AWS securityhub medium security documentation change

Service: securityhub · 2025-07-01 · Security-related medium

File: securityhub/latest/userguide/controls-change-log.md

Summary

Updated security controls: removed password symbol/expiration requirements, modified RDS/SageMaker controls

Security assessment

The SageMaker.8 control update explicitly addresses end-of-support platforms (potential security risk if used). Other changes reflect compliance alignment but lack direct security implications.

Diff

diff --git a/securityhub/latest/userguide/controls-change-log.md b/securityhub/latest/userguide/controls-change-log.md
index 6289c5d68..f3e45c762 100644
--- a//securityhub/latest/userguide/controls-change-log.md
+++ b//securityhub/latest/userguide/controls-change-log.md
@@ -12,0 +13,4 @@ Date of change | Control ID and title | Description of change
+June 30, 2025 | [[IAM.13] Ensure IAM password policy requires at least one symbol](./iam-controls.html#iam-13) | Security Hub CSPM removed this control from the [PCI DSS v4.0.1 standard](./pci-standard.html). PCI DSS v4.0.1 doesn't explicitly require the use of symbols in passwords.  
+June 30, 2025 | [[IAM.17] Ensure IAM password policy expires passwords within 90 days or less](./iam-controls.html#iam-17) | Security Hub CSPM removed this control from the [NIST SP 800-171 Revision 2 standard](./standards-reference-nist-800-171.html). NIST SP 800-171 Revision 2 doesn't explicitly require password expiration periods of 90 days or less.  
+June 30, 2025 | [[RDS.16] Aurora DB clusters should be configured to copy tags to DB snapshots](./rds-controls.html#rds-16) | Security Hub CSPM changed the title of this control. The new title more accurately reflects that the control checks only Amazon Aurora DB clusters. Previously, the title of this control was: _RDS DB clusters should be configured to copy tags to snapshots_.  
+June 30, 2025 | [[SageMaker.8] SageMaker notebook instances should run on supported platforms](./sagemaker-controls.html#sagemaker-8) | This control checks whether an Amazon SageMaker AI notebook instance is configured to run on a supported platform, based on the platform identifier specified for the notebook instance. Security Hub CSPM no longer supports `notebook-al2-v1` and `notebook-al2-v2` as parameter values for this control. Notebook instances that run on these platforms reached end of support on June 30, 2025.