AWS securityhub documentation change
Summary
Updated resource mappings for multiple AWS services across security standards (FSBP, CIS, NIST, PCI DSS). Added new controls for Amplify, EC2, ECS, Redshift, SageMaker, Transfer Family, and others. Expanded resource coverage for tagging standard.
Security assessment
Changes primarily document new/updated security controls and resource requirements for compliance standards. While these relate to security posture, there's no evidence of addressing specific vulnerabilities. The additions (e.g., EC2.174-179 controls, SageMaker.6-7) represent expanded security guidance rather than patching known issues.
Diff
diff --git a/securityhub/latest/userguide/controls-config-resources.md b/securityhub/latest/userguide/controls-config-resources.md index fc5542b84..4b3d4269b 100644 --- a//securityhub/latest/userguide/controls-config-resources.md +++ b//securityhub/latest/userguide/controls-config-resources.md @@ -5 +5 @@ -Required resources for all Security Hub controlsRequired resources for FSBP standardRequired resources for CIS AWS Foundations BenchmarkRequired resources for NIST SP 800-53 Rev. 5Required resources for PCI DSS v3.2.1Required resources for AWS Resource Tagging StandardRequired resources for Service-Managed Standard: AWS Control Tower +Required resources for all Security Hub controlsRequired resources for the FSBP standardRequired resources for CIS AWS Foundations BenchmarkRequired resources for NIST SP 800-53 Rev. 5Required resources for PCI DSS v3.2.1Required resources for the AWS Resource Tagging StandardRequired resources for Service-Managed Standard: AWS Control Tower @@ -17 +17 @@ Security Hub controls can rely on managed AWS Config rules or custom Security Hu -In AWS Regions where a control isn't available, the corresponding resource isn't available in AWS Config. For a list of these limits, see [Regional limits on controls](./regions-controls.html). +In AWS Regions where a control isn't available, the corresponding resource isn't available in AWS Config. For a list of these limits, see [Regional limits on Security Hub controls](./regions-controls.html). @@ -24,0 +25,2 @@ Service | Required resource | Related controls +AWS Amplify | `AWS::Amplify::App` | Amplify.1 +`AWS::Amplify::Branch` | Amplify.2 @@ -40 +42 @@ AWS Backup | `AWS::Backup::BackupPlan` | Backup.5 -AWS Batch | `AWS::Batch::ComputeEnvironment` | Batch.3 +AWS Batch | `AWS::Batch::ComputeEnvironment` | Batch.3 Batch.4 @@ -58 +60 @@ Amazon Connect | `AWS::CustomerProfiles::ObjectType` | Connect.1 -AWS DataSync | `AWS::DataSync::Task` | DataSync.1 +AWS DataSync | `AWS::DataSync::Task` | DataSync.1 DataSync.2 @@ -68,0 +71 @@ Amazon Elastic Compute Cloud (EC2) | `AWS::EC2::ClientVpnEndpoint` | EC2.51 +`AWS::EC2::DHCPOptions` | EC2.174 @@ -73 +76 @@ Amazon Elastic Compute Cloud (EC2) | `AWS::EC2::ClientVpnEndpoint` | EC2.51 -`AWS::EC2::LaunchTemplate` | EC2.25 EC2.170 +`AWS::EC2::LaunchTemplate` | EC2.25 EC2.170 EC2.175 @@ -76,0 +80 @@ Amazon Elastic Compute Cloud (EC2) | `AWS::EC2::ClientVpnEndpoint` | EC2.51 +`AWS::EC2::PrefixList` | EC2.176 @@ -78,0 +83 @@ Amazon Elastic Compute Cloud (EC2) | `AWS::EC2::ClientVpnEndpoint` | EC2.51 +`AWS::EC2::SpotFleet` | EC2.173 @@ -79,0 +85,3 @@ Amazon Elastic Compute Cloud (EC2) | `AWS::EC2::ClientVpnEndpoint` | EC2.51 +`AWS::EC2::TrafficMirrorFilter` | EC2.178 +`AWS::EC2::TrafficMirrorSession` | EC2.177 +`AWS::EC2::TrafficMirrorTarget` | EC2.179 @@ -99 +107 @@ Amazon Elastic Container Service (Amazon ECS) | `AWS::ECS::Cluster` | ECS.12 EC -`AWS::ECS::TaskDefinition` | ECS.1 