AWS securityhub low security documentation change
Summary
Added new control [Batch.4] for tagging compute resources in managed Batch environments, updated Config rule links, and clarified parameter constraints for tag keys
Security assessment
The addition of [Batch.4] control explicitly addresses security through tagging requirements for compute resources, which supports access control (ABAC) and resource management. The documentation emphasizes security implications of tagging and warns against storing sensitive data in tags.
Diff
diff --git a/securityhub/latest/userguide/batch-controls.md b/securityhub/latest/userguide/batch-controls.md index 8bc9d9f51..c134ae537 100644 --- a//securityhub/latest/userguide/batch-controls.md +++ b//securityhub/latest/userguide/batch-controls.md @@ -5 +5 @@ -[Batch.1] Batch job queues should be tagged[Batch.2] Batch scheduling policies should be tagged[Batch.3] Batch compute environments should be tagged +[Batch.1] Batch job queues should be tagged[Batch.2] Batch scheduling policies should be tagged[Batch.3] Batch compute environments should be tagged[Batch.4] Compute resources properties in managed Batch compute environments should be tagged @@ -9,3 +9 @@ -These Security Hub controls evaluate the AWS Batch service and resources. - -These controls may not be available in all AWS Regions. For more information, see [Availability of controls by Region](./securityhub-regions.html#securityhub-regions-control-support). +These Security Hub controls evaluate the AWS Batch service and resources. The controls might not be available in all AWS Regions. For more information, see [Availability of controls by Region](./securityhub-regions.html#securityhub-regions-control-support). @@ -21 +19 @@ These controls may not be available in all AWS Regions. For more information, se -**AWS Config rule:** `batch-job-queue-tagged` +**AWS Config rule:** [batch-job-queue-tagged](https://docs.aws.amazon.com/config/latest/developerguide/batch-job-queue-tagged.html) @@ -29 +27 @@ Parameter | Description | Type | Allowed custom values | Security Hub default va -`requiredKeyTags` | List of non-system tag keys that the evaluated resource must contain. Tag keys are case sensitive. | StringList | List of tags that meet [AWS requirements](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html#tag-conventions) | No default value +`requiredKeyTags` | List of non-system tag keys that the evaluated resource must contain. Tag keys are case sensitive. | StringList (maximum of 6 items) | 1–6 tag keys that meet [AWS requirements](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html#tag-conventions). | No default value @@ -51 +49 @@ To add tags to a Batch job queue, see [Tag your resources](https://docs.aws.amaz -**AWS Config rule:** `batch-scheduling-policy-tagged` +**AWS Config rule:** [batch-scheduling-policy-tagged](https://docs.aws.amazon.com/config/latest/developerguide/batch-scheduling-policy-tagged.html) @@ -59 +57 @@ Parameter | Description | Type | Allowed custom values | Security Hub default va -`requiredKeyTags` | List of non-system tag keys that the evaluated resource must contain. Tag keys are case sensitive. | StringList | List of tags that meet [AWS requirements](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html#tag-conventions) | No default value +`requiredKeyTags` | List of non-system tag keys that the evaluated resource must contain. Tag keys are case sensitive. | StringList (maximum of 6 items) | 1–6 tag keys that meet [AWS requirements](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html#tag-conventions). | No default value @@ -81 +79 @@ To add tags to a Batch scheduling policy, see [Tag your resources](https://docs. -**AWS Config rule:** `batch-compute-environment-tagged` +**AWS Config rule:** [batch-compute-environment-tagged](https://docs.aws.amazon.com/config/latest/developerguide/batch-compute-environment-tagged.html) @@ -89 +87 @@ Parameter | Description | Type | Allowed custom values | Security Hub default va -`requiredKeyTags` | List of non-system tag keys that the evaluated resource must contain. Tag keys are case sensitive. | StringList | List of tags that meet [AWS requirements](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html#tag-conventions) | No default value +`requiredKeyTags` | List of non-system tag keys that the evaluated resource must contain. Tag keys are case sensitive. | StringList (maximum of 6 items) | 1–6 tag keys that meet [AWS requirements](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html#tag-conventions). | No default value @@ -102,0 +101,30 @@ To add tags to a Batch compute environment, see [Tag your resources](https://doc +## [Batch.4] Compute resources properties in managed Batch compute environments should be tagged + +**Category:** Identify > Inventory > Tagging + +**Severity:** Low + +**Resource type:** `AWS::Batch::ComputeEnvironment` + +**AWS Config rule:** [batch-managed-compute-env-compute-resources-tagged](https://docs.aws.amazon.com/config/latest/developerguide/batch-managed-compute-env-compute-resources-tagged.html) + +**Schedule type:** Change triggered + +**Parameters:** + +Parameter | Description | Type | Allowed custom values | Security Hub default value +---|---|---|---|--- +`requiredKeyTags` | A list of non-system tag keys that must be assigned to an evaluated resource. Tag keys are case sensitive. | StringList (maximum of 6 items) | 1–6 tag keys that meet [AWS requirements](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html#tag-conventions). | No default value + +This control checks whether the compute resources property in a managed AWS Batch compute environment has the tag keys specified by the `requiredKeyTags` parameter. The control fails if the compute resources property doesn't have any tag keys, or it doesn't have all the keys specified by the `requiredKeyTags` parameter. If you don't specify any values for the `requiredKeyTags` parameter, the control checks only for the existence of a tag key and fails if a compute resources property doesn't have any tag keys. The control ignores system tags, which are applied automatically and have the `aws:` prefix. This control doesn’t evaluate unmanaged compute environments, or managed environments that use AWS Fargate resources. + +A tag is a label that you create and assign to an AWS resource. Each tag consists of a required tag key and an optional tag value. You can use tags to categorize resources by purpose, owner, environment, or other criteria. They can help you identify, organize, search for, and filter resources. They can also help you track resource owners for actions and notifications. You can also use tags to implement attribute-based access control (ABAC) as an authorization strategy. For more information about ABAC strategies, see [Define permissions based on attributes with ABAC authorization](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access-control.html) in the _IAM User Guide_. For more information about tags, see the [Tagging AWS Resources and Tag Editor User Guide](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html). + +###### Note + +Do not store personally identifiable information (PII) or other confidential or sensitive information in tags. Tags are accessible from many AWS services. They aren't intended to be used for private or sensitive data. + +### Remediation + +For information about adding tags to compute resources in a managed AWS Batch compute environment, see [Tag your resources](https://docs.aws.amazon.com/batch/latest/userguide/tag-resources.html) in the _AWS Batch User Guide_. +