AWS awssupport medium security documentation change
Summary
Added new check for AWS STS global endpoint usage across regions with guidance to migrate to Regional endpoints
Security assessment
The change documents a resiliency risk from cross-region STS endpoint dependencies and recommends using Regional endpoints for fault isolation. While primarily about fault tolerance, the guidance helps prevent potential availability issues that could be exploited in denial-of-service scenarios. The explicit mention of security implications in the description ('posing a resiliency risk to your application') provides concrete evidence of security relevance.
Diff
diff --git a/awssupport/latest/user/fault-tolerance-checks.md b/awssupport/latest/user/fault-tolerance-checks.md index 0d06dff99..b927195a4 100644 --- a//awssupport/latest/user/fault-tolerance-checks.md +++ b//awssupport/latest/user/fault-tolerance-checks.md @@ -5 +5 @@ -ALB Multi-AZAmazon Aurora MySQL cluster backtracking not enabledAmazon Aurora DB Instance AccessibilityAmazon CloudFront Origin FailoverAmazon Comprehend Endpoint Access RiskAmazon DocumentDB Single AZ ClustersAmazon DynamoDB Point-in-time RecoveryAmazon DynamoDB Table Not Included in Backup PlanAmazon EBS Not Included in AWS Backup PlanAmazon EBS SnapshotsAmazon EC2 Auto Scaling does not have ELB Health Check EnabledAmazon EC2 Auto Scaling Group has Capacity Rebalancing EnabledAmazon EC2 Auto Scaling is not deployed in multiple AZs or does not meet the minimum number of AZsAmazon EC2 Availability Zone BalanceAmazon EC2 Detailed Monitoring Not EnabledAmazon ECS AWSLogs driver in blocking modeAmazon ECS service using a single AZAmazon ECS Multi-AZ placement strategy Amazon EFS No Mount Target RedundancyAmazon EFS not in AWS Backup PlanAmazon ElastiCache Multi-AZ clustersElastiCache (Redis OSS) Clusters Automatic BackupAmazon MemoryDB Multi-AZ clustersAmazon MSK brokers hosting too many partitionsAmazon MSK Cluster Multi-AZAmazon OpenSearch Service domains with less than three data nodesAmazon RDS BackupsAmazon RDS Continuous Backup Not EnabledAmazon RDS DB clusters have one DB instanceAmazon RDS DB clusters with all instances in the same Availability ZoneAmazon RDS DB clusters with all reader instances in the same Availability ZoneAmazon RDS DB Instance Enhanced Monitoring not enabledAmazon RDS DB instances have storage autoscaling turned offAmazon RDS DB instances not using Multi-AZ deploymentAmazon RDS DiskQueueDepthAmazon RDS FreeStorageSpaceAmazon RDS log_output parameter is set to tableAmazon RDS innodb_default_row_format parameter setting is unsafeAmazon RDS innodb_flush_log_at_trx_commit parameter is not 1Amazon RDS max_user_connections parameter is lowAmazon RDS Multi-AZAmazon RDS Not In AWS Backup PlanAmazon RDS Read Replicas are open in writable modeAmazon RDS resource automated backups is turned offAmazon RDS sync_binlog parameter is turned offRDS DB Cluster has no Multi-AZ replication enabledRDS Multi-AZ Standby Instance Not EnabledAmazon RDS ReplicaLagAmazon RDS synchronous_commit parameter is turned offAmazon Redshift cluster automated snapshotsAmazon Route 53 Deleted Health ChecksAmazon Route 53 Failover Resource Record SetsAmazon Route 53 High TTL Resource Record SetsAmazon Route 53 Name Server DelegationsAmazon Route 53 Resolver Endpoint Availability Zone RedundancyAmazon S3 Bucket LoggingAmazon S3 Bucket Replication Not EnabledAmazon S3 Bucket VersioningApplication, Network, and Gateway Load Balancers Not Spanning Multiple Availability ZonesAuto Scaling available IPs in SubnetsAuto Scaling Group Health CheckAuto Scaling Group ResourcesAWS CloudHSM clusters running HSM instances in a single AZAWS Direct Connect Location ResiliencyAWS Lambda functions without a dead-letter queue configuredAWS Lambda On Failure Event DestinationsAWS Lambda VPC-enabled Functions without Multi-AZ RedundancyAWS Outposts Single Rack deploymentAWS Resilience Hub Application Component checkAWS Resilience Hub policy breachedAWS Resilience Hub resilience scoresAWS Resilience Hub assessment ageAWS Site-to-Site VPN has at least one tunnel in DOWN statusAWS Well-Architected high risk issues for