AWS securityhub documentation change
Summary
Clarified MFA delete control requirements, fixed markdown syntax, and added explicit statements about lifecycle configuration conflicts.
Security assessment
Enhances documentation of MFA delete security controls (a security feature) by clarifying prerequisites and limitations. While it improves security documentation, there's no indication of addressing a specific vulnerability.
Diff
diff --git a/securityhub/latest/userguide/s3-controls.md b/securityhub/latest/userguide/s3-controls.md index dfd443861..d5f1daa98 100644 --- a//securityhub/latest/userguide/s3-controls.md +++ b//securityhub/latest/userguide/s3-controls.md @@ -507 +507 @@ Amazon S3 currently doesn't support changing an access point's block public acce -**AWS Config rule:** [`s3-bucket-mfa-delete-enabled`](https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-mfa-delete-enabled.html) `` +**AWS Config rule:** [`s3-bucket-mfa-delete-enabled`](https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-mfa-delete-enabled.html) @@ -513 +513 @@ Amazon S3 currently doesn't support changing an access point's block public acce -This control checks whether multi-factor authentication (MFA) delete is enabled on an Amazon S3 general purpose versioned bucket. The control fails if MFA delete is not enabled on the bucket. The control doesn't produce findings for buckets that have a Lifecycle configuration. +This control checks whether multi-factor authentication (MFA) delete is enabled for an Amazon S3 general purpose bucket. The control fails if MFA delete is not enabled for the bucket. The control doesn't produce findings for buckets that have a lifecycle configuration. @@ -515 +515 @@ This control checks whether multi-factor authentication (MFA) delete is enabled -When working with S3 Versioning in Amazon S3 buckets, you can optionally add another layer of security by configuring a bucket to enable MFA delete. When you do this, the bucket owner must include two forms of authentication in any request to delete a version or change the versioning state of the bucket. MFA delete provides added security if your security credentials are compromised. MFA delete can also help prevent accidental bucket deletions by requiring the user who initiates the delete action to prove physical possession of an MFA device with an MFA code and adding an extra layer of friction and security to the delete action. +If you enable versioning for an S3 general purpose bucket, you can optionally add another layer of security by configuring MFA delete for the bucket. If you do this, the bucket owner must include two forms of authentication in any request to delete a version of an object in the bucket or change the versioning state of the bucket. MFA delete provides added security if, for example, the bucket owner’s security credentials are compromised. MFA delete can also help prevent accidental bucket deletions by requiring the user who initiates the delete action to prove physical possession of an MFA device with an MFA code, which adds an extra layer of friction and security to the delete action. @@ -519 +519 @@ When working with S3 Versioning in Amazon S3 buckets, you can optionally add ano -The MFA delete feature requires bucket versioning as a dependency. Bucket versioning is a method of keeping multiple variations of an S3 object in the same bucket. In addition, only the bucket owner who is logged in as a root user can enable MFA delete and perform delete actions on S3 buckets. +This control produces a `PASSED` finding only if MFA delete is enabled for the S3 general purpose bucket. To enable MFA delete for a bucket, versioning must also be enabled for the bucket. Bucket versioning is a method of storing multiple variations of an S3 object in the same bucket. In addition, only the bucket owner who is logged in as a root user can enable MFA delete and perform delete actions on the bucket. You cannot use MFA delete with a bucket that has a lifecycle configuration. @@ -523 +523 @@ The MFA delete feature requires bucket versioning as a dependency. Bucket versio -To enable S3 Versioning and configure MFA delete on a bucket, see [Configuring MFA delete](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html) in the _Amazon Simple Storage Service User Guide_. +For information about enabling versioning and configuring MFA delete for an S3 bucket, see [Configuring MFA delete](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html) in the _Amazon Simple Storage Service User Guide_.