AWS prescriptive-guidance documentation change
Summary
Formatting improvements, terminology consistency updates (e.g., 'S3' to 'Amazon S3'), documentation structure changes, and image reference update
Security assessment
Changes focus on documentation clarity and consistency rather than addressing security vulnerabilities. Updates include backtick formatting for code elements, service name standardization (e.g., 'Amazon S3' vs 'S3'), and workflow image replacement. No evidence of specific security vulnerability fixes or new security feature introductions.
Diff
diff --git a/prescriptive-guidance/latest/patterns/automate-remediation-for-aws-security-hub-standard-findings.md b/prescriptive-guidance/latest/patterns/automate-remediation-for-aws-security-hub-standard-findings.md index 7e37401bd..b2731f6c4 100644 --- a//prescriptive-guidance/latest/patterns/automate-remediation-for-aws-security-hub-standard-findings.md +++ b//prescriptive-guidance/latest/patterns/automate-remediation-for-aws-security-hub-standard-findings.md @@ -68 +68 @@ The EventBridge rule forwards these findings to an AWS Lambda function, which re - * For the EC2.6 remedy, to enable VPC Flow Logs, an Amazon CloudWatch Logs log group will be created with /VpcFlowLogs/vpc_id format. If a log group exists with same name, the existing log group will be used. + * For the EC2.6 remedy, to enable VPC Flow Logs, an Amazon CloudWatch Logs log group will be created with `/VpcFlowLogs/vpc_id` format. If a log group exists with same name, the existing log group will be used. @@ -85 +85 @@ The EventBridge rule forwards these findings to an AWS Lambda function, which re - * AWS Identity and Access Management (IAM) roles for Lambda function, VPC Flow Logs, and Amazon Relational Database Service (Amazon RDS) Enhanced Monitoring + * AWS Identity and Access Management (IAM) roles for the Lambda function, VPC Flow Logs, and Amazon RDS Enhanced Monitoring @@ -92 +92 @@ The EventBridge rule forwards these findings to an AWS Lambda function, which re - + @@ -100 +100 @@ If you are using AWS Organizations, you can use [AWS CloudFormation StackSets](h -**Tools** + * [AWS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html) is a service that helps you model and set up AWS resources by using infrastructure as code. @@ -102 +102 @@ If you are using AWS Organizations, you can use [AWS CloudFormation StackSets](h - * [AWS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html) – AWS CloudFormation is a service that helps you model and set up AWS resources by using infrastructure as code. + * [Amazon EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/what-is-amazon-eventbridge.html) delivers a stream of real-time data from your own applications, software as a service (SaaS) applications, and AWS services, routing that data to targets such as Lambda functions. @@ -104 +104 @@ If you are using AWS Organizations, you can use [AWS CloudFormation StackSets](h - * [EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/what-is-amazon-eventbridge.html) – Amazon EventBridge delivers a stream of real-time data from your own applications, software as a service (SaaS) applications, and AWS services, routing that data to targets such as Lambda functions. + * [AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html) supports running code without provisioning or managing servers. @@ -106 +106 @@ If you are using AWS Organizations, you can use [AWS CloudFormation StackSets](h - * [Lambda ](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html)– AWS Lambda supports running code without provisioning or managing servers. + * [Amazon Simple Storage Service (Amazon S3)](https://docs.aws.amazon.com/AmazonS3/latest/dev/Welcome.html) is a highly scalable object storage service that you can use for a wide range of storage solutions, including websites, mobile applications, backups, and data lakes. @@ -108,3 +108 @@ If you are using AWS Organizations, you can use [AWS CloudFormation StackSets](h - * [Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/dev/Welcome.html) – Amazon Simple Storage Service (Amazon S3) is a highly scalable object storage service that you can use for a wide range of storage solutions, including websites, mobile applications, backups, and data lakes. - - * [Amazon SNS](https://docs.aws.amazon.com/sns/latest/dg/welcome.html) – Amazon Simple Notification Service (Amazon SNS) coordinates and manages the delivery or sending of messages between publishers and clients, including web servers and email addresses. Subscribers receive all messages published to the topics to which they subscribe, and all subscribers to a topic receive the same messages. + * [Amazon Simple Notification Service (Amazon SNS)](https://docs.aws.amazon.com/sns/latest/dg/welcome.html) coordinates and manages the delivery or sending of messages between publishers and clients, including web servers and email addresses. Subscribers receive all messages published to the topics to which they subscribe, and all subscribers to a topic receive the same messages. @@ -128,2 +126,2 @@ Task| Description| Skills required -Define the S3 bucket.