AWS securityhub high security documentation change
Summary
Updated document history to reflect rebranding from 'AWS Security Hub' to 'AWS Security Hub Cloud Security Posture Management (CSPM)', added new managed policies, updated security controls, and documented new security standards integration.
Security assessment
The changes include additions of new managed policies (AWSSecurityHubV2ServiceRolePolicy) with security permissions, updates to security control severity levels (e.g., Config.1 from MEDIUM to CRITICAL), and integration with security standards like NIST SP 800-53 Rev.5. These changes directly impact security configurations and control implementations.
Diff
diff --git a/securityhub/latest/userguide/doc-history.md b/securityhub/latest/userguide/doc-history.md index 89d55effb..7a397f5a8 100644 --- a//securityhub/latest/userguide/doc-history.md +++ b//securityhub/latest/userguide/doc-history.md @@ -3 +3 @@ -[Documentation](/index.html)[AWS Security Hub](/securityhub/index.html)[User Guide](what-is-securityhub.html) +[Documentation](/index.html)[AWS Security Hub](/securityhub/index.html)[ User Guide ](what-is-security-hub-adv.html) @@ -5 +5 @@ -# Document history for the AWS Security Hub User Guide +# Document history for the AWS Security Hub Cloud Security Posture Management (CSPM) User Guide @@ -7 +7 @@ -The following table describes the important changes to the documentation since the last release of AWS Security Hub. For releases of new security controls, the date specifies when the controls begin to be available in supported AWS Regions. It can take 1‐2 weeks for controls to be available in all supported Regions. +The following table describes the important changes to the documentation since the last release of AWS Security Hub Cloud Security Posture Management (CSPM). For releases of new security controls, the date specifies when the controls begin to be available in supported AWS Regions. It can take 1‐2 weeks for controls to be available in all supported Regions. @@ -9 +9 @@ The following table describes the important changes to the documentation since t -For notification about updates to the _AWS Security Hub User Guide_ , you can subscribe to an RSS feed. +For notification about updates to the _AWS Security Hub Cloud Security Posture Management (CSPM) User Guide_ , you can subscribe to an RSS feed. @@ -12,0 +13,3 @@ Change| Description| Date +Update to existing managed policy| Security Hub CSPM added new permission to `AWSSecurityHubFullAccess`. The permission allows principals to create a service-linked role for Security Hub. | June 17, 2025 +Public preview release of AWS Security Hub| Published public preview release of [_AWS Security Hub User Guide_](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-security-hub-adv.html). | June 17, 2025 +New managed policy for Security Hub| A new managed policy, `AWSSecurityHubV2ServiceRolePolicy`, allows Security Hub to manage AWS Config rules and Security Hub resources in a customer's organization and on the customer's behalf. Security Hub is in preview release and subject to change. | June 17, 2025 @@ -14,3 +17,3 @@ Updates to security standards and controls| We removed the [IAM.10 control](http -New security standard| Security Hub now provides a [security standard](https://docs.aws.amazon.com/securityhub/latest/userguide/standards-reference-nist-800-171.html) that aligns with the NIST SP 800-171 Revision 2 cybersecurity and compliance framework. This new standard includes more than 60 existing security controls. The controls perform automated checks that evaluate certain AWS services and resources for compliance with a subset of the requirements defined by the framework.| May 29, 2025 -Updates to security controls| Security Hub rolled back the release of the following control in all AWS Regions: _[RDS.46] RDS DB instances should not be deployed in public subnets with routes to internet gateways_. Previously, this control supported the AWS Foundational Security Best Practices v1.0.0 (FSBP) standard.| May 8, 2025 -New security controls| Security Hub released 9 new controls. Most of the controls support the [AWS Foundational Security Best Practices v1.0.0 (FSBP)](https://docs.aws.amazon.com/securityhub/latest/userguide/fsbp-standard.html) standard. Some of the controls support [NIST SP 800-53 Rev. 5](https://docs.aws.amazon.com/securityhub/latest/userguide/nist-standard.html) requirements. +New security standard| Security Hub CSPM now provides a [security standard](https://docs.aws.amazon.com/securityhub/latest/userguide/standards-reference-nist-800-171.html) that aligns with the NIST SP 800-171 Revision 2 cybersecurity and compliance framework. This new standard includes more than 60 existing security controls. The controls perform automated checks that evaluate certain AWS services and resources for compliance with a subset of the requirements defined by the framework.| May 29, 2025 +Updates to security controls| Security Hub CSPM rolled back the release of the following control in all AWS Regions: _[RDS.46] RDS DB instances should not be deployed in public subnets with routes to internet gateways_. Previously, this control supported the AWS Foundational Security Best Practices (FSBP) standard.| May 8, 2025 +New security controls| Security Hub CSPM released 9 new controls. Most of the controls support the [AWS Foundational Security Best Practices (FSBP)](https://docs.aws.amazon.com/securityhub/latest/userguide/fsbp-standard.html) standard. Some of the controls support [NIST SP 800-53 Rev. 5](https://docs.aws.amazon.com/securityhub/latest/userguide/nist-standard.html) requirements. @@ -22 +25 @@ New security controls| Security Hub released 9 new controls. Most of the control -New security controls| Security Hub released 24 new controls. Most of the controls support the [AWS Foundational Security Best Practices v1.0.0 (FSBP)](https://docs.aws.amazon.com/securityhub/latest/userguide/fsbp-standard.html) or [AWS Resource Tagging](https://docs.aws.amazon.com/securityhub/latest/userguide/standards-tagging.html) standard. Some of the controls support [NIST SP 800-53 Rev. 5](https://docs.aws.amazon.com/securityhub/latest/userguide/nist-standard.html) requirements. +New security controls| Security Hub CSPM released 24 new controls. Most of the controls support the [AWS Foundational Security Best Practices (FSBP)](https://docs.aws.amazon.com/securityhub/latest/userguide/fsbp-standard.html) or [AWS Resource Tagging](https://docs.aws.amazon.com/securityhub/latest/userguide/standards-tagging.html) standard. Some of the controls support [NIST SP 800-53 Rev. 5](https://docs.aws.amazon.com/securityhub/latest/userguide/nist-standard.html) requirements. @@ -29 +32 @@ New security controls| Security Hub released 24 new controls. Most of the contro -New security controls| Security Hub released four new controls for the [AWS Foundational Security Best Practices v1.0.0 standard](https://docs.aws.amazon.com/securityhub/latest/userguide/fsbp-standard.html). The controls are: +New security controls| Security Hub CSPM released four new controls for the [AWS Foundational Security Best Practices standard](https://docs.aws.amazon.com/securityhub/latest/userguide/fsbp-standard.html). The controls are: @@ -37,3 +40,3 @@ New security controls| Security Hub released four new controls for the [AWS Foun -Updates to security standards and controls| We removed the [RDS.18 security control](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-18) from the AWS Foundational Security Best Practices v1.0.0 standard and automated checks for NIST SP 800-53 Rev. 5 requirements. Since Amazon EC2-Classic networking was retired, Amazon Relational Database Service (Amazon RDS) instances can no longer be deployed outside a VPC. The control continues to be part of the [AWS Control Tower service-managed standard](https://docs.aws.amazon.com/securityhub/latest/userguide/service-managed-standard-aws-control-tower.html).| March 7, 2025 -Updates to control findings| Security Hub now generates `WARNING` findings for an enabled control if [resource recording](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-setup-prereqs.html#config-resource-recording) isn't turned on in AWS Config for the type of resource that the control checks. This can help you identify and address potential configuration gaps in your security control checks.| February 25, 2025 -New security controls| Security Hub released 11 new controls. The controls are: +Updates to security standards and controls| We removed the [RDS.18 security control](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-18) from the AWS Foundational Security Best Practices standard and automated checks for NIST SP 800-53 Rev. 5 requirements. Since Amazon EC2-Classic networking was retired, Amazon Relational Database Service (Amazon RDS) instances can no longer be deployed outside a VPC. The control continues to be part of the [AWS Control Tower service-managed standard](https://docs.aws.amazon.com/securityhub/latest/userguide/service-managed-standard-aws-control-tower.html).| March 7, 2025 +Updates to control findings| Security Hub CSPM now generates `WARNING` findings for an enabled control if [resource recording](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-setup-prereqs.html#config-resource-recording) isn't turned on in AWS Config for the type of resource that the control checks. This can help you identify and address potential configuration gaps in your security control checks.| February 25, 2025 +New security controls| Security Hub CSPM released 11 new controls. The controls are: @@ -54 +57 @@ New security controls| Security Hub released 11 new controls. The controls are: -New security controls| Security Hub released 37 new controls for the [AWS Resource Tagging Standard](https://docs.aws.amazon.com/securityhub/latest/userguide/standards-tagging.html). Security Hub also released the following new controls: +New security controls| Security Hub CSPM released 37 new controls for the [AWS Resource Tagging Standard](https://docs.aws.amazon.com/securityhub/latest/userguide/standards-tagging.html). Security Hub CSPM also released the following new controls: @@ -61,2 +64,2 @@ New security controls| Security Hub released 37 new controls for the [AWS Resour -New security control| Security Hub released [EC2.172 EC2 VPC Block Public Access settings should block internet gateway traffic](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-172).| January 15, 2025 -New security controls| The following new Security Hub controls are available. +New security control| Security Hub CSPM released [EC2.172 EC2 VPC Block Public Access settings should block internet gateway traffic](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-172).| January 15, 2025 +New security controls| The following new Security Hub CSPM controls are available. @@ -70,5 +73,5 @@ New security controls| The following new Security Hub controls are available. -Security Hub supports PCI DSS v4.0.1| Security Hub now supports v4.0.1 of the Payment Card Industry Data Security Standard (PCI DSS). For more information about the standard and the controls that apply to it, see [PCI DSS in Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/pci-standard.html).| December 11, 2024 -Security Hub receives GuardDuty attack sequence findings| Security Hub now receives attack sequence findings from Amazon GuardDuty Extended Threat Detection. Attack sequence finding details are available in the [Detection](https://docs.aws.amazon.com/securityhub/latest/userguide/asff-top-level-attributes.html#asff-detection) object of the AWS Security Finding Format (ASFF).| December 1, 2024 -Security Hub supported in new AWS Region| Security Hub is now available in the Asia Pacific (Malaysia) Region. Some security controls have Regional limitations. For a list of controls that aren't available in this Region, see [Regional limits on Security Hub controls](https://docs.aws.amazon.com/securityhub/latest/userguide/regions-controls.html).| November 22, 2024 -Changes to Config.1| Security Hub increased the severity of the Config.1 control from `MEDIUM` to `CRITICAL`, and added new status codes and status reasons for failed Config.1 findings. For more information about the changes, see the entry for November 20, 2024 in the [Change log for Security Hub controls](https://docs.aws.amazon.com/securityhub/latest/userguide/controls-change-log.html).| November 20, 2024 -New security controls| The following new Security Hub controls are available. These controls are part of AWS Foundational Security Best Practices v1.0.0 and NIST SP 800-53 Rev. 5, and they evaluate whether a virtual private cloud (VPC) that you manage has an interface VPC endpoint for an AWS service or AWS resource. +Security Hub CSPM supports PCI DSS v4.0.1| Security Hub CSPM now supports v4.0.1 of the Payment Card Industry Data Security Standard (PCI DSS). For more information about the standard and the controls that apply to it, see [PCI DSS in Security Hub CSPM](https://docs.aws.amazon.com/securityhub/latest/userguide/pci-standard.html).| December 11, 2024 +Security Hub CSPM receives GuardDuty attack sequence findings| Security Hub CSPM now receives attack sequence findings from Amazon GuardDuty Extended Threat Detection. Attack sequence finding details are available in the [Detection](https://docs.aws.amazon.com/securityhub/latest/userguide/asff-top-level-attributes.html#asff-detection) object of the AWS Security Finding Format (ASFF).| December 1, 2024 +Security Hub CSPM supported in new AWS Region| Security Hub CSPM is now available in the Asia Pacific (Malaysia) Region. Some security controls have Regional limitations. For a list of controls that aren't available in this Region, see [Regional limits on Security Hub CSPM controls](https://docs.aws.amazon.com/securityhub/latest/userguide/regions-controls.html).| November 22, 2024 +Changes to Config.1| Security Hub CSPM increased the severity of the Config.1 control from `MEDIUM` to `CRITICAL`, and added new status codes and status reasons for failed Config.1 findings. For more information about the changes, see the entry for November 20, 2024 in the [Change log for Security Hub CSPM controls](https://docs.aws.amazon.com/securityhub/latest/userguide/controls-change-log.html).| November 20, 2024 +New security controls| The following new Security Hub CSPM controls are available. These controls are part of AWS Foundational Security Best Practices and NIST SP 800-53 Rev. 5, and they evaluate whether a virtual private cloud (VPC) that you manage has an interface VPC endpoint for an AWS service or AWS resource. @@ -83 +86 @@ New security controls| The following new Security Hub controls are available. Th -New security controls| The following new Security Hub controls are available. +New security controls| The following new Security Hub CSPM controls are available. @@ -94 +97 @@ New security controls| The following new Security Hub controls are available. -New security controls| The following new Security Hub controls are available. +New security controls| The following new Security Hub CSPM controls are available. @@ -105 +108 @@ New security controls| The following new Security Hub controls are available. -New security controls| The following new Security Hub controls are available. +New security controls| The following new Security Hub CSPM controls are available. @@ -117,2 +120,2 @@ New security controls| The following new Security Hub controls are available. -New finding panel| The [new finding panel](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-viewing.html) on the Security Hub console helps you quickly take action on findings, review resource details and finding history, and find other pertinent information about a finding.| August 16, 2024 -Update to Config.1 control| The [Config.1 control](https://docs.aws.amazon.com/securityhub/latest/userguide/config-controls.html#config-1) checks whether AWS Config is enabled, uses the service-linked role, and records resources for enabled controls. Security Hub added a custom control parameter named `includeConfigServiceLinkedRoleCheck`. By setting this parameter to `false`, you can opt out of checking whether AWS Config uses the service-linked role.| August 15, 2024 +New finding panel| The [new finding panel](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-viewing.html) on the Security Hub CSPM console helps you quickly take action on findings, review resource details and finding history, and find other pertinent information about a finding.| August 16, 2024 +Update to Config.1 control| The [Config.1 control](https://docs.aws.amazon.com/securityhub/latest/userguide/config-controls.html#config-1) checks whether AWS Config is enabled, uses the service-linked role, and records resources for enabled controls. Security Hub CSPM added a custom control parameter named `includeConfigServiceLinkedRoleCheck`. By setting this parameter to `false`, you can opt out of checking whether AWS Config uses the service-linked role.| August 15, 2024 @@ -139 +142 @@ Select controls available in more Regions| The following controls are now availa -New security controls| The following new Security Hub controls are available: +New security controls| The following new Security Hub CSPM controls are available: @@ -152 +155 @@ New security controls| The following new Security Hub controls are available: -Release of CIS AWS Foundations Benchmark v3.0.0| Security Hub released [Center for Internet Security (CIS) AWS Foundations Benchmark v3.0.0](https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html). The release includes the following new controls, as well as mappings to several existing controls. +Release of CIS AWS Foundations Benchmark v3.0.0| Security Hub CSPM released [Center for Internet Security (CIS) AWS Foundations Benchmark v3.0.0](https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html). The release includes the following new controls, as well as mappings to several existing controls. @@ -163 +166 @@ Release of CIS AWS Foundations Benchmark v3.0.0| Security Hub released [Center f -[New security controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html)| The following new Security Hub controls are available: +[New security controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html)| The following new Security Hub CSPM controls are available: @@ -182,4 +185,4 @@ Release of CIS AWS Foundations Benchmark v3.0.0| Security Hub released [Center f -AWS Resource Tagging Standard| The [AWS Resource Tagging Standard](https://docs.aws.amazon.com/securityhub/latest/userguide/standards-tagging.html) from Security Hub is now generally available, along with new controls that apply to the standard.| April 30, 2024 -Update to existing managed policy| Security Hub updated the [AWS managed policy](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html) named `AmazonSecurityHubFullAccess` to get pricing details for AWS services and products.| April 24, 2024 -In-context configuration of control parameters| If you use central configuration, you can now configure [control parameters in context](https://docs.aws.amazon.com/securityhub/latest/userguide/central-configuration-in-context.html), from the details page of a control on the Security Hub console.| March 29, 2024 -Update to existing managed policy| Security Hub updated the [AWS managed policy](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html) named `AWSSecurityHubReadOnlyAccess` by adding a `Sid` field.| February 22, 2024 +AWS Resource Tagging Standard| The [AWS Resource Tagging Standard](https://docs.aws.amazon.com/securityhub/latest/userguide/standards-tagging.html) from Security Hub CSPM is now generally available, along with new controls that apply to the standard.| April 30, 2024 +Update to existing managed policy| Security Hub CSPM updated the [AWS managed policy](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html) named `AmazonSecurityHubFullAccess` to get pricing details for AWS services and products.| April 24, 2024 +In-context configuration of control parameters| If you use central configuration, you can now configure [control parameters in context](https://docs.aws.amazon.com/securityhub/latest/userguide/central-configuration-in-context.html), from the details page of a control on the Security Hub CSPM console.| March 29, 2024 +Update to existing managed policy| Security Hub CSPM updated the [AWS managed policy](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html) named `AWSSecurityHubReadOnlyAccess` by adding a `Sid` field.| February 22, 2024 @@ -187,2 +190,2 @@ New security control| The control [[Macie.2] Macie automated sensitive data disc -Security Hub available in Canada West (Calgary)| Security Hub is now available in Canada West (Calgary). All Security Hub features are now available in this Region, with the exception of certain security controls. For more information, see [ Availability of controls by Region](https://docs.aws.amazon.com/securityhub/latest/userguide/regions-controls.html).| December 20, 2023 -New security controls| The following new Security Hub controls are available: +Security Hub CSPM available in Canada West (Calgary)| Security Hub CSPM is now available in Canada West (Calgary). All Security Hub CSPM features are now available in this Region, with the exception of certain security controls. For more information, see [ Availability of controls by Region](https://docs.aws.amazon.com/securityhub/latest/userguide/regions-controls.html).| December 20, 2023 +New security controls| The following new Security Hub CSPM controls are available: @@ -207,7 +210,7 @@ New security controls| The following new Security Hub controls are available: -[Finding enrichment](https://docs.aws.amazon.com/securityhub/latest/userguide/finding-view-details.html)| Security Hub added the new finding fields `AwsAccountName`, `ApplicationArn`, and `ApplicationName` to the AWS Security Finding Format (ASFF).| November 27, 2023 -[Enhancements to Summary dashboard](https://docs.aws.amazon.com/securityhub/latest/userguide/dashboard.html)| You can now access more dashboard widgets on the **Summary** page of the Security Hub console, save dashboard filter sets to quickly focus on specific security issues, and customize the dashboard layout.| November 27, 2023 -[Central configuration](https://docs.aws.amazon.com/securityhub/latest/userguide/central-configuration-intro.html)| Central configuration is now available. With central configuration, the Security Hub delegated administrator can configure Security Hub, standards, and controls across multiple organization accounts, organizational units (OUs), and Regions.| November 27, 2023 -[Updates to managed policy](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-awssecurityhubservicerolepolicy)| Security Hub added new permissions to the `AWSSecurityHubServiceRolePolicy` managed policy that allow Security Hub to read and update customizable security control properties.| November 26, 2023 -[Custom control parameters](https://docs.aws.amazon.com/securityhub/latest/userguide/custom-control-parameters.html)| You can now customize parameter values for select Security Hub controls. This can make findings for a specific control more relevant to your business requirements and security expectations.| November 26, 2023 -[Updates to managed policies](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html)| Security Hub updated the `AWSSecurityHubFullAccess` and `AWSSecurityHubOrganizationsAccess` managed policies that permit you to use, respectively, Security Hub features and the integration with AWS Organizations.| November 16, 2023 -[Existing security controls added to Service-Managed Standard: AWS Control Tower](https://docs.aws.amazon.com/securityhub/latest/userguide/service-managed-standard-aws-control-tower.html)| The following existing Security Hub controls have been added to Service-Managed Standard: AWS Control Tower. +[Finding enrichment](https://docs.aws.amazon.com/securityhub/latest/userguide/finding-view-details.html)| Security Hub CSPM added the new finding fields `AwsAccountName`, `ApplicationArn`, and `ApplicationName` to the AWS Security Finding Format (ASFF).| November 27, 2023 +[Enhancements to Summary dashboard](https://docs.aws.amazon.com/securityhub/latest/userguide/dashboard.html)| You can now access more dashboard widgets on the **Summary** page of the Security Hub CSPM console, save dashboard filter sets to quickly focus on specific security issues, and customize the dashboard layout.| November 27, 2023 +[Central configuration](https://docs.aws.amazon.com/securityhub/latest/userguide/central-configuration-intro.html)| Central configuration is now available. With central configuration, the Security Hub CSPM delegated administrator can configure Security Hub CSPM, standards, and controls across multiple organization accounts, organizational units (OUs), and Regions.| November 27, 2023 +[Updates to managed policy](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-awssecurityhubservicerolepolicy)| Security Hub CSPM added new permissions to the `AWSSecurityHubServiceRolePolicy` managed policy that allow Security Hub CSPM to read and update customizable security control properties.| November 26, 2023 +[Custom control parameters](https://docs.aws.amazon.com/securityhub/latest/userguide/custom-control-parameters.html)| You can now customize parameter values for select Security Hub CSPM controls. This can make findings for a specific control more relevant to your business requirements and security expectations.| November 26, 2023 +[Updates to managed policies](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html)| Security Hub CSPM updated the `AWSSecurityHubFullAccess` and `AWSSecurityHubOrganizationsAccess` managed policies that permit you to use, respectively, Security Hub CSPM features and the integration with AWS Organizations.| November 16, 2023 +[Existing security controls added to Service-Managed Standard: AWS Control Tower](https://docs.aws.amazon.com/securityhub/latest/userguide/service-managed-standard-aws-control-tower.html)| The following existing Security Hub CSPM controls have been added to Service-Managed Standard: AWS Control Tower. @@ -238,2 +241,2 @@ New security controls| The following new Security Hub controls are available: -[Updates to managed policy](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-awssecurityhubservicerolepolicy)| Security Hub added a new tagging permission to the `AWSSecurityHubServiceRolePolicy` managed policy that allows Security Hub to read resource tags related to findings.| November 7, 2023 -[New security controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html)| The following new Security Hub controls are available: +[Updates to managed policy](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-awssecurityhubservicerolepolicy)| Security Hub CSPM added a new tagging permission to the `AWSSecurityHubServiceRolePolicy` managed policy that allows Security Hub CSPM to read resource tags related to findings.| November 7, 2023 +[New security controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html)| The following new Security Hub CSPM controls are available: @@ -262,2 +265,2 @@ New security controls| The following new Security Hub controls are available: -[Updates to managed policy](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-awssecurityhubservicerolepolicy)| Security Hub added new Organizations actions to the `AWSSecurityHubServiceRolePolicy` managed policy that allow Security Hub to retrieve account and organizational unit (OU) information. We also added new Security Hub actions that allow Security Hub to read and update service configurations, including standards and controls.| September 27, 2023 -[Existing security controls added to Service-Managed Standard: AWS Control Tower](https://docs.aws.amazon.com/securityhub/latest/userguide/service-managed-standard-aws-control-tower.html)| The following existing Security Hub controls have been added to Service-Managed Standard: AWS Control Tower. +[Updates to managed policy](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-awssecurityhubservicerolepolicy)| Security Hub CSPM added new Organizations actions to the `AWSSecurityHubServiceRolePolicy` managed policy that allow Security Hub CSPM to retrieve account and organizational unit (OU) information. We also added new Security Hub CSPM actions that allow Security Hub CSPM to read and update service configurations, including standards and controls.| September 27, 2023 +[Existing security controls added to Service-Managed Standard: AWS Control Tower](https://docs.aws.amazon.com/securityhub/latest/userguide/service-managed-standard-aws-control-tower.html)| The following existing Security Hub CSPM controls have been added to Service-Managed Standard: AWS Control Tower. @@ -279,4 +282,4 @@ New security controls| The following new Security Hub controls are available: -[Consolidated controls view and consolidated control findings available in AWS GovCloud (US)](https://docs.aws.amazon.com/securityhub/latest/userguide/controls-findings-create-update.html#consolidated-control-findings)| Consolidated controls view and consolidated control findings are now available in the AWS GovCloud (US) Region. The **Controls** page of the Security Hub console shows all your controls across standards. Each control has the same control ID across standards. When you turn on consolidated control findings, you receive a single finding per security check even when a control applies to multiple enabled standards.| September 6, 2023 -[Consolidated controls view and consolidated control findings available in China Regions](https://docs.aws.amazon.com/securityhub/latest/userguide/controls-findings-create-update.html#consolidated-control-findings)| Consolidated controls view and consolidated control findings are now available in the China Regions. The **Controls** page of the Security Hub console shows all your controls across standards. Each control has the same control ID across standards. When you turn on consolidated control findings, you receive a single finding per security check even when a control applies to multiple enabled standards.| August 28, 2023 -[Security Hub available in Israel (Tel Aviv) Region](https://docs.aws.amazon.com/general/latest/gr/sechub.html)| Security Hub is now available in Israel (Tel Aviv). All Security Hub features are now available in this Region, with the exception of certain security controls. For more information, see [ Availability of controls by Region](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html#securityhub-regions-control-support).| August 8, 2023 -[New security controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html)| The following new Security Hub controls are available: +[Consolidated controls view and consolidated control findings available in AWS GovCloud (US)](https://docs.aws.amazon.com/securityhub/latest/userguide/controls-findings-create-update.html#consolidated-control-findings)| Consolidated controls view and consolidated control findings are now available in the AWS GovCloud (US) Region. The **Controls** page of the Security Hub CSPM console shows all your controls across standards. Each control has the same control ID across standards. When you turn on consolidated control findings, you receive a single finding per security check even when a control applies to multiple enabled standards.| September 6, 2023 +[Consolidated controls view and consolidated control findings available in China Regions](https://docs.aws.amazon.com/securityhub/latest/userguide/controls-findings-create-update.html#consolidated-control-findings)| Consolidated controls view and consolidated control findings are now available in the China Regions. The **Controls** page of the Security Hub CSPM console shows all your controls across standards. Each control has the same control ID across standards. When you turn on consolidated control findings, you receive a single finding per security check even when a control applies to multiple enabled standards.| August 28, 2023 +[Security Hub CSPM available in Israel (Tel Aviv) Region](https://docs.aws.amazon.com/general/latest/gr/sechub.html)| Security Hub CSPM is now available in Israel (Tel Aviv). All Security Hub CSPM features are now available in this Region, with the exception of certain security controls. For more information, see [ Availability of controls by Region](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html#securityhub-regions-control-support).| August 8, 2023 +[New security controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html)| The following new Security Hub CSPM controls are available: @@ -299,3 +302,3 @@ New security controls| The following new Security Hub controls are available: -[Automation rules](https://docs.aws.amazon.com/securityhub/latest/userguide/automation-rules.html)| Security Hub now offers automation rules that automatically update findings based on criteria that you specify.| June 13, 2023 -[New third party integration](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html)| Snyk is a new third-party integration that sends findings to Security Hub.| June 12, 2023 -[Existing security controls added to Service-Managed Standard: AWS Control Tower](https://docs.aws.amazon.com/securityhub/latest/userguide/service-managed-standard-aws-control-tower.html)| The following existing Security Hub controls have been added to Service-Managed Standard: AWS Control Tower. +[Automation rules](https://docs.aws.amazon.com/securityhub/latest/userguide/automation-rules.html)| Security Hub CSPM now offers automation rules that automatically update findings based on criteria that you specify.| June 13, 2023 +[New third party integration](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html)| Snyk is a new third-party integration that sends findings to Security Hub CSPM.| June 12, 2023 +[Existing security controls added to Service-Managed Standard: AWS Control Tower](https://docs.aws.amazon.com/securityhub/latest/userguide/service-managed-standard-aws-control-tower.html)| The following existing Security Hub CSPM controls have been added to Service-Managed Standard: AWS Control Tower. @@ -315 +318 @@ New security controls| The following new Security Hub controls are available: -[New security controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html)| The following new Security Hub controls are available: +[New security controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html)| The following new Security Hub CSPM controls are available: @@ -325,3 +328,3 @@ New security controls| The following new Security Hub controls are available: -[Security Hub available in Asia Pacific (Melbourne)](https://docs.aws.amazon.com/general/latest/gr/sechub.html)| Security Hub is now available in Asia Pacific (Melbourne). All Security Hub features are now available in this Region, with the exception of certain security controls. For more information, see [ Availability of controls by Region](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html#securityhub-regions-control-support).| May 25, 2023 -[Finding history](https://docs.aws.amazon.com/securityhub/latest/userguide/finding-view-details.html#finding-history)| Security Hub can now track the history of a finding during the last 90 days.| May 4, 2023 -[New security controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html)| The following new Security Hub controls are available: +[Security Hub CSPM available in Asia Pacific (Melbourne)](https://docs.aws.amazon.com/general/latest/gr/sechub.html)| Security Hub CSPM is now available in Asia Pacific (Melbourne). All Security Hub CSPM features are now available in this Region, with the exception of certain security controls. For more information, see [ Availability of controls by Region](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html#securityhub-regions-control-support).| May 25, 2023 +[Finding history](https://docs.aws.amazon.com/securityhub/latest/userguide/finding-view-details.html#finding-history)| Security Hub CSPM can now track the history of a finding during the last 90 days.| May 4, 2023 +[New security controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html)| The following new Security Hub CSPM controls are available: @@ -336,3 +339,3 @@ New security controls| The following new Security Hub controls are available: -[Security Hub available in new AWS Regions](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html#securityhub-regions-control-support)| Security Hub is now available in Asia Pacific (Hyderabad), Europe (Spain), and Europe (Zurich). Limits exist on which controls are available in these Regions.| March 21, 2023 -[Update to managed policy](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-awssecurityhubservicerolepolicy)| Security Hub has updated an existing permission in the `AWSSecurityHubServiceRolePolicy` managed policy.| March 17, 2023 -[New security controls for NIST 800-53 standard](https://docs.aws.amazon.com/securityhub/latest/userguide/nist-standard.html)| Security Hub has added the following security controls, which are applicable to the NIST 800-53 standard: +[Security Hub CSPM available in new AWS Regions](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html#securityhub-regions-control-support)| Security Hub CSPM is now available in Asia Pacific (Hyderabad), Europe (Spain), and Europe (Zurich). Limits exist on which controls are available in these Regions.| March 21, 2023 +[Update to managed policy](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-awssecurityhubservicerolepolicy)| Security Hub CSPM has updated an existing permission in the `AWSSecurityHubServiceRolePolicy` managed policy.| March 17, 2023 +[New security controls for NIST 800-53 standard](https://docs.aws.amazon.com/securityhub/latest/userguide/nist-standard.html)| Security Hub CSPM has added the following security controls, which are applicable to the NIST 800-53 standard: @@ -352,3 +355,3 @@ New security controls| The following new Security Hub controls are available: -[National Institute of Standards and Technology (NIST) 800-53 Rev. 5](https://docs.aws.amazon.com/securityhub/latest/userguide/nist-standard.html)| Security Hub now supports the NIST 800-53 Rev. 5 standard with more than 200 applicable security controls.| February 28, 2023 -[Consolidated controls view and control findings](https://docs.aws.amazon.com/securityhub/latest/userguide/controls-findings-create-update.html#consolidated-control-findings)| With the release of consolidated controls view, the **Controls** page of the Security Hub console shows all your controls across standards. Each control has the same control ID across standards. When you turn on consolidated control findings, you receive a single finding per security check even when a control applies to multiple enabled standards.| February 23, 2023 -[New security controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html)| The following new Security Hub controls are available. Some controls have [Regional limitations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html#securityhub-regions-control-support). +[National Institute of Standards and Technology (NIST) 800-53 Rev. 5](https://docs.aws.amazon.com/securityhub/latest/userguide/nist-standard.html)| Security Hub CSPM now supports the NIST 800-53 Rev. 5 standard with more than 200 applicable security controls.| February 28, 2023 +[Consolidated controls view and control findings](https://docs.aws.amazon.com/securityhub/latest/userguide/controls-findings-create-update.html#consolidated-control-findings)| With the release of consolidated controls view, the **Controls** page of the Security Hub CSPM console shows all your controls across standards. Each control has the same control ID across standards. When you turn on consolidated control findings, you receive a single finding per security check even when a control applies to multiple enabled standards.| February 23, 2023 +[New security controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html)| The following new Security Hub CSPM controls are available. Some controls have [Regional limitations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html#securityhub-regions-control-support). @@ -365,18 +368,18 @@ New security controls| The following new Security Hub controls are available: -[New ASFF fields](https://docs.aws.amazon.com/securityhub/latest/userguide/controls-findings-create-update.html#control-findings-asff-productfields)| Security Hub has added ProductFields.ArchivalReasons:0/Description and ProductFields.ArchivalReasons:0/ReasonCode to the AWS Security Finding Format (ASFF).| February 8, 2023 -[New ASFF fields](https://docs.aws.amazon.com/securityhub/latest/userguide/asff-top-level-attributes.html#asff-compliance)| Security Hub has added Compliance.AssociatedStandards and Compliance.SecurityControlId to the AWS Security Finding Format (ASFF).| January 31, 2023 -[Vulnerability details now available](https://docs.aws.amazon.com/securityhub/latest/userguide/finding-view-details.html)| You can now see vulnerability details in the Security Hub console for findings that Amazon Inspector sends to Security Hub.| January 14, 2023 -[Security Hub is available in Middle East (UAE)](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html)| Security Hub is now available in Middle East (UAE). Some controls have Regional limits.| January 12, 2023 -[Added third-party integration with MetricStream](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html)| Security Hub now supports a third-party integration with MetricStream in all Regions except China and AWS GovCloud (US).| January 11, 2023 -[Increased organizational account limit](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub_limits.html)| Security Hub now supports up to 11,000 member accounts for each Security Hub administrator account per Region.| December 27, 2022 -[ElasticBeanstalk.3 rolled back](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html)| Security Hub rolled back the control **[ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch** from the FSBP standard in all Regions.| December 21, 2022 -[Security Hub adds new security controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html)| New Security Hub controls are available to customers who have enabled the FSBP standard. Some controls have [Regional limitations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html#securityhub-regions-control-support).| December 15, 2022 -[Guidance on upcoming features](https://docs.aws.amazon.com/securityhub/latest/userguide/prepare-upcoming-features.html)| Security Hub is planning to release two new features: consolidated controls view and consolidated control findings. These upcoming features may impact existing workflows that rely on control finding fields and values.| December 9, 2022 -[Amazon Security Lake integration now available](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-internal-providers.html#integration-security-lake)| Security Lake now integrates with Security Hub by receiving Security Hub findings.| November 29, 2022 -[Support for Service-Managed Standard: AWS Control Tower](https://docs.aws.amazon.com/securityhub/latest/userguide/service-managed-standard-aws-control-tower.html)| Security Hub supports a new security standard called Service-Managed Standard: AWS Control Tower. AWS Control Tower manages this standard.| November 28, 2022 -[CIS AWS Foundations Benchmark v1.4.0 now available in China Regions](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls-1.4.0.html)| Security Hub now supports CIS AWS Foundations Benchmark v1.4.0 in the China Regions.| November 18, 2022 -[Jira Service Management Cloud integration now available](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html#integration-atlassian-jira-service-management-cloud)| Jira Service Management Cloud now receives Security Hub findings in all available Regions, except the China Regions.| November 17, 2022 -[AWS IoT Device Defender integration now available](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-internal-providers.html#integration-iot-device-defender)| AWS IoT Device Defender now sends findings to Security Hub in all available Regions.| November 17, 2022 -[Support for CIS AWS Foundations Benchmark v1.4.0](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls-1.4.0.html)| Security Hub now provides security controls that support CIS AWS Foundations Benchmark v1.4.0. This standard is available in all available Regions, except the China Regions.| November 9, 2022 -[Support for Security Hub announcements in AWS GovCloud (US)](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-announcements.html)| You can now subscribe to Security Hub announcements with Amazon Simple Notification Service (Amazon SNS) in AWS GovCloud (US-East) and AWS GovCloud (US-West) to receive notifications about Security Hub.