reliabilityClassic Load Balancer has no multiple AZs configuredCLB Connection DrainingELB Target ImbalanceGWLB - endpoint AZ independenceLoad Balancer OptimizationNAT Gateway AZ IndependenceNetwork Firewall endpoint AZ IndependenceNetwork Firewall Multi-AZNetwork Load Balancers Cross Load BalancingNLB - Internet-facing resource in private subnetNLB Multi-AZNumber of AWS Regions in an Incident Manager replication setSingle AZ Application CheckVPC interface endpoint network interfaces in multiple AZsVPN Tunnel RedundancyActiveMQ Availability Zone RedundancyRabbitMQ Availability Zone Redundancy +ALB Multi-AZAmazon Aurora MySQL cluster backtracking not enabledAmazon Aurora DB Instance AccessibilityAmazon CloudFront Origin FailoverAmazon Comprehend Endpoint Access RiskAmazon DocumentDB Single AZ ClustersAmazon DynamoDB Point-in-time RecoveryAmazon DynamoDB Table Not Included in Backup PlanAmazon EBS Not Included in AWS Backup PlanAmazon EBS SnapshotsAmazon EC2 Auto Scaling does not have ELB Health Check EnabledAmazon EC2 Auto Scaling Group has Capacity Rebalancing EnabledAmazon EC2 Auto Scaling is not deployed in multiple AZs or does not meet the minimum number of AZsAmazon EC2 Availability Zone BalanceAmazon EC2 Detailed Monitoring Not EnabledAmazon ECS AWSLogs driver in blocking modeAmazon ECS service using a single AZAmazon ECS Multi-AZ placement strategy Amazon EFS No Mount Target RedundancyAmazon EFS not in AWS Backup PlanAmazon ElastiCache Multi-AZ clustersElastiCache (Redis OSS) Clusters Automatic BackupAmazon MemoryDB Multi-AZ clustersAmazon MSK brokers hosting too many partitionsAmazon MSK Cluster Multi-AZAmazon OpenSearch Service domains with less than three data nodesAmazon RDS BackupsAmazon RDS Continuous Backup Not EnabledAmazon RDS DB clusters have one DB instanceAmazon RDS DB clusters with all instances in the same Availability ZoneAmazon RDS DB clusters with all reader instances in the same Availability ZoneAmazon RDS DB Instance Enhanced Monitoring not enabledAmazon RDS DB instances have storage autoscaling turned offAmazon RDS DB instances not using Multi-AZ deploymentAmazon RDS DiskQueueDepthAmazon RDS FreeStorageSpaceAmazon RDS log_output parameter is set to tableAmazon RDS innodb_default_row_format parameter setting is unsafeAmazon RDS innodb_flush_log_at_trx_commit parameter is not 1Amazon RDS max_user_connections parameter is lowAmazon RDS Multi-AZAmazon RDS Not In AWS Backup PlanAmazon RDS Read Replicas are open in writable modeAmazon RDS resource automated backups is turned offAmazon RDS sync_binlog parameter is turned offRDS DB Cluster has no Multi-AZ replication enabledRDS Multi-AZ Standby Instance Not EnabledAmazon RDS ReplicaLagAmazon RDS synchronous_commit parameter is turned offAmazon Redshift cluster automated snapshotsAmazon Route 53 Deleted Health ChecksAmazon Route 53 Failover Resource Record SetsAmazon Route 53 High TTL Resource Record SetsAmazon Route 53 Name Server DelegationsAmazon Route 53 Resolver Endpoint Availability Zone RedundancyAmazon S3 Bucket LoggingAmazon S3 Bucket Replication Not EnabledAmazon S3 Bucket VersioningApplication, Network, and Gateway Load Balancers Not Spanning Multiple Availability ZonesAuto Scaling available IPs in SubnetsAuto Scaling Group Health CheckAuto Scaling Group ResourcesAWS CloudHSM clusters running HSM instances in a single AZAWS Direct Connect Location ResiliencyAWS Lambda functions without a dead-letter queue configuredAWS Lambda On Failure Event DestinationsAWS Lambda VPC-enabled Functions without Multi-AZ RedundancyAWS Outposts Single Rack deploymentAWS Resilience Hub Application Component checkAWS Resilience Hub policy breachedAWS Resilience Hub resilience scoresAWS Resilience Hub assessment ageAWS Site-to-Site VPN has at least one tunnel in DOWN statusAWS STS global endpoint usage across AWS RegionsAWS Well-Architected high risk issues for reliabilityClassic Load Balancer has no multiple AZs configuredCLB Connection DrainingELB Target ImbalanceGWLB - endpoint AZ independenceLoad Balancer OptimizationNAT Gateway AZ IndependenceNetwork Firewall endpoint AZ IndependenceNetwork Firewall Multi-AZNetwork Load Balancers Cross Load BalancingNLB - Internet-facing resource in private subnetNLB Multi-AZNumber of AWS Regions in an Incident Manager replication setSingle AZ Application CheckVPC interface endpoint network interfaces in multiple AZsVPN Tunnel RedundancyActiveMQ Availability Zone RedundancyRabbitMQ Availability Zone Redundancy @@ -158,0 +159,2 @@ You can use the following checks for the fault tolerance category. + * [AWS STS global endpoint usage across AWS Regions](./fault-tolerance-checks.html#sts-global-endpoint) + @@ -4456,0 +4459,68 @@ For more information, see [Your customer gateway device](https://docs.aws.amazon +## AWS STS global endpoint usage across AWS Regions + +**Description** + + +This check identifies a resiliency risk when AWS workloads make cross-region calls to the STS global endpoint in the US East (N. Virginia) Region. AWS workloads that make cross-region requests to the STS global endpoint in US East (N. Virginia) might be adversely impacted if connectivity to the US East (N. Virginia) STS endpoint is impacted. + +In April 2025, AWS enhanced the global endpoint to automatically serve the STS global endpoint calls in the same Region as your workloads running in AWS, for all AWS Regions enabled by default. However, some workloads, such as those running in opt-in Regions, or those not using Amazon DNS servers, do not benefit from the reduced latency and [fault isolation](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/abstract-and-introduction.html) offered as part of this enhancement. For these workloads, STS global endpoint requests are served in the US East (N. Virginia) Region, posing a resiliency risk to your application, and increasing latency of STS requests. + +###### Note + +Results for this check are automatically refreshed several times daily, and refresh requests are not allowed. It might take a few hours for changes to appear. + +For Business, Enterprise On-Ramp, or Enterprise Support customers, you can use the [BatchUpdateRecommendationResourceExclusion](https://docs.aws.amazon.com/trustedadvisor/latest/APIReference/API_BatchUpdateRecommendationResourceExclusion.html) API to include or exclude one or more resources from your Trusted Advisor results. + +**Check ID** + + +`c15m0mgld3` + +**Alert criteria** + + +Red: Workloads are making cross-region calls to the AWS STS global endpoint in the US East (N. Virginia) Region. + +**Recommended action** + + +To improve the resiliency and performance of your workloads, we recommend that you migrate from the STS global endpoint to the STS Regional endpoint. By using a Regional endpoint, you can use AWS STS in the same Region as your workloads. + +The following is a list of AWS Identity and Access Management (IAM) Principals making cross-region calls to the AWS STS global endpoint in the US East (N. Virginia) Region. By following the steps in the blog post [How to use Regional AWS STS endpoints](https://aws.amazon.com/blogs/security/how-to-use-regional-aws-sts-endpoints/), you can reconfigure your workloads to use the Regional STS endpoint. + +Status | Principal ARN | IAM Principal Type | Action | Last Updated Time | Originating Region +---|---|---|---|---|--- +Red | arn:aws:iam::999999999999:role/example | Role | AssumeRole | 2025-01-01T08:00.000Z | ca-west-1 +Red | arn:aws:iam::123456789012:user/JohnDoe | User | GetCallerIdentity | 2025-01-01T08:00.000Z | ca-west-1 +Red | arn:aws:sts::123456789012:federated-user/<Name> | Federated User | GetCallerIdentity | 2025-01-01T08:00.000Z | eu-west-2 +Red | arn:aws:iam::123456789012:root | Root | AssumeRole | 2025-01-01T08:00.000Z | il-central-1 +Red | arn:aws:sts::0123456789012:assumed-role/aws:ec2-instance/i-0123456789example | EC2 Instance Identity Role | GetCallerIdentity | 2025-01-01T08:00.000Z | us-west-1 + +**Additional resources** + + + * [Manage AWS STS in an AWS Region](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html) + + * [AWS STS Regional endpoints](https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html) + + + + +**Report columns** + + + * Status + + * Principal Arn + + * Action + + * Principal Type + + * Originating Region + + * Last Updated Time + + + +