AWS systems-manager-automation-runbooks documentation change
Summary
Updated STIG version references, S3 bucket paths, and Windows/Linux component parameters. Added documentation for new 'InstallPackages' and 'SetDoDConsentBanner' parameters in Linux components.
Security assessment
Changes update STIG versions to newer releases (e.g., Windows Server 2022 STIG v2r4) reflecting current security standards. Added Linux parameters control security behaviors like DoD consent banners. No direct evidence of patching specific vulnerabilities.
Diff
diff --git a/systems-manager-automation-runbooks/latest/userguide/awsec2-configure-stig.md b/systems-manager-automation-runbooks/latest/userguide/awsec2-configure-stig.md index 79724a244..dcaa5fda2 100644 --- a//systems-manager-automation-runbooks/latest/userguide/awsec2-configure-stig.md +++ b//systems-manager-automation-runbooks/latest/userguide/awsec2-configure-stig.md @@ -11 +11 @@ Security Technical Implementation Guides (STIGs) are the configuration hardening -Amazon EC2 provides a Systems Manager command document, AWSEC2-ConfigureSTIG, which you can use to apply STIG settings to an instance. This document helps you to quickly build compliant images for STIG standards. The STIG Systems Manager document scans for misconfigurations and runs a remediation script. It also installs InstallRoot from the Department of Defense (DoD) on Windows AMIs to install and update the DoD certificates and to remove unnecessary certificates to maintain STIG compliance. There are no additional charges for using the STIG Systems Manager document. +Amazon EC2 provides a Systems Manager command document, AWSEC2-ConfigureSTIG, which you can use to apply STIG settings to an EC2 instance. This document helps you to quickly build compliant images for STIG standards. The STIG Systems Manager document scans for misconfigurations and runs a remediation script. It also installs InstallRoot from the Department of Defense (DoD) on AWS Windows AMIs to install and update the DoD certificates and to remove unnecessary certificates to maintain STIG compliance. There are no additional charges for using the STIG Systems Manager document. @@ -57 +57 @@ Amazon groups STIG hardening components together into operating system related b -Amazon stores the component bundles in the Image Builder S3 `STIG` bucket in each AWS Region. Use SSL/TLS to communicate with AWS resources. We require TLS 1.2 and recommend TLS 1.3. +Amazon stores the component bundles in the EC2 Windows S3 `STIG` bucket in each AWS Region. Use SSL/TLS to communicate with AWS resources. We require TLS 1.2 and recommend TLS 1.3. @@ -61 +61 @@ Amazon stores the component bundles in the Image Builder S3 `STIG` bucket in eac -With few exceptions, the STIG hardening components that the Systems Manager document downloads do not install third-party packages. If third-party packages are already installed on the instance, and if there are related STIGs that Amazon EC2 supports for that package, those STIGs are applied. +With few exceptions, the STIG hardening components that the Systems Manager document downloads do not install third-party packages. If third-party packages are already installed on the instance or the `InstallPackage` parameter is set to `yes`, related STIGs that Amazon EC2 supports for that package are applied. @@ -67 +67 @@ Patterns and examples for component storage paths and bundle file names are as f -`s3://aws-windows-downloads-`<region>`/STIG/`<bundle file name>`` +`s3://aws-windows-downloads-`<region>`/STIG/`<operating system>`/Latest/`<bundle file name>`` @@ -76,11 +76 @@ AWS Region (Each Region has its own components bucket.) -bundle file name - - -The format is `<os bundle name>`_`<YYYY>`_Q`<quarter>`[_`<release>`].`<file extension>`. _Note that the name has underscores between the nodes, not periods._ - -os bundle name - - -The standard name prefix for the operating system bundle is either `LinuxAWSConfigureSTIG` or `AWSConfigureSTIG`. To maintain backwards compatibility, the download for Windows doesn't include a platform prefix. - -YYYY +operating system @@ -89 +79 @@ YYYY -The four digit year of the release. +The operating system platform of the instance where STIGs are applied – either `Linux` or `Windows`. @@ -91 +81 @@ The four digit year of the release. -quarter +bundle file name @@ -94 +84 @@ quarter -Identifies the quarter of the year: 1, 2, 3, or 4. +The format is `<os bundle name>`.