ECS.3 ECS.4 ECS.5 ECS.8 ECS.9 ECS.15 +`AWS::ECS::TaskDefinition` | ECS.1 ECS.3 ECS.4 ECS.5 ECS.8 ECS.9 ECS.15 ECS.17 @@ -173 +181 @@ Amazon Redshift | `AWS::Redshift::Cluster` | Redshift.1 Redshift.2 Redshift.3 R -`AWS::Redshift::ClusterParameterGroup` | Redshift.2 +`AWS::Redshift::ClusterParameterGroup` | Redshift.2 Redshift.17 @@ -183 +191,2 @@ Amazon Simple Storage Service (Amazon S3) | `AWS::S3::AccessPoint` | S3.19 -Amazon SageMaker AI | `AWS::SageMaker::NotebookInstance` | SageMaker.2 SageMaker.3 +Amazon SageMaker AI | `AWS::SageMaker::AppImageConfig` | SageMaker.6 +`AWS::SageMaker::Image` | SageMaker.7 @@ -184,0 +194 @@ Amazon SageMaker AI | `AWS::SageMaker::NotebookInstance` | SageMaker.2 SageMak +`AWS::SageMaker::NotebookInstance` | SageMaker.2 SageMaker.3 @@ -193 +203,5 @@ AWS Step Functions | `AWS::StepFunctions::StateMachine` | StepFunctions.1 -AWS Transfer Family | `AWS::Transfer::Connector` | Transfer.3 +AWS Systems Manager (SSM) | `AWS::SSM::Document` | SSM.5 +AWS Transfer Family | `AWS::Transfer::Agreement` | Transfer.4 +`AWS::Transfer::Certificate` | Transfer.5 +`AWS::Transfer::Connector` | Transfer.3 Transfer.6 +`AWS::Transfer::Profile` | Transfer.7 @@ -205 +219 @@ Amazon WorkSpaces | `AWS::WorkSpaces::WorkSpace` | WorkSpaces.1 WorkSpaces.2 -## Required resources for FSBP standard +## Required resources for the FSBP standard @@ -224 +238 @@ Amazon EC2 Systems Manager (SSM) | `AWS::SSM::AssociationCompliance` `AWS::SSM -Amazon Elastic Compute Cloud (EC2) | `AWS::EC2::ClientVpnEndpoint` `AWS::EC2::Instance` `AWS::EC2::LaunchTemplate` `AWS::EC2::NetworkAcl` `AWS::EC2::NetworkInterface` `AWS::EC2::SecurityGroup` `AWS::EC2::Subnet` `AWS::EC2::TransitGateway` `AWS::EC2::VPCBlockPublicAccessOptions` `AWS::EC2::VPNConnection` `AWS::EC2::Volume` +Amazon Elastic Compute Cloud (EC2) | `AWS::EC2::ClientVpnEndpoint` `AWS::EC2::Instance` `AWS::EC2::LaunchTemplate` `AWS::EC2::NetworkAcl` `AWS::EC2::NetworkInterface` `AWS::EC2::SecurityGroup` `AWS::EC2::SpotFleet` `AWS::EC2::Subnet` `AWS::EC2::TransitGateway` `AWS::EC2::VPCBlockPublicAccessOptions` `AWS::EC2::VPNConnection` `AWS::EC2::Volume` @@ -242 +256 @@ Amazon OpenSearch Service | `AWS::OpenSearch::Domain` -Amazon Relational Database Service (Amazon RDS) | `AWS::RDS::DBCluster` `AWS::RDS::DBClusterSnapshot` `AWS::RDS::DBInstance` `AWS::RDS::DBSnapshot` `AWS::RDS::EventSubscription` +Amazon Relational Database Service (Amazon RDS) | `AWS::RDS::DBCluster` `AWS::RDS::DBClusterSnapshot` `AWS::RDS::DBInstance` `AWS::RDS::DBProxy` `AWS::RDS::DBSnapshot` `AWS::RDS::EventSubscription` @@ -243,0 +258 @@ Amazon Redshift | `AWS::Redshift::Cluster` `AWS::Redshift::ClusterSubnetGroup` +Amazon Redshift Serverless | `AWS::RedshiftServerless::Workgroup` @@ -356 +371 @@ Amazon EC2 Systems Manager (SSM) | `AWS::SSM::AssociationCompliance` `AWS::SSM -## Required resources for AWS Resource Tagging Standard +## Required resources for the AWS Resource Tagging Standard @@ -362 +377 @@ Service | Required resources -AWS AppConfig | `AWS::AppConfig::Application` `AWS::AppConfig::ConfigurationProfile` `AWS::AppConfig::Environment` `AWS::AppConfig::ExtensionAssociation` +AWS Amplify | `AWS::Amplify::App` `AWS::Amplify::Branch` @@ -364,0 +380 @@ AWS App Runner | `AWS::AppRunner::Service` `AWS::AppRunner::VpcConnector` +AWS AppConfig | `AWS::AppConfig::Application` `AWS::AppConfig::ConfigurationProfile` `AWS::AppConfig::Environment` `AWS::AppConfig::ExtensionAssociation` @@ -367,2 +383 @@ Amazon Athena | `AWS::Athena::DataCatalog` `AWS::Athena::WorkGroup` -AWS