AWS organizations documentation change
Summary
Added documentation for editing tags on Security Hub policies
Security assessment
Expands tagging documentation to include Security Hub policies, which are security-related. However, this is a routine documentation update about resource management rather than addressing a security vulnerability. Tag management supports security hygiene but isn't itself a security fix.
Diff
diff --git a/organizations/latest/userguide/orgs_policies_edit.md b/organizations/latest/userguide/orgs_policies_edit.md index 1482ce292..e7f5a6435 100644 --- a//organizations/latest/userguide/orgs_policies_edit.md +++ b//organizations/latest/userguide/orgs_policies_edit.md @@ -5 +5 @@ -Edit tags attached to a service control policy (SCP)Edit tags attached to a resource control policy (RCP)Edit tags attached to an declarative policyEdit tags attached to a backup policyEdit tags attached to a tag policyEdit tags attached to a chat applications policyEdit tags attached to an AI services opt-out policy +Edit tags attached to a service control policy (SCP)Edit tags attached to a resource control policy (RCP)Edit tags attached to an declarative policyEdit tags attached to a backup policyEdit tags attached to a tag policyEdit tags attached to a chat applications policyEdit tags attached to an AI services opt-out policyEdit tags attached to a Security Hub policy @@ -26,0 +27,2 @@ This topic describes how to edit tags attached policies with AWS Organizations. + * Edit tags attached to a Security Hub policy + @@ -426,0 +429,57 @@ You can use one of the following commands to edit the tags attached to a AI serv + + * AWS SDKs: [TagResource](https://docs.aws.amazon.com/organizations/latest/APIReference/API_TagResource.html) and [UntagResource](https://docs.aws.amazon.com/organizations/latest/APIReference/API_UntagResource.html) + + + + +## Edit tags attached to a Security Hub policy + +When you sign in to your organization's management account, you can add or remove the tags attached to a Security Hub policy. For more information about tagging, see [Tagging AWS Organizations resources](./orgs_tagging.html). + +###### Minimum permissions + +To edit the tags attached to a Security Hub policy in your organization, you must have the following permissions: + + * `organizations:DescribeOrganization`– required only when using the Organizations console + + * `organizations:DescribePolicy`– required only when using the Organizations console + + * `organizations:TagResource` + + * `organizations:UntagResource` + + + + +AWS Management Console + + +###### To edit the tags attached to a Security Hub policy + + 1. Sign in to the [AWS Organizations console](https://console.aws.amazon.com/organizations/v2). You must sign in as an IAM user, assume an IAM role, or sign in as the root user ([not recommended](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials)) in the organization’s management account. + + 2. On the **[Security Hub policies](https://console.aws.amazon.com/organizations/v2/home/policies/securityhub-policy)** page, choose the name of the policy with the tags that you want to edit. + + 3. On the chosen policy's detail page, choose the **Tags** tab, and then choose **Manage tags**. + + 4. You can perform any of these actions on this page: + + * Edit the value for any tag by entering a new value over the old one. You can't modify the key. To change a key, you must delete the tag with the old key and add a tag with the new key. + + * Remove an existing tag by choosing **Remove**. + + * Add a new tag key and value pair. Choose **Add tag** , then enter the new key name and optional value in the provided boxes. If you leave the **Value** box empty, the value is an empty string; it isn't `null`. + + 5. Choose **Save changes** after you've made all the additions, removals, and edits you want to make. + + + + +AWS CLI & AWS SDKs + + +###### To edit the tags attached to a Security Hub policy + +You can use one of the following commands to edit the tags attached to a Security Hub policy: + + * AWS CLI: [tag-resource](https://docs.aws.amazon.com/cli/latest/reference/organizations/tag-resource.html) and [untag-resource](https://docs.aws.amazon.com/cli/latest/reference/organizations/untag-resource.html)