`<file extension>`. @@ -96 +86 @@ Identifies the quarter of the year: 1, 2, 3, or 4. -release +os bundle name @@ -99 +89 @@ release -Incremental number that starts at one, and increments by one for each new release. The release is not included for the first release in a quarter and is only added for subsequent releases. +The standard name prefix for the operating system bundle is either `LinuxAWSConfigureSTIG` or `AWSConfigureSTIG`. To maintain backwards compatibility, the download for Windows doesn't include a platform prefix. @@ -108 +98 @@ Compressed file format `tgz` (Linux) or `zip` (Windows). - * `LinuxAWSConfigureSTIG_2023_Q1_2.tgz` + * `LinuxAWSConfigureSTIG.tgz` @@ -110 +100 @@ Compressed file format `tgz` (Linux) or `zip` (Windows). - * `AWSConfigureSTIG_2022_Q4.zip` + * `AWSConfigureSTIG.zip` @@ -117 +107 @@ Compressed file format `tgz` (Linux) or `zip` (Windows). -Amazon EC2 Windows STIG AMIs and hardening components are designed for standalone servers and apply Local Group Policy. STIG-compliant components install InstallRoot from the Department of Defense (DoD) on Windows AMIs to download, install and update the DoD certificates. They also remove unnecessary certificates to maintain STIG compliance. Currently, Amazon EC2 supports STIG baselines for the following versions of Windows Server: 2012 R2, 2016, 2019, and 2022. +Amazon EC2 Windows STIG AMIs and Image Builder hardening components are designed for standalone servers and apply Local Group Policy. STIG-compliant components install InstallRoot from the Department of Defense (DoD) on Windows AMIs to download, install and update the DoD certificates. They also remove unnecessary certificates to maintain STIG compliance. Currently, Amazon EC2 supports STIG baselines for the following versions of Windows Server: 2012 R2, 2016, 2019, and 2022. @@ -129 +119 @@ For a complete list of Windows STIGs, see the [STIGs Document Library](https://p - * **Windows Server 2022 STIG Version 2 Release 2** + * **Windows Server 2022 STIG Version 2 Release 4** @@ -133 +123 @@ V-254335, V-254336, V-254337, V-254338, V-254351, V-254357, V-254363, and V-2544 - * **Windows Server 2019 STIG Version 3 Release 2** + * **Windows Server 2019 STIG Version 3 Release 4** @@ -137 +127 @@ V-205691, V-205819, V-205858, V-205859, V-205860, V-205870, V-205871, and V-2059 - * **Windows Server 2016 STIG Version 2 Release 9** + * **Windows Server 2016 STIG Version 2 Release 10** @@ -143 +133 @@ V-224916, V-224917, V-224918, V-224919, V-224931, V-224942, and V-225060 -V-225537, V-225536, V-225526, V-225525, V-225514, V-225511, V-225490, V-225489, V-225488, V-225487, V-225485, V-225484, V-225483, V-225482, V-225481, V-225480, V-225479, V-225476, V-225473, V-225468, V-225462, V-225460, V-225459, V-225412, V-225394, V-225392, V-225376, V-225363, V-225362, V-225360, V-225359, V-225358, V-225357, V-225355, V-225343, V-225342, V-225336, V-225335, V-225334, V-225333, V-225332, V-225331, V-225330, V-225328, V-225327, V-225324, V-225319, V-225318, and V-225250 +V-225250, V-225318, V-225319, V-225324, V-225327, V-225328, V-225330, V-225331, V-225332, V-225333, V-225334, V-225335, V-225336, V-225342, V-225343, V-225355, V-225357, V-225358, V-225359, V-225360, V-225362, V-225363, V-225376, V-225392, V-225394, V-225412, V-225459, V-225460, V-225462, V-225468, V-225473, V-225476, V-225479, V-225480, V-225481, V-225482, V-225483, V-225484, V-225485, V-225487, V-225488, V-225489, V-225490, V-225511, V-225514, V-225525, V-225526, V-225536, and V-225537 @@ -145 +135 @@ V-225537, V-225536, V-225526, V-225525, V-225514, V-225511, V-225490, V-225489, - * **Microsoft .NET Framework 4.0 STIG Version 2 Release 2** + * **Microsoft .NET Framework 4.0 STIG Version 2 Release 6** @@ -174 +164 @@ The Windows STIG Medium category includes all of the listed STIG hardening setti - * **Windows Server 2022 STIG Version 2 Release 2** + * **Windows Server 2022 STIG Version 2 Release 4** @@ -180 +170 @@ V-254247, V-254265, V-254269, V-254270, V-254271, V-254272, V-254273, V-254274, - * **Windows Server 2019 STIG Version 3 Release 2** + * **Windows Server 2019 STIG Version 3 Release 4** @@ -186 +176 @@ V-205625, V-205626, V-205627, V-205629, V-205630, V-205633, V-205634, V-205635, - * **Windows Server 2016 STIG Version 2 Release 9** + * **Windows Server 2016 STIG Version 2 Release 10** @@ -196 +186 @@ Includes all STIG hardening settings that Amazon EC2 supports for Category III ( -V-225574, V-225573, V-225572, V-225571, V-225570, V-225569, V-225568, V-225567, V-225566, V-225565, V-225564, V-225563, V-225562, V-225561, V-225560, V-225559, V-225558, V-225557, V-225555, V-225554, V-225553, V-225551, V-225550, V-225549, V-225548, V-225546, V-225545, V-225544, V-225543, V-225542, V-225541, V-225540, V-225539, V-225538, V-225535, V-225534, V-225533, V-225532, V-225531, V-225530, V-225529, V-225528, V-225527, V-225524, V-225523, V-225522, V-225521, V-225520, V-225519, V-225518, V-225517, V-225516, V-225515, V-225513, V-225510, V-225509, V-225508, V-225506, V-225504, V-225503, V-225502, V-225501, V-225500, V-225494, V-225486, V-225478, V-225477, V-225475, V-225474, V-225472, V-225471, V-225470, V-225469, V-225464, V-225463, V-225461, V-225458, V-225457, V-225456, V-225455, V-225454, V-225453, V-225452, V-225448, V-225443, V-225442, V-225441, V-225415, V-225414, V-225413, V-225411, V-225410, V-225409, V-225408, V-225407, V-225406, V-225405, V-225404, V-225402, V-225401, V-225400, V-225398, V-225397, V-225395, V-225393, V-225391, V-225389, V-225386, V-225385, V-225384, V-225383, V-225382, V-225381, V-225380, V-225379, V-225378, V-225377, V-225375, V-225374, V-225373, V-225372, V-225371, V-225370, V-225369, V-225368, V-225367, V-225356, V-225353, V-225352, V-225351, V-225350, V-225349, V-225348, V-225347, V-225346, V-225345, V-225344, V-225341, V-225340, V-225339, V-225338, V-225337, V-225329, V-225326, V-225325, V-225317, V-225316, V-225315, V-225314, V-225305, V-225304, V-225303, V-225302, V-225301, V-225300, V-225299, V-225298, V-225297, V-225296, V-225295, V-225294, V-225293, V-225292, V-225291, V-225290, V-225289, V-225288, V-225287, V-225286, V-225285, V-225284, V-225283, V-225282, V-225281, V-225280, V-225279, V-225278, V-225277, V-225276, V-225275, V-225273, V-225272, V-225271, V-225270, V-225269, V-225268, V-225267, V-225266, V-225265, V-225264, V-225263, V-225261, V-225260, V-225259, and V-225239 +V-225239, V-225259, V-225260, V-225261, V-225263, V-225264, V-225265, V-225266, V-225267, V-225268, V-225269, V-225270, V-225271, V-225272, V-225273, V-225275, V-225276, V-225277, V-225278, V-225279, V-225280, V-225281, V-225282, V-225283, V-225284, V-225285, V-225286, V-225287, V-225288, V-225289, V-225290, V-225291, V-225292, V-225293, V-225294, V-225295, V-225296, V-225297, V-225298, V-225299, V-225300, V-225301, V-225302, V-225303, V-225304, V-225305, V-225314, V-225315, V-225316, V-225317, V-225325, V-225326, V-225329, V-225337, V-225338, V-225339, V-225340, V-225341, V-225344, V-225345, V-225346, V-225347, V-225348, V-225349, V-225350, V-225351, V-225352, V-225353, V-225356, V-225367, V-225368, V-225369, V-225370, V-225371, V-225372, V-225373, V-225374, V-225375, V-225377, V-225378, V-225379, V-225380, V-225381, V-225382, V-225383, V-225384, V-225385, V-225386, V-225389, V-225391, V-225393, V-225395, V-225397, V-225398, V-225400, V-225401, V-225402, V-225404, V-225405, V-225406, V-225407, V-225408, V-225409, V-225410, V-225411, V-225413, V-225414, V-225415, V-225441, V-225442, V-225443, V-225448, V-225452, V-225453, V-225454, V-225455, V-225456, V-225457, V-225458, V-225461, V-225463, V-225464, V-225469, V-225470, V-225471, V-225472, V-225474, V-225475, V-225477, V-225478, V-225486, V-225494, V-225500, V-225501, V-225502, V-225503, V-225504, V-225506, V-225508, V-225509, V-225510, V-225513, V-225515, V-225516, V-225517, V-225518, V-225519, V-225520, V-225521, V-225522, V-225523, V-225524, V-225527, V-225528, V-225529, V-225530, V-225531, V-225532, V-225533, V-225534, V-225535, V-225538, V-225539, V-225540, V-225541, V-225542, V-225543, V-225544, V-225545, V-225546, V-225548, V-225549, V-225550, V-225551, V-225553, V-225554, V-225555, V-225557, V-225558, V-225559, V-225560, V-225561, V-225562, V-225563, V-225564, V-225565, V-225566, V-225567, V-225568, V-225569, V-225570, V-225571, V-225572, V-225573, and