Certificate Manager (ACM) | `AWS::ACM::Certificate` -AWS Backup (AWS Backup) | `AWS::Backup::BackupPlan` `AWS::Backup::BackupVault` `AWS::Backup::RecoveryPlan` `AWS::Backup::ReportPlan` +AWS Backup | `AWS::Backup::BackupPlan` `AWS::Backup::BackupVault` `AWS::Backup::RecoveryPlan` `AWS::Backup::ReportPlan` @@ -369,0 +385 @@ AWS Batch | `AWS::Batch::ComputeEnvironment` `AWS::Batch::JobQueue` `AWS::Batc +AWS Certificate Manager (ACM) | `AWS::ACM::Certificate` @@ -376 +391,0 @@ Amazon Connect | `AWS::CustomerProfiles::ObjectType` -Amazon Detective | `AWS::Detective::Graph` @@ -377,0 +393,2 @@ AWS Database Migration Service (AWS DMS) | `AWS::DMS::Certificate` `AWS::DMS:: +AWS DataSync | `AWS::DataSync::Task` +Amazon Detective | `AWS::Detective::Graph` @@ -379 +396 @@ Amazon DynamoDB | `AWS::DynamoDB::Trail` -Amazon Elastic Compute Cloud (EC2) | `AWS::EC2::CustomerGateway` `AWS::EC2::EIP` `AWS::EC2::FlowLog` `AWS::EC2::Instance` `AWS::EC2::InternetGateway` `AWS::EC2::NatGateway` `AWS::EC2::NetworkAcl` `AWS::EC2::NetworkInterface` `AWS::EC2::RouteTable` `AWS::EC2::SecurityGroup` `AWS::EC2::Subnet` `AWS::EC2::TransitGateway` `AWS::EC2::TransitGatewayAttachment` `AWS::EC2::TransitGatewayRouteTable` `AWS::EC2::Volume` `AWS::EC2::VPC` `AWS::EC2::VPCEndpointService` `AWS::EC2::VPCPeeringConnection` `AWS::EC2::VPNGateway` +Amazon Elastic Compute Cloud (EC2) | `AWS::EC2::CustomerGateway` `AWS::EC2::DHCPOptions` `AWS::EC2::EIP` `AWS::EC2::FlowLog` `AWS::EC2::Instance` `AWS::EC2::InternetGateway` `AWS::EC2::LaunchTemplate` `AWS::EC2::NatGateway` `AWS::EC2::NetworkAcl` `AWS::EC2::NetworkInterface` `AWS::EC2::PrefixList` `AWS::EC2::RouteTable` `AWS::EC2::SecurityGroup` `AWS::EC2::Subnet` `AWS::EC2::TrafficMirrorFilter` `AWS::EC2::TrafficMirrorSession` `AWS::EC2::TrafficMirrorTarget` `AWS::EC2::TransitGateway` `AWS::EC2::TransitGatewayAttachment` `AWS::EC2::TransitGatewayRouteTable` `AWS::EC2::Volume` `AWS::EC2::VPC` `AWS::EC2::VPCEndpointService` `AWS::EC2::VPCPeeringConnection` `AWS::EC2::VPNGateway` @@ -385 +402 @@ Amazon Elastic Kubernetes Service (Amazon EKS) | `AWS::EKS::Cluster` `AWS::EKS -AWS Elastic Beanstalk (Elastic Beanstalk) | `AWS::ElasticBeanstalk::Environment` +AWS Elastic Beanstalk | `AWS::ElasticBeanstalk::Environment` @@ -408 +425 @@ Amazon Relational Database Service | `AWS::RDS::DBCluster` `AWS::RDS::DBCluste -Amazon Redshift | `AWS::Redshift::Cluster` `AWS::Redshift::ClusterSnapshot` `AWS::Redshift::ClusterSubnetGroup` `AWS::Redshift::EventSubscription` +Amazon Redshift | `AWS::Redshift::Cluster` `AWS::Redshift::ClusterParameterGroup` `AWS::Redshift::ClusterSnapshot` `AWS::Redshift::ClusterSubnetGroup` `AWS::Redshift::EventSubscription` @@ -409,0 +427 @@ Amazon Route 53 | `AWS::Route53::HealthCheck` +Amazon SageMaker AI | `AWS::SageMaker::AppImageConfig` `AWS::SageMaker::Image` @@ -415 +433,2 @@ AWS Step Functions | `AWS::StepFunctions::Activity` -AWS Transfer Family | `AWS::Transfer::Workflow` +AWS Systems Manager (SSM) | `AWS::SSM::Document` +AWS Transfer Family | `AWS::Transfer::Agreement` `AWS::Transfer::Certificate` `AWS::Transfer::Connector` `AWS::Transfer::Profile` `AWS::Transfer::Workflow` @@ -447 +465,0 @@ Amazon Simple Queue Service (Amazon SQS) | `AWS::SQS::Queue` -Amazon EC2 Systems Manager (SSM) | `AWS::SSM::AssociationCompliance` `AWS::SSM::ManagedInstanceInventory` `AWS::SSM::PatchCompliance` @@ -448,0 +467 @@ AWS Secrets Manager | `AWS::SecretsManager::Secret` +Amazon EC2 Systems Manager (SSM) | `AWS::SSM::AssociationCompliance` `AWS::SSM::ManagedInstanceInventory` `AWS::SSM::PatchCompliance`