdate to the Trusted Advisor consoleNew checks for Amazon EC2Added Security Hub checks to Trusted AdvisorAdded checks from AWS Compute OptimizerUpdates to the Exposed Access Keys checkUpdated checks for AWS Direct ConnectAWS Security Hub controls added to the AWS Trusted Advisor consoleNew checks for Amazon EC2 and AWS Well-ArchitectedUpdated check name for Amazon OpenSearch ServiceAdded checks for Amazon Elastic Block Store volume storageAdded checks for AWS LambdaTrusted Advisor check removalUpdated checks for Amazon Elastic Block StoreTrusted Advisor check removalTrusted Advisor check removal @@ -13 +13 @@ See the following topic for recent changes to Trusted Advisor checks. -If you use the Trusted Advisor console or the AWS Support API, checks that were removed won't appear in check results. If you use any of the removed checks such as specifying the check ID in an AWS Support API operation or your code, you must remove these checks to avoid API call errors. +If you use the Trusted Advisor console or the AWS Support API, checks that were removed won't appear in check results. If you use a removed check, such as specifying the check ID in an AWS Support API operation or your code, then you receive API call errors. Remove these checks to avoid errors. @@ -16,0 +17,13 @@ For more information about the available checks, see the [AWS Trusted Advisor ch +## Deprecated AWS Security Hub checks + +The following AWS Security Hub checks are deprecated: + +Check name | Check ID +---|--- +S3.10 - S3 general purpose buckets with versioning enabled should have Lifecycle configurations | `Hs4Ma3G211` +S3.11 - S3 general purpose buckets should have event notifications enabled | `Hs4Ma3G212` +CodeBuild.5 - CodeBuild project environments should not have privileged mode enabled | `Hs4Ma3G218` +CloudFormation.1 - CloudFormation stacks should be integrated with Amazon Simple Notification Service (SNS) | `Hs4Ma3G245` +SNS.2 - Logging of delivery status should be enabled for notification messages sent to a topic | `Hs4Ma3G263` +Athena.1 - Athena workgroups should be encrypted at rest | `Hs4Ma3G294` +