| On the Amazon S3 console, choose or create an S3 bucket with a unique name that does not contain leading slashes. An S3 bucket name is globally unique, and the namespace is shared by all AWS accounts. Your S3 bucket must be in the same Region as the Security Hub findings that are being evaluated.| Cloud Architect -Upload the Lambda code to the S3 bucket.| Upload the Lambda code .zip file that's provided in the "Attachments" section to the defined S3 bucket.| Cloud Architect +Define the Amazon S3 bucket.| On the Amazon S3 console, choose or create an Amazon S3 bucket with a unique name that does not contain leading slashes. An Amazon S3 bucket name is globally unique, and the namespace is shared by all AWS accounts. Your Amazon S3 bucket must be in the same Region as the Security Hub findings that are being evaluated.| Cloud Architect +Upload the Lambda code to the Amazon S3 bucket.| Upload the Lambda code .zip file that's provided in the "Attachments" section to the defined Amazon S3 bucket.| Cloud Architect @@ -134,7 +132,7 @@ Task| Description| Skills required -Provide the S3 bucket name.| Enter the name of the S3 bucket that you created in the first epic.| Cloud Architect -Provide the Amazon S3 prefix.| Provide the location of the Lambda code .zip file in your S3 bucket, without leading slashes (for example, <directory>/<file-name>.zip).| Cloud Architect -Provide the SNS topic ARN.| Provide the SNS topic Amazon Resource Name (ARN) if you want to use an existing SNS topic for remediation notifications. To use a new SNS topic, keep the value as "None" (the default value).| Cloud Architect -Provide an email address.| Provide an email address where you want to receive the remediation notifications (needed only when you want AWS CloudFormation to create the SNS topic).| Cloud Architect -Define the logging level.| Define the logging level and frequency for your Lambda function. “Info” designates detailed informational messages on the application’s progress. “Error” designates error events that could still allow the application to continue running. “Warning” designates potentially harmful situations.| Cloud Architect -Provide the VPC Flow Logs IAM role ARN.| Provide the IAM role ARN to be used for VPC Flow Logs. (If “None” is entered as input, AWS CloudFormation creates an IAM role and uses it.)| Cloud Architect -Provide the RDS Enhanced Monitoring IAM role ARN.| Provide the IAM role ARN to be used for RDS Enhanced Monitoring. (If “None” is entered, AWS CloudFormation creates an IAM role and uses it.)| Cloud Architect +Provide the Amazon S3 bucket name.| Enter the name of the Amazon S3 bucket that you created in the first epic.| Cloud Architect +Provide the Amazon S3 prefix.| Provide the location of the Lambda code .zip file in your Amazon S3 bucket, without leading slashes (for example, `<directory>/<file-name>.zip`).| Cloud Architect +Provide the ARN of the Amazon SNS topic.| If you want to use an existing Amazon SNS topic for remediation notifications, provide the Amazon Resource Name (ARN) of the Amazon SNS topic. If you want to use a new Amazon SNS topic, keep the value as `None` (the default value).| Cloud Architect +Provide an email address.| Provide an email address where you want to receive the remediation notifications (needed only when you want AWS CloudFormation to create the Amazon SNS topic).| Cloud Architect +Define the logging level.| Define the logging level and frequency for your Lambda function. `Info` designates detailed informational messages on the application’s progress. `Error` designates error events that could still allow the application to continue running. `Warning` designates potentially harmful situations.| Cloud Architect +Provide the ARN of the IAM role for VPC Flow Logs.| Provide the ARN of the IAM role to be used for VPC Flow Logs. If you enter `None`, AWS CloudFormation creates an IAM role and uses it.| Cloud Architect +Provide the ARN of the IAM role for Amazon RDS Enhanced Monitoring.| Provide the ARN of the IAM role to be used for Amazon RDS Enhanced Monitoring. If you enter `None`, AWS CloudFormation creates an IAM role and uses it.| Cloud Architect @@ -144 +142 @@ Task| Description| Skills required -Confirm the Amazon SNS subscription.| When the template successfully deploys, if a new SNS topic was created, a subscription message is sent to the email address that you provided. To receive remediation notifications, you must confirm this subscription email message.| Cloud Architect +Confirm the Amazon SNS subscription.| When the template successfully deploys, if a new Amazon SNS topic was created, a subscription message is sent to the email address that you provided. To receive remediation notifications, you must confirm this subscription email message.| Cloud Architect @@ -150 +148 @@ Confirm the Amazon SNS subscription.| When the template successfully deploys, if - * [AWS Lambda](https://aws.amazon.com/lambda/) + * [AWS Lambda website](https://aws.amazon.com/lambda/) @@ -152 +150 @@ Confirm the Amazon SNS subscription.| When the template successfully deploys, if - * [AWS Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html) + * [AWS Security Hub documentation](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html)