AWS securityhub documentation change
Summary
Added [Lambda.7] control requiring AWS X-Ray active tracing for improved monitoring and compliance.
Security assessment
Introduces a logging/tracing control to help identify operational issues and compliance gaps, but does not address a specific disclosed vulnerability. Enhances security observability.
Diff
diff --git a/securityhub/latest/userguide/lambda-controls.md b/securityhub/latest/userguide/lambda-controls.md index 7afcfd079..bf913ac04 100644 --- a//securityhub/latest/userguide/lambda-controls.md +++ b//securityhub/latest/userguide/lambda-controls.md @@ -5 +5 @@ -[Lambda.1] Lambda function policies should prohibit public access[Lambda.2] Lambda functions should use supported runtimes[Lambda.3] Lambda functions should be in a VPC[Lambda.5] VPC Lambda functions should operate in multiple Availability Zones[Lambda.6] Lambda functions should be tagged +[Lambda.1] Lambda function policies should prohibit public access[Lambda.2] Lambda functions should use supported runtimes[Lambda.3] Lambda functions should be in a VPC[Lambda.5] VPC Lambda functions should operate in multiple Availability Zones[Lambda.6] Lambda functions should be tagged[Lambda.7] Lambda functions should have AWS X-Ray active tracing enabled @@ -160,0 +161,28 @@ To add tags to a Lambda function, see [Using tags on Lambda functions](https://d +## [Lambda.7] Lambda functions should have AWS X-Ray active tracing enabled + +**Related requirements:** NIST.800-53.r5 CA-7 + +**Category:** Identify > Logging + +**Severity:** Low + +**Resource type:** `AWS::Lambda::Function` + +**AWS Config rule:** [lambda-function-xray-enabled](https://docs.aws.amazon.com/config/latest/developerguide/lambda-function-xray-enabled.html) + +**Schedule type:** Change triggered + +**Parameters:** None + +This control checks whether active tracing with AWS X-Ray is enabled for an AWS Lambda function. The control fails if active tracing with X-Ray is disabled for the Lambda function. + +AWS X-Ray can provide tracing and monitoring capabilities for AWS Lambda functions, which can save time and effort debugging and operating Lambda functions. It can help you diagnose errors and identify performance bottlenecks, slowdowns, and timeouts by breaking down latency for Lambda functions. It can also help with data privacy and compliance requirements. If you enable active tracing for a Lambda function, X-Ray provides a holistic view of data flow and processing within the Lambda function, which can help you identify potential security vulnerabilities or non-compliant data handling practices. This visibility can help you maintain data integrity, confidentiality, and compliance with relevant regulations. + +###### Note + +AWS X-Ray tracing is currently not supported for Lambda functions with Amazon Managed Streaming for Apache Kafka (Amazon MSK), self-managed Apache Kafka, Amazon MQ with ActiveMQ and RabbitMQ, or Amazon DocumentDB event source mappings. + +### Remediation + +For information about enabling active tracing for an AWS Lambda function, see [Visualize Lambda function invocations using AWS X-Ray](https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html) in the _AWS Lambda Developer Guide_. +