AWS solutions documentation change
Summary
Updated solution references from SHARR to ASR across multiple sections including log groups, orchestrator names, and remediation entries
Security assessment
Changes reflect branding/naming updates (SHARR to ASR) rather than security fixes. Documentation maintains existing security guidance but does not introduce new security features or address vulnerabilities.
Diff
diff --git a/solutions/latest/automated-security-response-on-aws/known-issue-resolution.md b/solutions/latest/automated-security-response-on-aws/known-issue-resolution.md index 30528ccfa..76fca5a86 100644 --- a//solutions/latest/automated-security-response-on-aws/known-issue-resolution.md +++ b//solutions/latest/automated-security-response-on-aws/known-issue-resolution.md @@ -9 +9 @@ -**Resolution:** Check for an error message in the CloudFormation resources/events section indicating log groups already exist. The SHARR deployment templates allow reuse of existing log groups. Verify that you have selected reuse. +**Resolution:** Check for an error message in the CloudFormation resources/events section indicating log groups already exist. The ASR deployment templates allow reuse of existing log groups. Verify that you have selected reuse. @@ -19 +19 @@ - * **Issue:** Immediately after deploying, the **SO0111-SHARR-Orchestrator** is failing in the Get Automation Document State with a 502 error: _"`Lambda was unable to decrypt the environment variables because KMS access was denied. Please check the function’s KMS key settings. KMS Exception: UnrecognizedClientExceptionKMS Message: The security token included in the request is invalid. (Service: AWSLambda; Status Code: 502; Error Code: KMSAccessDeniedException; Request ID: …`"_ + * **Issue:** Immediately after deploying, the **SO0111-ASR-Orchestrator** is failing in the Get Automation Document State with a 502 error: _"`Lambda was unable to decrypt the environment variables because KMS access was denied. Please check the function’s KMS key settings. KMS Exception: UnrecognizedClientExceptionKMS Message: The security token included in the request is invalid. (Service: AWSLambda; Status Code: 502; Error Code: KMSAccessDeniedException; Request ID: …`"_ @@ -25 +25 @@ -**Resolution:** Check the notes of the finding for reasons why it was not remediated. A common cause is that the finding has no automated remediation. At this time there is no way to provide direct feedback to the user when no remediation exists other than via the notes. Review the solution logs. Open CloudWatch Logs in the console. Find the SO0111-SHARR CloudWatch Logs Group. Sort the list so the most-recently updated streams appear first. Select the log stream for the finding you attempted to run. You should find any errors there. Some reasons for the failure could be: mismatch between finding control and remediation control, cross-account remediation (not yet supported), or that the finding has already been remediated. If unable to determine the reason for the failure, please collect the logs and open a support ticket. +**Resolution:** Check the notes of the finding for reasons why it was not remediated. A common cause is that the finding has no automated remediation. At this time there is no way to provide direct feedback to the user when no remediation exists other than via the notes. Review the solution logs. Open CloudWatch Logs in the console. Find the SO0111-ASR CloudWatch Logs Group. Sort the list so the most-recently updated streams appear first. Select the log stream for the finding you attempted to run. You should find any errors there. Some reasons for the failure could be: mismatch between finding control and remediation control, cross-account remediation (not yet supported), or that the finding has already been remediated. If unable to determine the reason for the failure, please collect the logs and open a support ticket. @@ -33 +33 @@ -**Resolution** : The member template has not been installed in the member account where SHARR is attempting to remediate a finding. Follow instructions for deployment of the member template. +**Resolution** : The member template has not been installed in the member account where ASR is attempting to remediate a finding. Follow instructions for deployment of the member template. @@ -57 +57 @@ - 4. Manually delete the entry **Remediate with SHARR**. + 4. Manually delete the entry **Remediate with ASR**. @@ -67 +67 @@ -**Resolution** : This is a common occurrence if you have no subscriptions to the `SO0111-SHARR_LocalAlarmNotification` SNS topic in the member account. +**Resolution** : This is a common occurrence if you have no subscriptions to the `SO0111-ASR_LocalAlarmNotification` SNS topic in the member account.