AWS securityhub documentation change
Summary
Updated documentation to reflect rebranding of 'Security Hub' to 'Security Hub CSPM (Cloud Security Posture Management)' throughout the text, including console references, API/CLI mentions, and administrator role terminology
Security assessment
The changes introduce CSPM (Cloud Security Posture Management) terminology but do not address a specific security vulnerability or weakness. This appears to be a branding/documentation clarification rather than a security fix. However, CSPM itself is a security feature category, so this adds documentation about security posture management capabilities.
Diff
diff --git a/securityhub/latest/userguide/designate-orgs-admin-account.md b/securityhub/latest/userguide/designate-orgs-admin-account.md index 28aa86b9d..8bc118766 100644 --- a//securityhub/latest/userguide/designate-orgs-admin-account.md +++ b//securityhub/latest/userguide/designate-orgs-admin-account.md @@ -3 +3 @@ -[Documentation](/index.html)[AWS Security Hub](/securityhub/index.html)[User Guide](what-is-securityhub.html) +[Documentation](/index.html)[AWS Security Hub](/securityhub/index.html)[ User Guide ](what-is-security-hub-adv.html) @@ -5 +5 @@ -Creating an organizationRecommendations for choosing the delegated Security Hub administratorVerify permissions to configure the delegated administratorDesignating the delegated administrator +Creating an organizationRecommendations for choosing the delegated Security Hub CSPM administratorVerify permissions to configure the delegated administratorDesignating the delegated administrator @@ -7 +7 @@ Creating an organizationRecommendations for choosing the delegated Security Hub -# Integrating Security Hub with AWS Organizations +# Integrating Security Hub CSPM with AWS Organizations @@ -9 +9 @@ Creating an organizationRecommendations for choosing the delegated Security Hub -To integrate AWS Security Hub and AWS Organizations, you create an organization in Organizations and use the organization management account to designate a delegated Security Hub administrator account. This enables Security Hub as a trusted service in Organizations. It also enables Security Hub in the current AWS Region for the delegated administrator account, and it allows the delegated administrator to enable Security Hub for member accounts, view data in member accounts, and perform other [allowed actions](./securityhub-accounts-allowed-actions.html) on member accounts. +To integrate AWS Security Hub Cloud Security Posture Management (CSPM) and AWS Organizations, you create an organization in Organizations and use the organization management account to designate a delegated Security Hub CSPM administrator account. This enables Security Hub CSPM as a trusted service in Organizations. It also enables Security Hub CSPM in the current AWS Region for the delegated administrator account, and it allows the delegated administrator to enable Security Hub CSPM for member accounts, view data in member accounts, and perform other [allowed actions](./securityhub-accounts-allowed-actions.html) on member accounts. @@ -11 +11 @@ To integrate AWS Security Hub and AWS Organizations, you create an organization -If you use [central configuration](./central-configuration-intro.html), then the delegated administrator can also create Security Hub configuration policies that specify how the Security Hub service, standards, and controls should be configured in organization accounts. +If you use [central configuration](./central-configuration-intro.html), then the delegated administrator can also create Security Hub CSPM configuration policies that specify how the Security Hub CSPM service, standards, and controls should be configured in organization accounts. @@ -21 +21 @@ You can use AWS Organizations to centrally view and manage all of the accounts w -## Recommendations for choosing the delegated Security Hub administrator +## Recommendations for choosing the delegated Security Hub CSPM administrator @@ -23 +23 @@ You can use AWS Organizations to centrally view and manage all of the accounts w -If you have an administrator account in place from the manual invitation process and are transitioning to account management with AWS Organizations, we recommend designating that account as the delegated Security Hub administrator. +If you have an administrator account in place from the manual invitation process and are transitioning to account management with AWS Organizations, we recommend designating that account as the delegated Security Hub CSPM administrator. @@ -25 +25 @@ If you have an administrator account in place from the manual invitation process -Although the Security Hub APIs and console allow the organization management account to be the delegated Security Hub administrator, we recommend choosing two different accounts. This is because users who have access to the organization management account to manage billing are likely to be different from users who need access to Security Hub for security management. +Although the Security Hub CSPM APIs and console allow the organization management account to be the delegated Security Hub CSPM administrator, we recommend choosing two different accounts. This is because users who have access to the organization management account to manage billing are likely to be different from users who need access to Security Hub CSPM for security management. @@ -27 +27 @@ Although the Security Hub APIs and console allow the organization management acc -We recommend using the same delegated administrator across Regions. If you opt in to central configuration, Security Hub automatically designates the same delegated administrator in your home Region and any linked Regions. +We recommend using the same delegated administrator across Regions. If you opt in to central configuration, Security Hub CSPM automatically designates the same delegated administrator in your home Region and any linked Regions. @@ -31 +31 @@ We recommend using the same delegated administrator across Regions. If you opt i -To designate and remove a delegated Security Hub administrator account, the organization management account must have permissions for the `EnableOrganizationAdminAccount` and `DisableOrganizationAdminAccount` actions in Security Hub. The Organizations management account must also have administrative permissions for Organizations. +To designate and remove a delegated Security Hub CSPM administrator account, the organization management account must have permissions for the `EnableOrganizationAdminAccount` and `DisableOrganizationAdminAccount` actions in Security Hub CSPM. The Organizations management account must also have administrative permissions for Organizations. @@ -33 +33 @@ To designate and remove a delegated Security Hub administrator account, the orga -To grant all of the required permissions, attach the following Security Hub managed policies to the IAM principal for the organization management account: +To grant all of the required permissions, attach the following Security Hub CSPM managed policies to the IAM principal for the organization management account: @@ -44 +44 @@ To grant all of the required permissions, attach the following Security Hub mana -To designate the delegated Security Hub administrator account, you can use the Security Hub console, Security Hub API, or AWS CLI. Security Hub sets the delegated administrator in the current AWS Region only, and you must repeat the action in other Regions. If you start using central configuration, then Security Hub automatically sets the same delegated administrator in the home Region and linked Regions. +To designate the delegated Security Hub CSPM administrator account, you can use the Security Hub CSPM console, Security Hub CSPM API, or AWS CLI. Security Hub CSPM sets the delegated administrator in the current AWS Region only, and you must repeat the action in other Regions. If you start using central configuration, then Security Hub CSPM automatically sets the same delegated administrator in the home Region and linked Regions. @@ -46 +46 @@ To designate the delegated Security Hub administrator account, you can use the S -The organization management account doesn't have to enable Security Hub in order to designate the delegated Security Hub administrator account. +The organization management account doesn't have to enable Security Hub CSPM in order to designate the delegated Security Hub CSPM administrator account. @@ -48 +48 @@ The organization management account doesn't have to enable Security Hub in order -We recommend that the organization management account is not the delegated Security Hub administrator account. However, if you do choose the organization management account as the Security Hub delegated administrator, the management account must have Security Hub enabled. If the management account does not have Security Hub enabled, you must enable Security Hub for it manually. Security Hub can't be enabled automatically for the organization management account. +We recommend that the organization management account is not the delegated Security Hub CSPM administrator account. However, if you do choose the organization management account as the Security Hub CSPM delegated administrator, the management account must have Security Hub CSPM enabled. If the management account does not have Security Hub CSPM enabled, you must enable Security Hub CSPM for it manually. Security Hub CSPM can't be enabled automatically for the organization management account. @@ -50 +50 @@ We recommend that the organization management account is not the delegated Secur -You must designate the delegated Security Hub administrator using one of the following methods. Designating the delegated Security Hub administrator with Organizations APIs doesn't reflect in Security Hub. +You must designate the delegated Security Hub CSPM administrator using one of the following methods. Designating the delegated Security Hub CSPM administrator with Organizations APIs doesn't reflect in Security Hub CSPM. @@ -52 +52 @@ You must designate the delegated Security Hub administrator using one of the fol -Choose your preferred method, and follow the steps to designate the delegated Security Hub administrator account. +Choose your preferred method, and follow the steps to designate the delegated Security Hub CSPM administrator account. @@ -54 +54 @@ Choose your preferred method, and follow the steps to designate the delegated Se -Security Hub console +Security Hub CSPM console @@ -59 +59 @@ Security Hub console - 1. Open the AWS Security Hub console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). + 1. Open the AWS Security Hub Cloud Security Posture Management (CSPM) console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). @@ -61 +61 @@ Security Hub console - 2. Choose **Go to Security Hub**. You're prompted to sign in to the organization management account. + 2. Choose **Go to Security Hub CSPM**. You're prompted to sign in to the organization management account. @@ -72 +72 @@ Security Hub console - 1. Open the AWS Security Hub console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). + 1. Open the AWS Security Hub Cloud Security Posture Management (CSPM) console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). @@ -74 +74 @@ Security Hub console - 2. In the Security Hub navigation pane, choose **Settings**. Then choose **General**. + 2. In the Security Hub CSPM navigation pane, choose **Settings**. Then choose **General**. @@ -76 +76 @@ Security Hub console - 3. If a Security Hub administrator account is currently assigned, then before you can designate a new account, you must remove the current account. + 3. If a Security Hub CSPM administrator account is currently assigned, then before you can designate a new account, you must remove the current account. @@ -80 +80 @@ Under **Delegated Administrator** , to remove the current account, choose **Remo - 4. Enter the account ID of the account you want to designate as the **Security Hub** administrator account. + 4. Enter the account ID of the account you want to designate as the **Security Hub CSPM** administrator account. @@ -82 +82 @@ Under **Delegated Administrator** , to remove the current account, choose **Remo -You must designate the same Security Hub administrator account in all Regions. If you designate an account that is different from the account designated in other Regions, the console returns an error. +You must designate the same Security Hub CSPM administrator account in all Regions. If you designate an account that is different from the account designated in other Regions, the console returns an error. @@ -89 +89 @@ You must designate the same Security Hub administrator account in all Regions. I -Security Hub API, AWS CLI +Security Hub CSPM API, AWS CLI @@ -92 +92 @@ Security Hub API, AWS CLI -From the organization management account, use the [EnableOrganizationAdminAccount](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_EnableOrganizationAdminAccount.html) operation of the Security Hub API. If you're using the AWS CLI, run the [enable-organization-admin-account](https://docs.aws.amazon.com/cli/latest/reference/securityhub/enable-organization-admin-account.html) command. Provide the AWS account ID of the delegated Security Hub administrator. +From the organization management account, use the [EnableOrganizationAdminAccount](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_EnableOrganizationAdminAccount.html) operation of the Security Hub CSPM API. If you're using the AWS CLI, run the [enable-organization-admin-account](https://docs.aws.amazon.com/cli/latest/reference/securityhub/enable-organization-admin-account.html) command. Provide the AWS account ID of the delegated Security Hub CSPM administrator. @@ -94 +94 @@ From the organization management account, use the [EnableOrganizationAdminAccoun -The following example designates the delegated Security Hub administrator. This example is formatted for Linux, macOS, or Unix, and it uses the backslash (\\) line-continuation character to improve readability. +The following example designates the delegated Security Hub CSPM administrator. This example is formatted for Linux, macOS, or Unix, and it uses the backslash (\\) line-continuation character to improve readability. @@ -105 +105 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Managing accounts with Organizations +Managing accounts with AWS Organizations