AWS managedservices documentation change
Summary
Updated documentation to include Security Hub controls, restructured tables, added remediation parameters, and clarified security-related automation steps for Trusted Advisor checks. Enhanced integration guidance with AWS Config and Security Hub.
Security assessment
The changes primarily document security best practices and remediation automations tied to AWS Security Hub controls (e.g., encryption, deletion protection, audit logging). While these address security posture improvements, there is no explicit evidence of patching a specific vulnerability or incident response.
Diff
diff --git a/managedservices/latest/userguide/tr-supported-checks.md b/managedservices/latest/userguide/tr-supported-checks.md index 378e5f8a3..c77873994 100644 --- a//managedservices/latest/userguide/tr-supported-checks.md +++ b//managedservices/latest/userguide/tr-supported-checks.md @@ -10,0 +11,2 @@ The following table lists the supported Trusted Advisor checks, SSM automation d +Make sure that the corresponding config rule for each Trusted Advisor check is present for the supported checks that you want to enable remediation for. For more information, see [ View AWS Trusted Advisor checks powered by AWS Config](https://docs.aws.amazon.com/awssupport/latest/user/aws-config-integration-with-ta.html). If a check has corresponding AWS Security Hub controls, make sure that the Security Hub control is enabled. For more information, see [Enabling controls in Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-enable-disable-controls.html). For information on managing preconfigured parameters, see [ Configure Trusted Advisor check remediation in Trusted Remediator](https://docs.aws.amazon.com/managedservices/latest/accelerate-guide/tr-configure-remediations.html). + @@ -13,4 +15,4 @@ The following table lists the supported Trusted Advisor checks, SSM automation d -Check ID and name | SSM document name and expected outcome | Supported preconfigured parameters | Constraints ----|---|---|--- -[Z4AUBRNSmz](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#unassociated-elastic-ip-addresses) Unassociated Elastic IP Addresses | **AWSManagedServices-TrustedRemediatorReleaseElasticIP** Releases an elastic IP address that is not associated with any resource. | No preconfigured parameters are allowed. | No constraints -[c18d2gz128 ](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#amazon-ecr-repository-without-lifecycle-policy) Amazon ECR Repository Without Lifecycle Policy Configured | **AWSManagedServices-TrustedRemediatorPutECRLifecyclePolicy** Creates a lifecycle policy for the specified repository if a lifecycle policy does not already exist. | **ImageAgeLimit:** The maximum age limit in days (1-365) for 'any' image in the Amazon ECR repository. | No constraints +Check ID and name | SSM document name and expected outcome | Supported preconfigured parameters and constraints +---|---|--- +[Z4AUBRNSmz](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#unassociated-elastic-ip-addresses) Unassociated Elastic IP Addresses | **AWSManagedServices-TrustedRemediatorReleaseElasticIP** Releases an elastic IP address that is not associated with any resource. | No preconfigured parameters are allowed. No constraints +[c18d2gz128 ](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#amazon-ecr-repository-without-lifecycle-policy) Amazon ECR Repository Without Lifecycle Policy Configured | **AWSManagedServices-TrustedRemediatorPutECRLifecyclePolicy** Creates a lifecycle policy for the specified repository if a lifecycle policy does not already exist. | **ImageAgeLimit:** The maximum age limit in days (1-365) for 'any' image in the Amazon ECR repository. No constraints @@ -22,5 +24,5 @@ Check ID and name | SSM document name and expected outcome | Supported preconfig -| No constraints -[hjLMh88uM8](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#idle-load-balancers) Idle Load Balancers | **AWSManagedServices-DeleteIdleClassicLoadBalancer** Deletes an idle Classic Load Balancer if it's unused and no instances are registered. | **IdleLoadBalancerDays:** The number of days that the Classic Load Balancer has 0 requested connections before considering it idle. The default is 7 days. | If auto execution is enabled, then the automation deletes idle Classic Load Balancers only if there are no active back-end instances. For all idle Classic Load Balancers that have active back-end instances, but don't have healthy back-end instances, auto remediation isn't used and OpsItems for manual remediation are created. -[Ti39halfu8](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#amazon-rds-idle-dbs-instances) Amazon RDS Idle DB Instances | **AWSManagedServices-StopIdleRDSInstance** Amazon RDS DB instance that has been in an idle state for the last 7 days is stopped. | No preconfigured parameters are allowed. | No constraints -[COr6dfpM05](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#aws-lambda-over-provisioned-functions-memory-size) AWS Lambda over-provisioned functions for memory size | **AWSManagedServices-ResizeLambdaMemory** AWS Lambda function's memory size is resized to the recommended memory size provided by Trusted Advisor. | **RecommendedMemorySize:** The recommended memory allocation for the Lambda function. Value range is between 128 and 10240. | If the Lambda function size was modified before the automation runs, then the settings might be overwritten by this automation with the value recommended by Trusted Advisor. -[Qch7DwouX1](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#low-utilization-amazon-ec2-instances) Low Utilization Amazon EC2 Instances | **AWSManagedServices-StopEC2Instance** (Default SSM document for both auto and manual execution mode.) Amazon EC2 instances with low utilization are stopped. | **ForceStopWithInstanceStore:** Set to `true` to force stop instances using instance store. Otherwise, set to `false`. The default value of `false` prevents instance from stopping. Valid values are true or false (case-sensitive). | No constraints +No constraints +[hjLMh88uM8](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#idle-load-balancers) Idle Load Balancers | **AWSManagedServices-DeleteIdleClassicLoadBalancer** Deletes an idle Classic Load Balancer if it's unused and no instances are registered. | **IdleLoadBalancerDays:** The number of days that the Classic Load Balancer has 0 requested connections before considering it idle. The default is seven days. If auto execution is enabled, the automation deletes idle Classic Load Balancers if there are no active back-end instances. For all idle Classic Load Balancers that have active back-end instances, but don't have healthy back-end instances, auto remediation isn't used and OpsItems for manual remediation are created. +[Ti39halfu8](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#amazon-rds-idle-dbs-instances) Amazon RDS Idle DB Instances | **AWSManagedServices-StopIdleRDSInstance** Amazon RDS DB instance that has been in an idle state for the last seven days is stopped. | No preconfigured parameters are allowed. No constraints +[COr6dfpM05](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#aws-lambda-over-provisioned-functions-memory-size) AWS Lambda over-provisioned functions for memory size | **AWSManagedServices-ResizeLambdaMemory** AWS Lambda function's memory size is resized to the recommended memory size provided by Trusted Advisor. | **RecommendedMemorySize:** The recommended memory allocation for the Lambda function. Value range is between 128 and 10240. If the Lambda function size was modified before the automation runs, then the settings might be overwritten by this automation with the value recommended by Trusted Advisor. +[Qch7DwouX1](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#low-utilization-amazon-ec2-instances) Low Utilization Amazon EC2 Instances | **AWSManagedServices-StopEC2Instance** (Default SSM document for both auto and manual execution mode.) Amazon EC2 instances with low utilization are stopped. | **ForceStopWithInstanceStore:** Set to `true` to force stop instances using instance store. Otherwise, set to `false`. The default value of `false` prevents instance from stopping. Valid values are true or false (case-sensitive). No constraints @@ -30 +32,2 @@ Check ID and name | SSM document name and expected outcome | Supported preconfig - * **CreateAMIBeforeResize:** Set this option to `true` or `false` to create the instance AMI as a backup before resizing. The default is `false`. Valid values are `true` and `false` (case-sensitive). + * **CreateAMIBeforeResize:** To create the instance AMI as a backup before resizing, choose `true`. To not create a backup, choose `false`. The default is `false`. Valid values are `true` and `false` (case-sensitive). + * **ResizeIfStopped:** To proceed with the instance size change, even if the instance is in a stopped state, choose `true`. To not automatically resize the instance if in a stopped state, choose `false`. Valid values are `true` and `false` (case-sensitive). @@ -32,4 +35,4 @@ Check ID and name | SSM document name and expected outcome | Supported preconfig -| No constraints -[Qch7DwouX1](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#low-utilization-amazon-ec2-instances) Low Utilization Amazon EC2 Instances | **AWSManagedServices-TerminateInstance** Low utilized Amazon EC2 instances are terminated if not part of an Auto Scaling Group and termination protection isn't enabled. An AMI is created by default. | **CreateAMIBeforeTermination:** Set this option to `true` or `false` to create an instance AMI as a backup before terminating the EC2 instance. The default is `true`. Valid values are `true` and `false` (case-sensitive). | No constraints -[G31sQ1E9U](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#underutilized-amazon-redshift-clusters) Underutilized Amazon Redshift Clusters | **AWSManagedServices-PauseRedshiftCluster** The Amazon Redshift cluster is paused. | No preconfigured parameters are allowed. | No constraints -[c1cj39rr6v](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#s3-incomplete-multipart-upload-abort-config) Amazon S3 Incomplete Multipart Upload Abort Configuration | **AWSManagedServices-TrustedRemediatorEnableS3AbortIncompleteMultipartUpload** Amazon S3 bucket is configured with a lifecycle rule to abort multipart uploads that remain incomplete after certain days. | **DaysAfterInitiation:** The number of days after which Amazon S3 stops an incomplete multipart upload. Default is set to 7 days. | No constraints +No constraints +[Qch7DwouX1](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#low-utilization-amazon-ec2-instances) Low Utilization Amazon EC2 Instances | **AWSManagedServices-TerminateInstance** Low utilized Amazon EC2 instances are terminated if not part of an Auto Scaling Group and termination protection isn't enabled. An AMI is created by default. | **CreateAMIBeforeTermination:** Set this option to `true` or `false` to create an instance AMI as a backup before terminating the EC2 instance. The default is `true`. Valid values are `true` and `false` (case-sensitive). No constraints +[G31sQ1E9U](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#underutilized-amazon-redshift-clusters) Underutilized Amazon Redshift Clusters | **AWSManagedServices-PauseRedshiftCluster** The Amazon Redshift cluster is paused. | No preconfigured parameters are allowed. No constraints +[c1cj39rr6v](https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.html#s3-incomplete-multipart-upload-abort-config) Amazon S3 Incomplete Multipart Upload Abort Configuration | **AWSManagedServices-TrustedRemediatorEnableS3AbortIncompleteMultipartUpload** Amazon S3 bucket is configured with a lifecycle rule to abort multipart uploads that remain incomplete after certain days. | **DaysAfterInitiation:** The number of days after which Amazon S3 stops an incomplete multipart upload. Default is set to 7 days. No constraints @@ -39,8 +42,8 @@ Check ID and name | SSM document name and expected outcome | Supported preconfig -Check ID and name | SSM document name and expected outcome | Supported preconfigured parameters | Constraints ----|---|---|--- -[12Fnkpl8Y5](https://docs.aws.amazon.com/awssupport/latest/user/security-checks.html#exposed-access-keys) Exposed Access Keys | **AWSManagedServices-TrustedRemediatorDeactivateIAMAccessKey** The exposed IAM access key is deactivated. | No preconfigured parameters are allowed. | Applications configured with an exposed IAM access key can't authenticate. -Hs4Ma3G127 - API Gateway REST and WebSocket API execution logging should be enabled Corresponding AWS Security Hub check: [APIGateway.1](https://docs.aws.amazon.com/securityhub/latest/userguide/apigateway-controls.html#apigateway-1) | **AWSManagedServices-TrustedRemediatorEnableAPIGateWayExecutionLogging** Execution logging is enabled on the API stage. | **LogLevel:** Logging level to enable execution logging, `ERROR` \- Logging is enabled for errors only. `INFO` \- Logging is enabled for all events. | You must grant API Gateway permission to read and write logs to CloudWatch for your account in order to enable execution log, refer to [Set up CloudWatch logging for REST APIs in API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html) for detail. -Hs4Ma3G129 - API Gateway REST API stages should have AWS X-Ray tracing enabled Corresponding AWS Security Hub check: [APIGateway.3](https://docs.aws.amazon.com/securityhub/latest/userguide/apigateway-controls.html#apigateway-3) | **AWSManagedServices-EnableApiGateWayXRayTracing** X-Ray tracing is enabled on the API stage. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G202 - API Gateway REST API cache data should be encrypted at rest Corresponding AWS Security Hub check: [APIGateway.5](https://docs.aws.amazon.com/securityhub/latest/userguide/apigateway-controls.html#apigateway-5) | **AWSManagedServices-EnableAPIGatewayCacheEncryption** Enable encryption at rest for API Gateway REST API cache data if the API Gateway REST API stage has cache enabled. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G177 - Corresponding AWS Security Hub check - Auto scaling groups associated with a load balancer should use load balancer health checks [AutoScaling.1](https://docs.aws.amazon.com/securityhub/latest/userguide/autoscaling-controls.html#autoscaling-1) | **AWSManagedServices-TrustedRemediatorEnableAutoScalingGroupELBHealthCheck** Elastic Load Balancing health checks are enabled for the Auto Scaling Group. | **HealthCheckGracePeriod:** The amount of time, in seconds, that Auto Scaling waits before checking the health status of an Amazon Elastic Compute Cloud instance that has come into service. | Turning on Elastic Load Balancing health checks might result in replacing a running instance if any of the Elastic Load Balancing load balancers attached to the Auto Scaling group report it as unhealthy. For more information, see [Attach an Elastic Load Balancing load balancer to your Auto Scaling group](https://docs.aws.amazon.com/autoscaling/ec2/userguide/attach-load-balancer-asg.html) -Hs4Ma3G245 - AWS CloudFormation stacks should be integrated with Amazon Simple Notification Service Corresponding AWS Security Hub check: [CloudFormation.1](https://docs.aws.amazon.com/securityhub/latest/userguide/cloudformation-controls.html#cloudformation-1) | **AWSManagedServices-EnableCFNStackNotification** Associate a CloudFormation stack with an Amazon SNS topic for notification. | **NotificationARNs:** The ARNs of the Amazon SNS topics to be associated with selected CloudFormation stacks. | To enable auto remediation, The `NotificationARNs` preconfigured parameter must be provided. +Check ID and name | SSM document name and expected outcome | Supported preconfigured parameters and constraints +---|---|--- +[12Fnkpl8Y5](https://docs.aws.amazon.com/awssupport/latest/user/security-checks.html#exposed-access-keys) Exposed Access Keys | **AWSManagedServices-TrustedRemediatorDeactivateIAMAccessKey** The exposed IAM access key is deactivated. | No preconfigured parameters are allowed. Applications configured with an exposed IAM access key can't authenticate. +Hs4Ma3G127 - API Gateway REST and WebSocket API execution logging should be enabled Corresponding AWS Security Hub check: [APIGateway.1](https://docs.aws.amazon.com/securityhub/latest/userguide/apigateway-controls.html#apigateway-1) | **AWSManagedServices-TrustedRemediatorEnableAPIGateWayExecutionLogging** Execution logging is enabled on the API stage. | **LogLevel:** Logging level to enable execution logging, `ERROR` \- Logging is enabled for errors only. `INFO` \- Logging is enabled for all events. You must grant API Gateway permission to read and write logs to CloudWatch for your account in order to enable execution log, refer to [Set up CloudWatch logging for REST APIs in API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html) for detail. +Hs4Ma3G129 - API Gateway REST API stages should have AWS X-Ray tracing enabled Corresponding AWS Security Hub check: [APIGateway.3](https://docs.aws.amazon.com/securityhub/latest/userguide/apigateway-controls.html#apigateway-3) | **AWSManagedServices-EnableApiGateWayXRayTracing** X-Ray tracing is enabled on the API stage. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G202 - API Gateway REST API cache data should be encrypted at rest Corresponding AWS Security Hub check: [APIGateway.5](https://docs.aws.amazon.com/securityhub/latest/userguide/apigateway-controls.html#apigateway-5) | **AWSManagedServices-EnableAPIGatewayCacheEncryption** Enable encryption at rest for API Gateway REST API cache data if the API Gateway REST API stage has cache enabled. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G177 - Corresponding AWS Security Hub check - Auto scaling groups associated with a load balancer should use load balancer health checks [AutoScaling.1](https://docs.aws.amazon.com/securityhub/latest/userguide/autoscaling-controls.html#autoscaling-1) | **AWSManagedServices-TrustedRemediatorEnableAutoScalingGroupELBHealthCheck** Elastic Load Balancing health checks are enabled for the Auto Scaling Group. | **HealthCheckGracePeriod:** The amount of time, in seconds, that Auto Scaling waits before checking the health status of an Amazon Elastic Compute Cloud instance that has come into service. Turning on Elastic Load Balancing health checks might result in replacing a running instance if any of the Elastic Load Balancing load balancers attached to the Auto Scaling group report it as unhealthy. For more information, see [Attach an Elastic Load Balancing load balancer to your Auto Scaling group](https://docs.aws.amazon.com/autoscaling/ec2/userguide/attach-load-balancer-asg.html) +Hs4Ma3G245 - AWS CloudFormation stacks should be integrated with Amazon Simple Notification Service Corresponding AWS Security Hub check: [CloudFormation.1](https://docs.aws.amazon.com/securityhub/latest/userguide/cloudformation-controls.html#cloudformation-1) | **AWSManagedServices-EnableCFNStackNotification** Associate a CloudFormation stack with an Amazon SNS topic for notification. | **NotificationARNs:** The ARNs of the Amazon SNS topics to be associated with selected CloudFormation stacks. To enable auto remediation, The `NotificationARNs` preconfigured parameter must be provided. @@ -53 +56 @@ Hs4Ma3G210 - CloudFront distributions should have logging enabled Corresponding -| To enable auto remediation, the following preconfigured parameters must be provided: +To enable auto remediation, the following preconfigured parameters must be provided: @@ -60 +63 @@ For this remediations constraints, see [ How do I turn on logging for my CloudFr -Hs4Ma3G109 - CloudTrail log file validation should be enabled Corresponding AWS Security Hub check: [CloudTrail.4](https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html#cloudtrail-4) | **AWSManagedServices-TrustedRemediatorEnableCloudTrailLogValidation** Enables CloudTrail trail log validation. | No preconfigured parameters are allowed. | No constraints +Hs4Ma3G109 - CloudTrail log file validation should be enabled Corresponding AWS Security Hub check: [CloudTrail.4](https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html#cloudtrail-4) | **AWSManagedServices-TrustedRemediatorEnableCloudTrailLogValidation** Enables CloudTrail trail log validation. | No preconfigured parameters are allowed. No constraints @@ -66 +69 @@ Hs4Ma3G108 - CloudTrail trails should be integrated with Amazon CloudWatch Logs -| To enable auto remediation, the following preconfigured parameters must be provided: +To enable auto remediation, the following preconfigured parameters must be provided: @@ -72,6 +75,6 @@ Hs4Ma3G108 - CloudTrail trails should be integrated with Amazon CloudWatch Logs -Hs4Ma3G217 - CodeBuild project environments should have a logging AWS configuration Corresponding AWS Security Hub check: [CodeBuild.4](https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-4) | **AWSManagedServices-TrustedRemediatorEnableCodeBuildLoggingConfig** Enables the logging for CodeBuild project. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G306 - Neptune DB clusters should have deletion protection enabled Corresponding AWS Security Hub check: [DocumentDB.3](https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-3) | **AWSManagedServices-TrustedRemediatorDisablePublicAccessOnDocumentDBSnapshot** Removes public access from Amazon DocumentDB manual cluster snapshot. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G308 - Amazon DocumentDB clusters should have deletion protection enabled Corresponding AWS Security Hub check: [DocumentDB.5](https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-5) | **AWSManagedServices-TrustedRemediatorEnableDocumentDBClusterDeletionProtection** Enables deletion protection for Amazon DocumentDB cluster. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G323 - DynamoDB tables should have deletion protection enabled Corresponding AWS Security Hub check: [DynamoDB.6](https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html#dynamodb-6) | **AWSManagedServices-TrustedRemediatorEnableDynamoDBTableDeletionProtection** Enables deletion protection for non-AMS DynamoDB tables. | No preconfigured parameters are allowed. | No constraints -[ePs02jT06w](https://docs.aws.amazon.com/awssupport/latest/user/security-checks.html#amazon-ebs-public-snapshots) \- Amazon EBS Public Snapshots | **AWSManagedServices-TrustedRemediatorDisablePublicAccessOnEBSSnapshot** Public access for Amazon EBS snapshot is disabled. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G118 - VPC default security groups should not allow inbound or outbound traffic Corresponding AWS Security Hub check: [EC2.2](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-2) | **AWSManagedServices-TrustedRemediatorRemoveAllRulesFromDefaultSG** All ingress and egress rules in the default security group are removed. | No preconfigured parameters are allowed. | No constraints +Hs4Ma3G217 - CodeBuild project environments should have a logging AWS configuration Corresponding AWS Security Hub check: [CodeBuild.4](https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-4) | **AWSManagedServices-TrustedRemediatorEnableCodeBuildLoggingConfig** Enables the logging for CodeBuild project. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G306 - Neptune DB clusters should have deletion protection enabled Corresponding AWS Security Hub check: [DocumentDB.3](https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-3) | **AWSManagedServices-TrustedRemediatorDisablePublicAccessOnDocumentDBSnapshot** Removes public access from Amazon DocumentDB manual cluster snapshot. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G308 - Amazon DocumentDB clusters should have deletion protection enabled Corresponding AWS Security Hub check: [DocumentDB.5](https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-5) | **AWSManagedServices-TrustedRemediatorEnableDocumentDBClusterDeletionProtection** Enables deletion protection for Amazon DocumentDB cluster. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G323 - DynamoDB tables should have deletion protection enabled Corresponding AWS Security Hub check: [DynamoDB.6](https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html#dynamodb-6) | **AWSManagedServices-TrustedRemediatorEnableDynamoDBTableDeletionProtection** Enables deletion protection for non-AMS DynamoDB tables. | No preconfigured parameters are allowed. No constraints +[ePs02jT06w](https://docs.aws.amazon.com/awssupport/latest/user/security-checks.html#amazon-ebs-public-snapshots) \- Amazon EBS Public Snapshots | **AWSManagedServices-TrustedRemediatorDisablePublicAccessOnEBSSnapshot** Public access for Amazon EBS snapshot is disabled. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G118 - VPC default security groups should not allow inbound or outbound traffic Corresponding AWS Security Hub check: [EC2.2](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-2) | **AWSManagedServices-TrustedRemediatorRemoveAllRulesFromDefaultSG** All ingress and egress rules in the default security group are removed. | No preconfigured parameters are allowed. No constraints @@ -80 +83 @@ Hs4Ma3G117 - Attached EBS volumes should be encrypted at-rest Corresponding AWS - * **KMSKeyId:** AWS KMS key id or ARN to encrypt the volume. + * **KMSKeyId:** AWS KMS key ID or ARN to encrypt the volume. @@ -83,3 +86,3 @@ Hs4Ma3G117 - Attached EBS volumes should be encrypted at-rest Corresponding AWS -| The instance is rebooted as a part of the remediation and rollback is possible if `DeleteStaleNonEncryptedSnapshotBackups` is set to `false` which helps with restore. -Hs4Ma3G120 - Stopped EC2 instances should be removed after a specified time period Corresponding AWS Security Hub check: [EC2.4](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-4) | **AWSManagedServices-TerminateInstance** Amazon EC2 instances stopped for 30 days are terminated. | **CreateAMIBeforeTermination:** Set this option to `true` or `false` to create the instance AMI as a backup before terminating the EC2 instance. The default is `true`. | No constraints -Hs4Ma3G121 - EBS default encryption should be enabled Corresponding AWS Security Hub check: [EC2.7](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-7) | **AWSManagedServices-EncryptEBSByDefault** Amazon EBS encryption by default is enabled for the specific AWS Region | No preconfigured parameters are allowed. | Encryption by default is a Region-specific setting. If you enable it for a Region, you can't disable it for individual volumes or snapshots in that Region. +The instance is rebooted as a part of the remediation and rollback is possible if `DeleteStaleNonEncryptedSnapshotBackups` is set to `false` which helps with restore. +Hs4Ma3G120 - Stopped EC2 instances should be removed after a specified time period Corresponding AWS Security Hub check: [EC2.4](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-4) | **AWSManagedServices-TerminateInstance** Amazon EC2 instances stopped for 30 days are terminated. | **CreateAMIBeforeTermination:**. To create the instance AMI as a backup before terminating the EC2 instance, choose `true`. To not create a backup before terminating, choose `false`. The default is `true`. No constraints +Hs4Ma3G121 - EBS default encryption should be enabled Corresponding AWS Security Hub check: [EC2.7](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-7) | **AWSManagedServices-EncryptEBSByDefault** Amazon EBS encryption by default is enabled for the specific AWS Region | No preconfigured parameters are allowed. Encryption by default is a Region-specific setting. If you enable it for a Region, you can't disable it for individual volumes or snapshots in that Region. @@ -91,9 +94,9 @@ Hs4Ma3G124 - Amazon EC2 instances should use Instance Metadata Service Version 2 -| No constraints -Hs4Ma3G207 - EC2 subnets should not automatically assign public IP addresses Corresponding AWS Security Hub check: [EC2.15](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-15) | **AWSManagedServices-UpdateAutoAssignPublicIpv4Addresses** VPC subnets are configured to not automatically assign public IP addresses. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G209 - Unused Network Access Control Lists are removed Corresponding AWS Security Hub check: [EC2.16](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-16) | **AWSManagedServices-DeleteUnusedNACL** Delete unused network ACL | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G215 - Unused Amazon EC2 security groups should be removed Corresponding AWS Security Hub check: [EC2.22](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-22) | **AWSManagedServices-DeleteSecurityGroups** Delete unused security groups. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G247 - Amazon EC2 Transit Gateway should not automatically accept VPC attachment requests Corresponding AWS Security Hub check: [EC2.23](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-23) | **AWSManagedServices-TrustedRemediatorDisableTGWAutoVPCAttach** \- Disables the automatic acceptance of VPC attachment requests for the specified non-AMS Amazon EC2 Transit Gateway. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G235 - ECR private repositories should have tag immutability configured Corresponding AWS Security Hub check: [ECR.2](https://docs.aws.amazon.com/securityhub/latest/userguide/ecr-controls.html#ecr-2) | **AWSManagedServices-TrustedRemediatorSetImageTagImmutability** Sets the image tag mutability settings to IMMUTABLE for the specified repository. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G216 - ECR repositories should have at least one lifecycle policy configured Corresponding AWS Security Hub check: [ECR.3](https://docs.aws.amazon.com/securityhub/latest/userguide/ecr-controls.html#ecr-3) | **AWSManagedServices-PutECRRepositoryLifecyclePolicy** ECR repository has a lifecycle policy configured. | **LifecyclePolicyText:** The JSON repository policy text to apply to the repository. | To enable auto remediation, the following preconfigured parameters must be provided: **LifecyclePolicyText** -Hs4Ma3G325 - EKS clusters should have audit logging enabled Corresponding AWS Security Hub check: [EKS.8](https://docs.aws.amazon.com/securityhub/latest/userguide/eks-controls.html#eks-8) | **AWSManagedServices-TrustedRemediatorEnableEKSAuditLog** Audit log is enabled for EKS cluster. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G183 - Application load balancer should be configured to drop HTTP headers Corresponding AWS Security Hub check: [ELB.4](https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html#elb-4) | **AWSConfigRemediation-DropInvalidHeadersForALB** Application Load Balancer is configured to invalid header fields. | No preconfigured parameters are allowed. | No constraints +No constraints +Hs4Ma3G207 - EC2 subnets should not automatically assign public IP addresses Corresponding AWS Security Hub check: [EC2.15](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-15) | **AWSManagedServices-UpdateAutoAssignPublicIpv4Addresses** VPC subnets are configured to not automatically assign public IP addresses. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G209 - Unused Network Access Control Lists are removed Corresponding AWS Security Hub check: [EC2.16](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-16) | **AWSManagedServices-DeleteUnusedNACL** Delete unused network ACL | No preconfigured parameters are allowed. No constraints +Hs4Ma3G215 - Unused Amazon EC2 security groups should be removed Corresponding AWS Security Hub check: [EC2.22](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-22) | **AWSManagedServices-DeleteSecurityGroups** Delete unused security groups. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G247 - Amazon EC2 Transit Gateway should not automatically accept VPC attachment requests Corresponding AWS Security Hub check: [EC2.23](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-23) | **AWSManagedServices-TrustedRemediatorDisableTGWAutoVPCAttach** \- Disables the automatic acceptance of VPC attachment requests for the specified non-AMS Amazon EC2 Transit Gateway. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G235 - ECR private repositories should have tag immutability configured Corresponding AWS Security Hub check: [ECR.2](https://docs.aws.amazon.com/securityhub/latest/userguide/ecr-controls.html#ecr-2) | **AWSManagedServices-TrustedRemediatorSetImageTagImmutability** Sets the image tag mutability settings to IMMUTABLE for the specified repository. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G216 - ECR repositories should have at least one lifecycle policy configured Corresponding AWS Security Hub check: [ECR.3](https://docs.aws.amazon.com/securityhub/latest/userguide/ecr-controls.html#ecr-3) | **AWSManagedServices-PutECRRepositoryLifecyclePolicy** ECR repository has a lifecycle policy configured. | **LifecyclePolicyText:** The JSON repository policy text to apply to the repository. To enable auto remediation, the following preconfigured parameters must be provided: **LifecyclePolicyText** +Hs4Ma3G325 - EKS clusters should have audit logging enabled Corresponding AWS Security Hub check: [EKS.8](https://docs.aws.amazon.com/securityhub/latest/userguide/eks-controls.html#eks-8) | **AWSManagedServices-TrustedRemediatorEnableEKSAuditLog** Audit log is enabled for EKS cluster. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G183 - Application load balancer should be configured to drop HTTP headers Corresponding AWS Security Hub check: [ELB.4](https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html#elb-4) | **AWSConfigRemediation-DropInvalidHeadersForALB** Application Load Balancer is configured to invalid header fields. | No preconfigured parameters are allowed. No constraints @@ -105,16 +108,11 @@ Hs4Ma3G184 - Application Load Balancers and Classic Load Balancers logging shoul -| To enable auto remediation, the following preconfigured parameters must be provided: - - * **BucketName** - * **S3KeyPrefix:** The Amazon S3 bucket must have a bucket policy that grants Elastic Load Balancing permission to write the access logs to the bucket. - - -Hs4Ma3G326 - Amazon EMR block public access setting should be enabled Corresponding AWS Security Hub check: [EMR.2](https://docs.aws.amazon.com/securityhub/latest/userguide/emr-controls.html#emr-2) | **AWSManagedServices-TrustedRemediatorEnableEMRBlockPublicAccess** Amazon EMR block public access settings is turned on for the account. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G135 - AWS KMS keys should not be deleted unintentionally Corresponding AWS Security Hub check: [KMS.3](https://docs.aws.amazon.com/securityhub/latest/userguide/kms-controls.html#kms-3) | **AWSManagedServices-CancelKeyDeletion** AWS KMS key deletion is canceled. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G299 - Amazon DocumentDB manual cluster snapshots should not be public Corresponding AWS Security Hub check: [Neptune.4](https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-4) | **AWSManagedServices-TrustedRemediatorEnableNeptuneDBClusterDeletionProtection** Enables deletion protection for Amazon Neptune cluster. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G319 - Network Firewall firewalls should have deletion protection enabled Corresponding AWS Security Hub check: [NetworkFirewall.9](https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html#networkfirewall-9) | **AWSManagedServices-TrustedRemediatorEnableNetworkFirewallDeletionProtection** \- Enables the delete protection for AWS Network Firewall. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G223 - OpenSearch domains should encrypt data sent between nodes Corresponding AWS Security Hub check: [OpenSearch.3](https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html#Opensearch-3) | **AWSManagedServices-EnableOpenSearchNodeToNodeEncryption** Node to Node encryption is enabled for the domain. | No preconfigured parameters are allowed. | After node-to-node encryption is enabled, you can't disable the setting. Instead, take a manual snapshot of the encrypted domain, create another domain, migrate your data, and then delete the old domain. -Hs4Ma3G222 - OpenSearch domain error logging to CloudWatch Logs should be enabled Corresponding AWS Security Hub check: [Opensearch.4](https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html#opensearch-4) | **AWSManagedServices-EnableOpenSearchLogging** Error logging is enabled for the OpenSearch domain. | CloudWatchLogGroupArn: The ARN of anAmazon CloudWatch Logs log group. | To enable auto remediation, the following preconfigured parameters must be provided: **CloudWatchLogGroupArn** Amazon CloudWatch resource policy must be configured with permissions. For more information, see [Enabling audit logs](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/audit-logs.html#audit-log-enabling) in the _Amazon OpenSearch Service User Guide_ -Hs4Ma3G221 - OpenSearch domains should have audit logging enabled Corresponding AWS Security Hub check: [Opensearch.5](https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html#opensearch-5) | **AWSManagedServices-EnableOpenSearchLogging** OpenSearch domains are configured with audit logging enabled. | **CloudWatchLogGroupArn:** The ARN of the CloudWatch Logs group to publish logs to. | To enable auto remediation, the following preconfigured parameters must be provided: CloudWatchLogGroupArn Amazon CloudWatch resource policy must be configured with permissions. For more information, see [Enabling audit logs](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/audit-logs.html#audit-log-enabling) in the _Amazon OpenSearch Service User Guide_ -Hs4Ma3G220 - Connections to OpenSearch domains should be encrypted using TLS 1.2 Corresponding AWS Security Hub check: [Opensearch.8](https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html#opensearch-8) | **AWSManagedServices-EnableOpenSearchEndpointEncryptionTLS1.2** TLS policy is set to `Policy-Min-TLS-1-2-2019-07` and only encrypted connections over HTTPS (TLS) are allowed. | No preconfigured parameters are allowed. | Connections to OpenSearch domains are required to use TLS 1.2. Encrypting data in transit can affect performance. Test your applications with this feature to understand the performance profile and the impact of TLS. -Hs4Ma3G194 - Amazon RDS snapshot should be private Corresponding AWS Security Hub check: [RDS.1](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-1) | **AWSManagedServices-DisablePublicAccessOnRDSSnapshotV2** Public access for Amazon RDS snapshot is disabled. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G192 - RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible AWS Configuration Corresponding AWS Security Hub check: [RDS.2](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-2) | **AWSManagedServices-TrustedRemediatorDisablePublicAccessOnRDSInstance** Disable public access on RDS DB instance. | No preconfigured parameters are allowed. | No constraints +To enable auto remediation, the following preconfigured parameters must be provided: **BucketName** and **S3KeyPrefix:**. Make sure the Amazon S3 bucket has a bucket policy that grants Elastic Load Balancing permission to write the access logs to the bucket. +Hs4Ma3G326 - Amazon EMR block public access setting should be enabled Corresponding AWS Security Hub check: [EMR.2](https://docs.aws.amazon.com/securityhub/latest/userguide/emr-controls.html#emr-2) | **AWSManagedServices-TrustedRemediatorEnableEMRBlockPublicAccess** Amazon EMR block public access settings is turned on for the account. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G135 - AWS KMS keys should not be deleted unintentionally Corresponding AWS Security Hub check: [KMS.3](https://docs.aws.amazon.com/securityhub/latest/userguide/kms-controls.html#kms-3) | **AWSManagedServices-CancelKeyDeletion** AWS KMS key deletion is canceled. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G299 - Amazon DocumentDB manual cluster snapshots should not be public Corresponding AWS Security Hub check: [Neptune.4](https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-4) | **AWSManagedServices-TrustedRemediatorEnableNeptuneDBClusterDeletionProtection** Enables deletion protection for Amazon Neptune cluster. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G319 - Network Firewall firewalls should have deletion protection enabled Corresponding AWS Security Hub check: [NetworkFirewall.9](https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html#networkfirewall-9) | **AWSManagedServices-TrustedRemediatorEnableNetworkFirewallDeletionProtection** \- Enables the delete protection for AWS Network Firewall. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G223 - OpenSearch domains should encrypt data sent between nodes Corresponding AWS Security Hub check: [OpenSearch.3](https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html#Opensearch-3) | **AWSManagedServices-EnableOpenSearchNodeToNodeEncryption** Node to Node encryption is enabled for the domain. | No preconfigured parameters are allowed. After node-to-node encryption is enabled, you can't disable the setting. Instead, take a manual snapshot of the encrypted domain, create another domain, migrate your data, and then delete the old domain. +Hs4Ma3G222 - OpenSearch domain error logging to CloudWatch Logs should be enabled Corresponding AWS Security Hub check: [Opensearch.4](https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html#opensearch-4) | **AWSManagedServices-EnableOpenSearchLogging** Error logging is enabled for the OpenSearch domain. | CloudWatchLogGroupArn: The ARN of anAmazon CloudWatch Logs log group. To enable auto remediation, the following preconfigured parameter must be provided: **CloudWatchLogGroupArn**. Amazon CloudWatch resource policy must be configured with permissions. For more information, see [Enabling audit logs](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/audit-logs.html#audit-log-enabling) in the _Amazon OpenSearch Service User Guide_ +Hs4Ma3G221 - OpenSearch domains should have audit logging enabled Corresponding AWS Security Hub check: [Opensearch.5](https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html#opensearch-5) | **AWSManagedServices-EnableOpenSearchLogging** OpenSearch domains are configured with audit logging enabled. | **CloudWatchLogGroupArn:** The ARN of the CloudWatch Logs group to publish logs to. To enable auto remediation, the following preconfigured parameter must be provided: **CloudWatchLogGroupArn** Amazon CloudWatch resource policy must be configured with permissions. For more information, see [Enabling audit logs](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/audit-logs.html#audit-log-enabling) in the _Amazon OpenSearch Service User Guide_ +Hs4Ma3G220 - Connections to OpenSearch domains should be encrypted using TLS 1.2 Corresponding AWS Security Hub check: [Opensearch.8](https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html#opensearch-8) | **AWSManagedServices-EnableOpenSearchEndpointEncryptionTLS1.2** TLS policy is set to `Policy-Min-TLS-1-2-2019-07` and only encrypted connections over HTTPS (TLS) are allowed. | No preconfigured parameters are allowed. Connections to OpenSearch domains are required to use TLS 1.2. Encrypting data in transit can affect performance. Test your applications with this feature to understand the performance profile and the impact of TLS. +Hs4Ma3G194 - Amazon RDS snapshot should be private Corresponding AWS Security Hub check: [RDS.1](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-1) | **AWSManagedServices-DisablePublicAccessOnRDSSnapshotV2** Public access for Amazon RDS snapshot is disabled. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G192 - RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible AWS Configuration Corresponding AWS Security Hub check: [RDS.2](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-2) | **AWSManagedServices-TrustedRemediatorDisablePublicAccessOnRDSInstance** Disable public access on RDS DB instance. | No preconfigured parameters are allowed. No constraints @@ -126,15 +124,15 @@ Hs4Ma3G189 - Enhanced monitoring are configured for Amazon RDS DB instances Corr -| If enhanced monitoring is enabled before the automation execution, then the settings might be overwritten by this automation with the MonitoringInterval and MonitoringRoleName values configured in the preconfigured parameters. -Hs4Ma3G190 - Amazon RDS clusters should have deletion protection enabled Corresponding AWS Security Hub check: [RDS.7](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-7) | **AWSManagedServices-TrustedRemediatorEnableRDSDeletionProtection** Deletion protection is enabled for Amazon RDS clusters. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G198 - Amazon RDS DB instances should have deletion protection enabled Corresponding AWS Security Hub check: [RDS.8](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-8) | **AWSManagedServices-TrustedRemediatorEnableRDSDeletionProtection** Deletion protection is enabled for Amazon RDS instances. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G199 - RDS DB instances should publish logs to CloudWatch Logs Corresponding AWS Security Hub check: [RDS.9](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-9) | **AWSManagedServices-TrustedRemediatorEnableRDSLogExports** RDS log exports is enabled for the RDS DB instance or RDS DB cluster. | No preconfigured parameters are allowed. | Service-linked role [ AWSServiceRoleForRDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_LogAccess.Procedural.UploadtoCloudWatch.html#integrating_cloudwatchlogs.configure) is required. -Hs4Ma3G160 - IAM authentication should be configured for RDS instances Corresponding AWS Security Hub check: [RDS.10](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-10>RDS.10) | **AWSManagedServices-UpdateRDSIAMDatabaseAuthentication** AWS Identity and Access Management authentication is enabled for the RDS instance. | **ApplyImmediately:** Indicates if the modifications in this request and any pending modifications are asynchronously applied as soon as possible, Choose `true` to apply the change immediately, or `false` to schedule the change for the next maintenance window. | No constraints -Hs4Ma3G161 - IAM authentication should be configured for RDS clusters Corresponding AWS Security Hub check: [RDS.12](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-12) | **AWSManagedServices-UpdateRDSIAMDatabaseAuthentication** IAM authentication is enabled for the RDS cluster. | **ApplyImmediately:** Indicates if the modifications in this request and any pending modifications are asynchronously applied as soon as possible, Choose `true` to apply the change immediately, or `false` to schedule the change for the next maintenance window. | No constraints -Hs4Ma3G162 - RDS automatic minor version upgrades should be enabled Corresponding AWS Security Hub check: [RDS.13](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-13) | **AWSManagedServices-UpdateRDSInstanceMinorVersionUpgrade** Automatic minor version upgrade configuration for Amazon RDS is enabled. | No preconfigured parameters are allowed. | The Amazon RDS instance must be in the `available` state for this remediation to happen. -Hs4Ma3G163 - RDS DB clusters should be configured to copy tags to snapshots Corresponding AWS Security Hub check: [RDS.16](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-16) | **AWSManagedServices-UpdateRDSCopyTagsToSnapshots** `CopyTagtosnapshot` setting for Amazon RDS clusters is enabled. | No preconfigured parameters are allowed. | Amazon RDS instances must be in available state for this remediation to happen. -Hs4Ma3G164 - RDS DB instances should be configured to copy tags to snapshots Corresponding AWS Security Hub check: [RDS.17](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-17) | **AWSManagedServices-UpdateRDSCopyTagsToSnapshots** `CopyTagsToSnapshot` setting for Amazon RDS is enabled. | No preconfigured parameters are allowed. | Amazon RDS instances must be in available state for this remediation to happen. -[rSs93HQwa1](https://docs.aws.amazon.com/awssupport/latest/user/security-checks.html#amazon-rds-public-snapshots) Amazon RDS Public Snapshots | **AWSManagedServices-DisablePublicAccessOnRDSSnapshotV2** Public access for Amazon RDS snapshot is disabled. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G103 - Amazon Redshift clusters should prohibit public access Corresponding AWS Security Hub check: [Redshift.1](https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html#redshift-1) | **AWSManagedServices-DisablePublicAccessOnRedshiftCluster** Public access on Amazon Redshift cluster is disabled. | No preconfigured parameters are allowed. | Disabling public access blocks all clients coming from the internet. And the Amazon Redshift cluster is in the modifying state for a few minutes while the remediation disables public access on the cluster. -Hs4Ma3G106 - Amazon Redshift clusters should have audit logging enabled Corresponding AWS Security Hub check: [Redshift.4](https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html#redshift-4) | **AWSManagedServices-TrustedRemediatorEnableRedshiftClusterAuditLogging** Audit logging is enabled to your Amazon Redshift cluster during the maintenance window. | No preconfigured parameters are allowed. | To enable auto remediation, the following preconfigured parameters must be provided. **BucketName:** The bucket must be in the same AWS Region. The cluster must have read bucket and put object permissions. If Redshift cluster logging is enabled before the automation execution, then the logging settings might be overwritten by this automation with the `BucketName` and `S3KeyPrefix` values configured in the preconfigured parameters. -Hs4Ma3G105 - Amazon Redshiftshould have automatic upgrades to major versions enabled Corresponding AWS Security Hub check: [Redshift.6](https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html#redshift-6) | **AWSManagedServices-EnableRedshiftClusterVersionAutoUpgrade** \- Major version upgrades are applied automatically to the cluster during the maintenance window. There is no immediate downtime for the Amazon Redshift cluster, but your Amazon Redshift cluster might have downtime during its maintenance window if it upgrades to a major version. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G104 - Amazon Redshift clusters should use enhanced VPC routing Corresponding AWS Security Hub check: [Redshift.7](https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html#redshift-7) | **AWSManagedServices-TrustedRemediatorEnableRedshiftClusterEnhancedVPCRouting** Enhanced VPC routing is enabled for Amazon Redshift clusters. | No preconfigured parameters are allowed. | No constraints -Hs4Ma3G173 - S3 Block Public Access setting should be enabled at the bucket-level Corresponding AWS Security Hub check: [S3.8](https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-8) | **AWSManagedServices-TrustedRemediatorBlockS3BucketPublicAccess** Bucket-level public access blocks are applied for the Amazon S3 bucket. | No preconfigured parameters are allowed. | This remediation might affect S3 object availability. For information on how Amazon S3 evaluates access, see [Blocking public access to your Amazon S3 storage](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html). +If enhanced monitoring is enabled before the automation execution, then the settings might be overwritten by this automation with the MonitoringInterval and MonitoringRoleName values configured in the preconfigured parameters. +Hs4Ma3G190 - Amazon RDS clusters should have deletion protection enabled Corresponding AWS Security Hub check: [RDS.7](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-7) | **AWSManagedServices-TrustedRemediatorEnableRDSDeletionProtection** Deletion protection is enabled for Amazon RDS clusters. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G198 - Amazon RDS DB instances should have deletion protection enabled Corresponding AWS Security Hub check: [RDS.8](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-8) | **AWSManagedServices-TrustedRemediatorEnableRDSDeletionProtection** Deletion protection is enabled for Amazon RDS instances. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G199 - RDS DB instances should publish logs to CloudWatch Logs Corresponding AWS Security Hub check: [RDS.9](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-9) | **AWSManagedServices-TrustedRemediatorEnableRDSLogExports** RDS log exports is enabled for the RDS DB instance or RDS DB cluster. | No preconfigured parameters are allowed. Service-linked role [ AWSServiceRoleForRDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_LogAccess.Procedural.UploadtoCloudWatch.html#integrating_cloudwatchlogs.configure) is required. +Hs4Ma3G160 - IAM authentication should be configured for RDS instances Corresponding AWS Security Hub check: [RDS.10](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-10>RDS.10) | **AWSManagedServices-UpdateRDSIAMDatabaseAuthentication** AWS Identity and Access Management authentication is enabled for the RDS instance. | **ApplyImmediately:** Indicates if the modifications in this request and any pending modifications are asynchronously applied as soon as possible, To apply the change immediately, choose `true`. To schedule the change for the next maintenance window, choose `false`. No constraints +Hs4Ma3G161 - IAM authentication should be configured for RDS clusters Corresponding AWS Security Hub check: [RDS.12](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-12) | **AWSManagedServices-UpdateRDSIAMDatabaseAuthentication** IAM authentication is enabled for the RDS cluster. | **ApplyImmediately:** Indicates if the modifications in this request and any pending modifications are asynchronously applied as soon as possible, To apply the change immediately, choose `true`. To schedule the change for the next maintenance window, choose `false`. No constraints +Hs4Ma3G162 - RDS automatic minor version upgrades should be enabled Corresponding AWS Security Hub check: [RDS.13](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-13) | **AWSManagedServices-UpdateRDSInstanceMinorVersionUpgrade** Automatic minor version upgrade configuration for Amazon RDS is enabled. | No preconfigured parameters are allowed. The Amazon RDS instance must be in the `available` state for this remediation to happen. +Hs4Ma3G163 - RDS DB clusters should be configured to copy tags to snapshots Corresponding AWS Security Hub check: [RDS.16](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-16) | **AWSManagedServices-UpdateRDSCopyTagsToSnapshots** `CopyTagtosnapshot` setting for Amazon RDS clusters is enabled. | No preconfigured parameters are allowed. Amazon RDS instances must be in available state for this remediation to happen. +Hs4Ma3G164 - RDS DB instances should be configured to copy tags to snapshots Corresponding AWS Security Hub check: [RDS.17](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-17) | **AWSManagedServices-UpdateRDSCopyTagsToSnapshots** `CopyTagsToSnapshot` setting for Amazon RDS is enabled. | No preconfigured parameters are allowed. Amazon RDS instances must be in available state for this remediation to happen. +[rSs93HQwa1](https://docs.aws.amazon.com/awssupport/latest/user/security-checks.html#amazon-rds-public-snapshots) Amazon RDS Public Snapshots | **AWSManagedServices-DisablePublicAccessOnRDSSnapshotV2** Public access for Amazon RDS snapshot is disabled. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G103 - Amazon Redshift clusters should prohibit public access Corresponding AWS Security Hub check: [Redshift.1](https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html#redshift-1) | **AWSManagedServices-DisablePublicAccessOnRedshiftCluster** Public access on Amazon Redshift cluster is disabled. | No preconfigured parameters are allowed. Disabling public access blocks all clients coming from the internet. And the Amazon Redshift cluster is in the modifying state for a few minutes while the remediation disables public access on the cluster. +Hs4Ma3G106 - Amazon Redshift clusters should have audit logging enabled Corresponding AWS Security Hub check: [Redshift.4](https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html#redshift-4) | **AWSManagedServices-TrustedRemediatorEnableRedshiftClusterAuditLogging** Audit logging is enabled to your Amazon Redshift cluster during the maintenance window. | No preconfigured parameters are allowed. To enable auto remediation, the following preconfigured parameters must be provided. **BucketName:** The bucket must be in the same AWS Region. The cluster must have read bucket and put object permissions. If Redshift cluster logging is enabled before the automation execution, then the logging settings might be overwritten by this automation with the `BucketName` and `S3KeyPrefix` values configured in the preconfigured parameters. +Hs4Ma3G105 - Amazon Redshiftshould have automatic upgrades to major versions enabled Corresponding AWS Security Hub check: [Redshift.6](https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html#redshift-6) | **AWSManagedServices-EnableRedshiftClusterVersionAutoUpgrade** \- Major version upgrades are applied automatically to the cluster during the maintenance window. There is no immediate downtime for the Amazon Redshift cluster, but your Amazon Redshift cluster might have downtime during its maintenance window if it upgrades to a major version. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G104 - Amazon Redshift clusters should use enhanced VPC routing Corresponding AWS Security Hub check: [Redshift.7](https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html#redshift-7) | **AWSManagedServices-TrustedRemediatorEnableRedshiftClusterEnhancedVPCRouting** Enhanced VPC routing is enabled for Amazon Redshift clusters. | No preconfigured parameters are allowed. No constraints +Hs4Ma3G173 - S3 Block Public Access setting should be enabled at the bucket-level Corresponding AWS Security Hub check: [S3.8](https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-8) | **AWSManagedServices-TrustedRemediatorBlockS3BucketPublicAccess** Bucket-level public access blocks are applied for the Amazon S3 bucket. | No preconfigured parameters are allowed. This remediation might affect S3 object availability. For information on how Amazon S3 evaluates access, see [Blocking public access to your Amazon S3 storage](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html). @@ -144,6 +142 @@ Hs4Ma3G230 - S3 bucket server access logging should be enabled Corresponding AWS - * **TargetPrefix:** Specifies an S3 prefix where the log files are stored. - -| To enable auto remediation, the following preconfigured parameters must be provided: - - * **TargetBucket** - * **TargetPrefix** + * **TargetObjectKeyFormat:** Amazon S3 key format for log objects, to use the simple format for S3 keys for log objects, choose`SimplePrefix`. To use Partitioned S3 key for log objects and use EventTime for the partitioned prefix, choose `PartitionedPrefixEventTime`. To use Partitioned S3 key for log objects and use DeliveryTime for the partitioned prefix, choose `PartitionedPrefixDeliveryTime`. Valid values are `SimplePrefix`, `PartitionedPrefixEventTime` and `PartitionedPrefixDeliveryTime` (case-sensitive). @@ -151,5 +144,5 @@ Hs4Ma3G230 - S3 bucket server access logging should be enabled Corresponding AWS -If access logging is enabled before the automation runs, then the settings might be overwritten by this automation with the `TargetBucket` and `TargetPrefix` values configured in the preconfigured parameters. -[Pfx0RwqBli](https://docs.aws.amazon.com/awssupport/latest/user/security-checks.html#amazon-s3-bucket-permissions) Amazon S3 Bucket Permissions | **AWSManagedServices-TrustedRemediatorBlockS3BucketPublicAccess** Block public access | No preconfigured parameters are allowed. | This check consists of multiple alert criteria. This automation remediates public access issues. Remediation for other configuration issues flagged by Trusted Advisor isn't supported. This remediation does support remediating AWS service created S3 buckets (for example, cf-templates-000000000000). -Hs4Ma3G272 - Users should not have root access to SageMaker notebook instances Corresponding AWS Security Hub check: [SageMaker.3](https://docs.aws.amazon.com/securityhub/latest/userguide/sagemaker-controls.html#sagemaker-3) | **AWSManagedServices-TrustedRemediatorDisableSageMakerNotebookInstanceRootAccess** Root access for users is disabled for SageMaker notebook instance. | No preconfigured parameters are allowed. | This remediation causes outage if the SageMaker notebook instance is in the InService state. -Hs4Ma3G179 - SNS topics should be encrypted at-rest using AWS KMS Corresponding AWS Security Hub check: [SNS.1](https://docs.aws.amazon.com/securityhub/latest/userguide/sns-controls.html#sns-1) | **AWSManagedServices-EnableSNSEncryptionAtRest** SNS topic is configured with server-side encryption. | **KmsKeyId:** The ID of an AWS managed customer master key (CMK) for Amazon SNS or a custom CMK to be used for server-side encryption (SSE). Default is set to alias/aws/sns. | If a custom AWS KMS key is used, it must be configured with the correct permissions. For more information, see [Enabling server-side encryption (SSE) for an Amazon SNS topic](https://docs.aws.amazon.com/sns/latest/dg/sns-enable-encryption-for-topic.html) -Hs4Ma3G158 - SSM documents should not be public Corresponding AWS Security Hub check: [SSM.4](https://docs.aws.amazon.com/securityhub/latest/userguide/ssm-controls.html#ssm-4) | **AWSManagedServices-TrustedRemediatorDisableSSMDocPublicSharing** \- Disables the public sharing of SSM document. | No preconfigured parameters are allowed. | No constraints +To enable auto remediation, the following preconfigured parameter must be provided: **TargetBucket**. The destination bucket must be in the same AWS Region and AWS account as the source bucket, with correct permissions for log delivery. For more information, see [Enabling Amazon S3 server access logging](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html). +[Pfx0RwqBli](https://docs.aws.amazon.com/awssupport/latest/user/security-checks.html#amazon-s3-bucket-permissions) Amazon S3 Bucket Permissions | **AWSManagedServices-TrustedRemediatorBlockS3BucketPublicAccess** Block public access | No preconfigured parameters are allowed. This check consists of multiple alert criteria. This automation remediates public access issues. Remediation for other configuration issues flagged by Trusted Advisor isn't supported. This remediation does support remediating AWS service created S3 buckets (for example, cf-templates-000000000000). +Hs4Ma3G272 - Users should not have root access to SageMaker notebook instances Corresponding AWS Security Hub check: [SageMaker.3](https://docs.aws.amazon.com/securityhub/latest/userguide/sagemaker-controls.html#sagemaker-3) | **AWSManagedServices-TrustedRemediatorDisableSageMakerNotebookInstanceRootAccess** Root access for users is disabled for SageMaker notebook instance. | No preconfigured parameters are allowed. This remediation causes outage if the SageMaker notebook instance is in the InService state. +Hs4Ma3G179 - SNS topics should be encrypted at-rest using AWS KMS Corresponding AWS Security Hub check: [SNS.1](https://docs.aws.amazon.com/securityhub/latest/userguide/sns-controls.html#sns-1) | **AWSManagedServices-EnableSNSEncryptionAtRest** SNS topic is configured with server-side encryption. | **KmsKeyId:** The ID of an AWS managed customer master key (CMK) for Amazon SNS or a custom CMK to be used for server-side encryption (SSE). Default is set to `alias/aws/sns`. If a custom AWS KMS key is used, it must be configured with the correct permissions. For more information, see [Enabling server-side encryption (SSE) for an Amazon SNS topic](https://docs.aws.amazon.com/sns/latest/dg/sns-enable-encryption-for-topic.html) +Hs4Ma3G158 - SSM documents should not be public Corresponding AWS Security Hub check: [SSM.4](https://docs.aws.amazon.com/securityhub/latest/userguide/ssm-controls.html#ssm-4) | **AWSManagedServices-TrustedRemediatorDisableSSMDocPublicSharing** \- Disables the public sharing of SSM document. | No preconfigured parameters are allowed. No constraints @@ -162 +155 @@ Hs4Ma3G136 - Amazon SQS queues should be encrypted at rest Corresponding AWS Sec -| Anonymous SendMessage and ReceiveMessage requests to the encrypted queue are rejected. All requests to queues with SSE enabled must use HTTPS and S ignature Version 4. +Anonymous SendMessage and ReceiveMessage requests to the encrypted queue are rejected. All requests to queues with SSE enabled must use HTTPS and Signature Version 4. @@ -166,4 +159,4 @@ Hs4Ma3G136 - Amazon SQS queues should be encrypted at rest Corresponding AWS Sec -Check ID and name | SSM document name and expected outcome | Supported preconfigured parameters | Constraints ----|---|---|--- -[c18d2gz138](https://docs.aws.amazon.com/awssupport/latest/user/fault-tolerance-checks.html#amazon-dynamodb-table-point-in-time-recovery) Amazon DynamoDB Point-in-time Recovery | **AWSManagedServices-TrustedRemediatorEnableDDBPITR** Enables point-in-time recovery for DynamoDB tables. | No preconfigured parameters are allowed. | No constraints -[R365s2Qddf](https://docs.aws.amazon.com/awssupport/latest/user/fault-tolerance-checks.html#amazon-s3-bucket-versioning) Amazon S3 Bucket Versioning | **AWSManagedServices-TrustedRemediatorEnableBucketVersioning** Amazon S3 bucket versioning is enabled. | No preconfigured parameters are allowed. | This remediation doesn't support remediating AWS service created S3 buckets (for example cf-templates-000000000000). +Check ID and name | SSM document name and expected outcome | Supported preconfigured parameters and constraints +---|---|--- +[c18d2gz138](https://docs.aws.amazon.com/awssupport/latest/user/fault-tolerance-checks.html#amazon-dynamodb-table-point-in-time-recovery) Amazon DynamoDB Point-in-time Recovery | **AWSManagedServices-TrustedRemediatorEnableDDBPITR** Enables point-in-time recovery for DynamoDB tables. | No preconfigured parameters are allowed. No constraints +[R365s2Qddf](https://docs.aws.amazon.com/awssupport/latest/user/fault-tolerance-checks.html#amazon-s3-bucket-versioning) Amazon S3 Bucket Versioning | **AWSManagedServices-TrustedRemediatorEnableBucketVersioning** Amazon S3 bucket versioning is enabled. | No preconfigured parameters are allowed. This remediation doesn't support remediating AWS service created S3 buckets (for example cf-templates-000000000000). @@ -173 +166 @@ Check ID and name | SSM document name and expected outcome | Supported preconfig - * **TargetPrefix:** Specifies an S3 prefix where the log files will be stored.