AWS securityhub documentation change
Summary
Updated documentation to consistently reference 'Security Hub CSPM' controls instead of generic 'Security Hub' controls, clarified cost optimization guidance for disabling controls related to global resources, and adjusted breadcrumb navigation links.
Security assessment
The changes focus on rebranding controls as part of CSPM (Cloud Security Posture Management) and refining cost management guidance. While CSPM is a security feature, there is no evidence of addressing a specific vulnerability or security incident. The updates primarily improve clarity and operational guidance rather than patching security flaws.
Diff
diff --git a/securityhub/latest/userguide/controls-to-disable.md b/securityhub/latest/userguide/controls-to-disable.md index 9bfc95338..41cbe2b73 100644 --- a//securityhub/latest/userguide/controls-to-disable.md +++ b//securityhub/latest/userguide/controls-to-disable.md @@ -3 +3 @@ -[Documentation](/index.html)[AWS Security Hub](/securityhub/index.html)[User Guide](what-is-securityhub.html) +[Documentation](/index.html)[AWS Security Hub](/securityhub/index.html)[ User Guide ](what-is-security-hub-adv.html) @@ -7 +7 @@ Controls that use global resourcesCloudTrail logging controlsCloudWatch alarm co -# Suggested controls to disable in Security Hub +# Suggested controls to disable @@ -9 +9 @@ Controls that use global resourcesCloudTrail logging controlsCloudWatch alarm co -We recommend disabling some AWS Security Hub controls to reduce finding noise and usage costs. +We recommend disabling some AWS Security Hub Cloud Security Posture Management (CSPM) controls to reduce finding noise and usage costs. @@ -13 +13 @@ We recommend disabling some AWS Security Hub controls to reduce finding noise an -Some AWS services support global resources, which means that you can access the resource from any AWS Region. To save on the cost of AWS Config, you can disable recording of global resources in all but one Region. After you do this, however, Security Hub stills run security checks in all Regions where a control is enabled and charges you based on the number of checks per account per Region. Accordingly, to reduce finding noise and save on the cost of Security Hub, you should also disable controls that involve global resources in all Regions except the Region that records global resources. +Some AWS services support global resources, which means that you can access the resource from any AWS Region. To save on the cost of AWS Config, you can disable recording of global resources in all but one Region. After you do this, however, Security Hub CSPM stills run security checks in all Regions where a control is enabled and charges you based on the number of checks per account per Region. Accordingly, to reduce finding noise and save on the cost of Security Hub CSPM, you should also disable controls that involve global resources in all Regions except the Region that records global resources. @@ -30 +30 @@ If a control involves global resources but is available in only one Region, disa -If you use central configuration, Security Hub automatically disables controls that involve global resources in all Regions except the home Region. Other controls that you choose to enable though a configuration policy are enabled in all Regions where they are available. To limit findings for these controls to just one Region, you can update your AWS Config recorder settings and turn off global resource recording in all Regions except the home Region. +If you use central configuration, Security Hub CSPM automatically disables controls that involve global resources in all Regions except the home Region. Other controls that you choose to enable though a configuration policy are enabled in all Regions where they are available. To limit findings for these controls to just one Region, you can update your AWS Config recorder settings and turn off global resource recording in all Regions except the home Region. @@ -32 +32 @@ If you use central configuration, Security Hub automatically disables controls t -If an enabled control that involves global resources isn't supported in the home Region, Security Hub tries to enable the control in one linked Region where the control is supported. With central configuration, you lack coverage for a control that isn't available in the home Region or any of the linked Regions. +If an enabled control that involves global resources isn't supported in the home Region, Security Hub CSPM tries to enable the control in one linked Region where the control is supported. With central configuration, you lack coverage for a control that isn't available in the home Region or any of the linked Regions. @@ -34 +34 @@ If an enabled control that involves global resources isn't supported in the home -For more information about central configuration, see [Understanding central configuration in Security Hub](./central-configuration-intro.html). +For more information about central configuration, see [Understanding central configuration in Security Hub CSPM](./central-configuration-intro.html). @@ -36 +36 @@ For more information about central configuration, see [Understanding central con -For controls that have a _periodic_ schedule type, disabling them in Security Hub is required to prevent billing. Setting the AWS Config parameter `includeGlobalResourceTypes` to `false` doesn't affect periodic Security Hub controls. +For controls that have a _periodic_ schedule type, disabling them in Security Hub CSPM is required to prevent billing. Setting the AWS Config parameter `includeGlobalResourceTypes` to `false` doesn't affect periodic Security Hub CSPM controls. @@ -38 +38 @@ For controls that have a _periodic_ schedule type, disabling them in Security Hu -The following Security Hub controls use global resources: +The following Security Hub CSPM controls use global resources: