AWS securityhub documentation change
Summary
Updated documentation to reflect rebranding of 'Security Hub' to 'Security Hub CSPM' (Cloud Security Posture Management) throughout the document, including console references, API calls, and CLI commands. Added CSPM terminology to clarify administrative roles and service behavior.
Security assessment
The changes emphasize Cloud Security Posture Management (CSPM) features but do not address specific vulnerabilities or security incidents. The updates enhance documentation about existing security posture management capabilities rather than patching issues.
Diff
diff --git a/securityhub/latest/userguide/update-policy.md b/securityhub/latest/userguide/update-policy.md index 98066b408..34d8160c6 100644 --- a//securityhub/latest/userguide/update-policy.md +++ b//securityhub/latest/userguide/update-policy.md @@ -3 +3 @@ -[Documentation](/index.html)[AWS Security Hub](/securityhub/index.html)[User Guide](what-is-securityhub.html) +[Documentation](/index.html)[AWS Security Hub](/securityhub/index.html)[ User Guide ](what-is-security-hub-adv.html) @@ -7 +7 @@ -After creating a configuration policy, the delegated AWS Security Hub administrator account can update the policy details and policy associations. When policy details are updated, accounts that are associated with the configuration policy automatically start using the updated policy. +After creating a configuration policy, the delegated AWS Security Hub Cloud Security Posture Management (CSPM) administrator account can update the policy details and policy associations. When policy details are updated, accounts that are associated with the configuration policy automatically start using the updated policy. @@ -9 +9 @@ After creating a configuration policy, the delegated AWS Security Hub administra -For background information about the benefits of central configuration and how it works, see [Understanding central configuration in Security Hub](./central-configuration-intro.html). +For background information about the benefits of central configuration and how it works, see [Understanding central configuration in Security Hub CSPM](./central-configuration-intro.html). @@ -13 +13 @@ The delegated administrator can update the following policy settings: - * Enable or disable Security Hub. + * Enable or disable Security Hub CSPM. @@ -17 +17 @@ The delegated administrator can update the following policy settings: - * Indicate which [security controls](./securityhub-controls-reference.html) are enabled across enabled standards. You can do this by providing a list of specific controls that should be enabled, and Security Hub disables all other controls, including new controls when they are released. Alternatively, you can provide a list of specific controls that should be disabled, and Security Hub enables all other controls, including new controls when they are released. + * Indicate which [security controls](./securityhub-controls-reference.html) are enabled across enabled standards. You can do this by providing a list of specific controls that should be enabled, and Security Hub CSPM disables all other controls, including new controls when they are released. Alternatively, you can provide a list of specific controls that should be disabled, and Security Hub CSPM enables all other controls, including new controls when they are released. @@ -28 +28 @@ Choose your preferred method, and follow the steps to update a configuration pol -If you use central configuration, Security Hub automatically disables controls that involve global resources in all Regions except the home Region. Other controls that you choose to enable though a configuration policy are enabled in all Regions where they are available. To limit findings for these controls to just one Region, you can update your AWS Config recorder settings and turn off global resource recording in all Regions except the home Region. +If you use central configuration, Security Hub CSPM automatically disables controls that involve global resources in all Regions except the home Region. Other controls that you choose to enable though a configuration policy are enabled in all Regions where they are available. To limit findings for these controls to just one Region, you can update your AWS Config recorder settings and turn off global resource recording in all Regions except the home Region. @@ -30 +30 @@ If you use central configuration, Security Hub automatically disables controls t -If an enabled control that involves global resources isn't supported in the home Region, Security Hub tries to enable the control in one linked Region where the control is supported. With central configuration, you lack coverage for a control that isn't available in the home Region or any of the linked Regions. +If an enabled control that involves global resources isn't supported in the home Region, Security Hub CSPM tries to enable the control in one linked Region where the control is supported. With central configuration, you lack coverage for a control that isn't available in the home Region or any of the linked Regions. @@ -39 +39 @@ Console - 1. Open the AWS Security Hub console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). + 1. Open the AWS Security Hub Cloud Security Posture Management (CSPM) console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). @@ -41 +41 @@ Console -Sign in using the credentials of the delegated Security Hub administrator account in the home Region. +Sign in using the credentials of the delegated Security Hub CSPM administrator account in the home Region. @@ -63 +63 @@ API - 1. To update the settings in a configuration policy, invoke the [UpdateConfigurationPolicy](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateConfigurationPolicy.html) API from the Security Hub delegated administrator account in the home Region. + 1. To update the settings in a configuration policy, invoke the [UpdateConfigurationPolicy](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateConfigurationPolicy.html) API from the Security Hub CSPM delegated administrator account in the home Region. @@ -69 +69 @@ API - 4. To add new associations for this configuration policy, invoke the [StartConfigurationPolicyAssociation](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_StartConfigurationPolicyAssociation.html) API from the Security Hub delegated administrator account in the home Region. To remove one or more current associations, invoke the [StartConfigurationPolicyDisassociation](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_StartConfigurationPolicyDisassociation.html) API from the Security Hub delegated administrator account in the home Region. + 4. To add new associations for this configuration policy, invoke the [StartConfigurationPolicyAssociation](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_StartConfigurationPolicyAssociation.html) API from the Security Hub CSPM delegated administrator account in the home Region. To remove one or more current associations, invoke the [StartConfigurationPolicyDisassociation](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_StartConfigurationPolicyDisassociation.html) API from the Security Hub CSPM delegated administrator account in the home Region. @@ -80 +80 @@ API -When you invoke the `UpdateConfigurationPolicy` API, Security Hub performs a full list replacement for the `EnabledStandardIdentifiers`, `EnabledSecurityControlIdentifiers`, `DisabledSecurityControlIdentifiers`, and `SecurityControlCustomParameters` fields. Each time you invoke this API, provide the full list of standards that you want to enable and the full list of controls that you want to enable or disable and customize parameters for. +When you invoke the `UpdateConfigurationPolicy` API, Security Hub CSPM performs a full list replacement for the `EnabledStandardIdentifiers`, `EnabledSecurityControlIdentifiers`, `DisabledSecurityControlIdentifiers`, and `SecurityControlCustomParameters` fields. Each time you invoke this API, provide the full list of standards that you want to enable and the full list of controls that you want to enable or disable and customize parameters for. @@ -125 +125 @@ AWS CLI - 1. To update the settings in a configuration policy, run the [update-configuration-policy](https://docs.aws.amazon.com/cli/latest/reference/securityhub/update-configuration-policy.html) command from the Security Hub delegated administrator account in the home Region. + 1. To update the settings in a configuration policy, run the [update-configuration-policy](https://docs.aws.amazon.com/cli/latest/reference/securityhub/update-configuration-policy.html) command from the Security Hub CSPM delegated administrator account in the home Region. @@ -131 +131 @@ AWS CLI - 4. To add new associations for this configuration policy, run the [start-configuration-policy-association](https://docs.aws.amazon.com/cli/latest/reference/securityhub/start-configuration-policy-association.html) command from the Security Hub delegated administrator account in the home Region. To remove one or more current associations, run the [start-configuration-policy-disassociation](https://docs.aws.amazon.com/cli/latest/reference/securityhub/start-configuration-policy-association.html) command from the Security Hub delegated administrator account in the home Region. + 4. To add new associations for this configuration policy, run the [start-configuration-policy-association](https://docs.aws.amazon.com/cli/latest/reference/securityhub/start-configuration-policy-association.html) command from the Security Hub CSPM delegated administrator account in the home Region. To remove one or more current associations, run the [start-configuration-policy-disassociation](https://docs.aws.amazon.com/cli/latest/reference/securityhub/start-configuration-policy-association.html) command from the Security Hub CSPM delegated administrator account in the home Region. @@ -142 +142 @@ AWS CLI -When you run the `update-configuration-policy` command, Security Hub performs a full list replacement for the `EnabledStandardIdentifiers`, `EnabledSecurityControlIdentifiers`, `DisabledSecurityControlIdentifiers`, and `SecurityControlCustomParameters` fields. Each time you run this command, provide the full list of standards that you want to enable and the full list of controls that you want to enable or disable and customize parameters for. +When you run the `update-configuration-policy` command, Security Hub CSPM performs a full list replacement for the `EnabledStandardIdentifiers`, `EnabledSecurityControlIdentifiers`, `DisabledSecurityControlIdentifiers`, and `SecurityControlCustomParameters` fields. Each time you run this command, provide the full list of standards that you want to enable and the full list of controls that you want to enable or disable and customize parameters for. @@ -163 +163 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Reviewing policy status and details +Reviewing the status and details of configuration policies