AWS securityhub documentation change
Summary
Updated VPC endpoint documentation with corrected links to Amazon VPC Guide, removed region restriction note for Osaka, adjusted service name formatting, and clarified DNS configuration.
Security assessment
Changes primarily involve documentation corrections and link updates. The removal of the Osaka Region VPC endpoint restriction note may indicate expanded service availability but does not address a security vulnerability. Updates to endpoint policy references and VPC sharing details improve clarity but do not introduce new security features or mitigate specific vulnerabilities. VPC endpoints themselves are security features, so documentation updates maintain/add security context.
Diff
diff --git a/securityhub/latest/userguide/security-vpc-endpoints.md b/securityhub/latest/userguide/security-vpc-endpoints.md index b29fbf217..3e58132d9 100644 --- a//securityhub/latest/userguide/security-vpc-endpoints.md +++ b//securityhub/latest/userguide/security-vpc-endpoints.md @@ -11,3 +11 @@ You can establish a private connection between your VPC and AWS Security Hub by -Each interface endpoint is represented by one or more [Elastic Network Interfaces](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html) in your subnets. - -For more information, see [Interface VPC endpoints (AWS PrivateLink)](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html) in the _AWS PrivateLink Guide_. +Each interface endpoint is represented by one or more [Elastic Network Interfaces](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html) in your subnets. For more information, see [Access an AWS service using an interface VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html) in the _Amazon Virtual Private Cloud Guide_. @@ -17 +15 @@ For more information, see [Interface VPC endpoints (AWS PrivateLink)](https://do -Before you set up an interface VPC endpoint for Security Hub, ensure that you review [Interface endpoint properties and limitations](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html#vpce-interface-limitations) in the _AWS PrivateLink Guide_. +Before you set up an interface VPC endpoint for Security Hub, ensure that you review the prerequisites and other information in the [Amazon Virtual Private Cloud Guide](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html). @@ -21,4 +18,0 @@ Security Hub supports making calls to all of its API actions from your VPC. -###### Note - -Security Hub does not support VPC endpoints in the Asia Pacific (Osaka) Region. - @@ -27 +21 @@ Security Hub does not support VPC endpoints in the Asia Pacific (Osaka) Region. -You can create a VPC endpoint for the Security Hub service using either the Amazon VPC console or the AWS Command Line Interface (AWS CLI). For more information, see [Create an interface endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html#create-interface-endpoint) in the _AWS PrivateLink Guide_. +You can create a VPC endpoint for the Security Hub service using either the Amazon VPC console or the AWS Command Line Interface (AWS CLI). For more information, see [Create a VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html#create-interface-endpoint) in the _Amazon Virtual Private Cloud Guide_. @@ -31,4 +25 @@ Create a VPC endpoint for Security Hub using the following service name: - * com.amazonaws.`region`.securityhub - - - +`com.amazonaws.`region`.securityhub` @@ -36 +27 @@ Create a VPC endpoint for Security Hub using the following service name: -If you enable private DNS for the endpoint, you can make API requests to Security Hub using its default DNS name for the Region, for example, `securityhub.us-east-1.amazonaws.com`. +Where `region` is the Region code for the applicable AWS Region. @@ -38 +29 @@ If you enable private DNS for the endpoint, you can make API requests to Securit -For more information, see [Access a service through an interface endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html#access-service-though-endpoint) in the _AWS PrivateLink Guide_. +If you enable private DNS for the endpoint, you can make API requests to Security Hub using its default DNS name for the Region, for example, `securityhub.us-east-1.amazonaws.com` for the US East (N. Virginia) Region. @@ -53 +44 @@ You can attach an endpoint policy to your VPC endpoint that controls access to S -For more information, see [Control access to services with VPC endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-access.html) in the _AWS PrivateLink Guide_. +For more information, see [Control access to VPC endpoints using endpoint policies](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-access.html) in the _Amazon Virtual Private Cloud Guide_. @@ -77 +68 @@ The following is an example of an endpoint policy for Security Hub. When attache -You can't create, describe, modify, or delete VPC endpoints in subnets that are shared with you. However, you can use the VPC endpoints in subnets that are shared with you. For information about VPC sharing, see [Share your VPC with other accounts](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-sharing.html) in the _Amazon VPC User Guide_. +You can't create, describe, modify, or delete VPC endpoints in subnets that are shared with you. However, you can use the VPC endpoints in subnets that are shared with you. For information about VPC sharing, see [Share your VPC subnets with other accounts](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-sharing.html) in the _Amazon Virtual Private Cloud Guide_.