| October 3, 2022 -[AWS Security Hub adds a new security control](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html)| The new Security Hub control **AutoScaling.9** is available to customers who have enabled the FSBP standard. Controls may have [Regional limitations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html#securityhub-regions-control-support).| September 1, 2022 -[Subscribe to Security Hub announcements](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-announcements.html)| You can now subscribe to Security Hub announcements with Amazon Simple Notification Service (Amazon SNS) to receive notifications about Security Hub.| August 29, 2022 +[New ASFF fields](https://docs.aws.amazon.com/securityhub/latest/userguide/controls-findings-create-update.html#control-findings-asff-productfields)| Security Hub CSPM has added ProductFields.ArchivalReasons:0/Description and ProductFields.ArchivalReasons:0/ReasonCode to the AWS Security Finding Format (ASFF).| February 8, 2023 +[New ASFF fields](https://docs.aws.amazon.com/securityhub/latest/userguide/asff-top-level-attributes.html#asff-compliance)| Security Hub CSPM has added Compliance.AssociatedStandards and Compliance.SecurityControlId to the AWS Security Finding Format (ASFF).| January 31, 2023 +[Vulnerability details now available](https://docs.aws.amazon.com/securityhub/latest/userguide/finding-view-details.html)| You can now see vulnerability details in the Security Hub CSPM console for findings that Amazon Inspector sends to Security Hub CSPM.| January 14, 2023 +[Security Hub CSPM is available in Middle East (UAE)](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html)| Security Hub CSPM is now available in Middle East (UAE). Some controls have Regional limits.| January 12, 2023 +[Added third-party integration with MetricStream](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html)| Security Hub CSPM now supports a third-party integration with MetricStream in all Regions except China and AWS GovCloud (US).| January 11, 2023 +[Increased organizational account limit](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub_limits.html)| Security Hub CSPM now supports up to 11,000 member accounts for each Security Hub CSPM administrator account per Region.| December 27, 2022 +[ElasticBeanstalk.3 rolled back](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html)| Security Hub CSPM rolled back the control **[ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch** from the FSBP standard in all Regions.| December 21, 2022 +[Security Hub CSPM adds new security controls](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html)| New Security Hub CSPM controls are available to customers who have enabled the FSBP standard. Some controls have [Regional limitations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html#securityhub-regions-control-support).| December 15, 2022 +[Guidance on upcoming features](https://docs.aws.amazon.com/securityhub/latest/userguide/prepare-upcoming-features.html)| Security Hub CSPM is planning to release two new features: consolidated controls view and consolidated control findings. These upcoming features may impact existing workflows that rely on control finding fields and values.| December 9, 2022 +[Amazon Security Lake integration now available](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-internal-providers.html#integration-security-lake)| Security Lake now integrates with Security Hub CSPM by receiving Security Hub CSPM findings.| November 29, 2022 +[Support for Service-Managed Standard: AWS Control Tower](https://docs.aws.amazon.com/securityhub/latest/userguide/service-managed-standard-aws-control-tower.html)| Security Hub CSPM supports a new security standard called Service-Managed Standard: AWS Control Tower. AWS Control Tower manages this standard.| November 28, 2022 +[CIS AWS Foundations Benchmark v1.4.0 now available in China Regions](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls-1.4.0.html)| Security Hub CSPM now supports CIS AWS Foundations Benchmark v1.4.0 in the China Regions.| November 18, 2022 +[Jira Service Management Cloud integration now available](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html#integration-atlassian-jira-service-management-cloud)| Jira Service Management Cloud now receives Security Hub CSPM findings in all available Regions, except the China Regions.| November 17, 2022 +[AWS IoT Device Defender integration now available](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-internal-providers.html#integration-iot-device-defender)| AWS IoT Device Defender now sends findings to Security Hub CSPM in all available Regions.| November 17, 2022 +[Support for CIS AWS Foundations Benchmark v1.4.0](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls-1.4.0.html)| Security Hub CSPM now provides security controls that support CIS AWS Foundations Benchmark v1.4.0. This standard is available in all available Regions, except the China Regions.| November 9, 2022 +[Support for Security Hub CSPM announcements in AWS GovCloud (US)](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-announcements.html)| You can now subscribe to Security Hub CSPM announcements with Amazon Simple Notification Service (Amazon SNS) in AWS GovCloud (US-East) and AWS GovCloud (US-West) to receive notifications about Security Hub CSPM.| October 3, 2022 +[AWS Security Hub Cloud Security Posture Management (CSPM) adds a new security control](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html)| The new Security Hub CSPM control **AutoScaling.9** is available to customers who have enabled the FSBP standard. Controls may have [Regional limitations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html#securityhub-regions-control-support).| September 1, 2022 +[Subscribe to Security Hub CSPM announcements](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-announcements.html)| You can now subscribe to Security Hub CSPM announcements with Amazon Simple Notification Service (Amazon SNS) to receive notifications about Security Hub CSPM.| August 29, 2022 @@ -384,7 +387,7 @@ New security controls| The following new Security Hub controls are available: -[New third-party product integrations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html)| Fortinet - FortiCNP is a third-party integration that receives Security Hub findings, and JFrog is a third-party integration that sends findings to Security Hub.| July 26, 2022