V-225574 @@ -198 +188 @@ V-225574, V-225573, V-225572, V-225571, V-225570, V-225569, V-225568, V-225567, - * **Microsoft .NET Framework STIG 4.0 Version 2 Release 2** + * **Microsoft .NET Framework STIG 4.0 Version 2 Release 6** @@ -208 +198 @@ Includes all STIG hardening settings that Amazon EC2 supports for Category III ( -V-241989, V-241990, V-241991, V-241993, V-241993, V-241998, V-241998, V-242003, and V-242003 +V-241989, V-241990, V-241991, V-241993, V-241993, V-241998, and V-242003 @@ -237 +227 @@ The Windows STIG High category includes all of the listed STIG hardening setting - * **Windows Server 2022 STIG Version 2 Release 2** + * **Windows Server 2022 STIG Version 2 Release 4** @@ -241 +231 @@ V-254293, V-254352, V-254353, V-254354, V-254374, V-254378, V-254381, V-254446, - * **Windows Server 2019 STIG Version 3 Release 2** + * **Windows Server 2019 STIG Version 3 Release 4** @@ -247 +237 @@ V-205653, V-205654, V-205711, V-205713, V-205724, V-205725, V-205757, V-205802, - * **Windows Server 2016 STIG Version 2 Release 9** + * **Windows Server 2016 STIG Version 2 Release 10** @@ -257 +247 @@ Includes all STIG hardening settings that Amazon EC2 supports for Categories II -V-225556, V-225552, V-225547, V-225507, V-225505, V-225498, V-225497, V-225496, V-225493, V-225492, V-225491, V-225449, V-225444, V-225399, V-225396, V-225390, V-225366, V-225365, V-225364, V-225354, and V-225274 +V-225274, V-225354, V-225364, V-225365, V-225366, V-225390, V-225396, V-225399, V-225444, V-225449, V-225491, V-225492, V-225493, V-225496, V-225497, V-225498, V-225505, V-225507, V-225547, V-225552, and V-225556 @@ -259 +249 @@ V-225556, V-225552, V-225547, V-225507, V-225505, V-225498, V-225497, V-225496, - * **Microsoft .NET Framework STIG 4.0 Version 2 Release 2** + * **Microsoft .NET Framework STIG 4.0 Version 2 Release 6** @@ -285 +275 @@ Includes all STIG hardening settings that Amazon EC2 supports for Categories II -V-213426, V-213426, V-213452, V-213452, V-213452, V-213453, V-213453, and V-213453 +V-213426, V-213452, and V-213453 @@ -294 +284,19 @@ This section logs Windows component version history for the quarterly STIG updat -Updated STIGS for Internet Explorer 11 STIG Version 2 Release 5 for all STIG components for the 2025 first quarter release. +Updated STIG versions and applied STIGS for the 2025 Q2 release as follows: + +###### Windows STIG Low (Category III) + + * Windows Server 2022 STIG Version 2 Release 4 + + * Windows Server 2019 STIG Version 3 Release 4 + + * Windows Server 2016 STIG Version 2 Release 10 + + * Windows Server 2012 R2 MS STIG Version 3 Release 5 + + * Microsoft .NET Framework 4.0 STIG Version 2 Release 6 + + * Windows Firewall STIG Version 2 Release 2 + + * Internet Explorer 11 STIG Version 2 Release 5 + + * Microsoft Edge STIG Version 2 Release 2 (Windows Server 2022 only) @@ -296 +303,0 @@ Updated STIGS for Internet Explorer 11 STIG Version 2 Release 5 for all STIG com - * STIG-Build-Windows-Low version 2025.1.x @@ -298 +304,0 @@ Updated STIGS for Internet Explorer 11 STIG Version 2 Release 5 for all STIG com - * STIG-Build-Windows-Medium version 2025.1.x @@ -300 +305,0 @@ Updated STIGS for Internet Explorer 11 STIG Version 2 Release 5 for all STIG com - * STIG-Build-Windows-High version 2025.1.x @@ -301,0 +307 @@ Updated STIGS for Internet Explorer 11 STIG Version 2 Release 5 for all STIG com +###### Windows STIG Medium (Category II) @@ -302,0 +309 @@ Updated STIGS for Internet Explorer 11 STIG Version 2 Release 5 for all STIG com + * Windows Server 2022 STIG Version 2 Release 4 @@ -303,0 +311,43 @@ Updated STIGS for Internet Explorer 11 STIG Version 2 Release 5 for all STIG com + * Windows Server 2019 STIG Version 3 Release 4 + + * Windows Server 2016 STIG Version 2 Release 10 + + * Windows Server 2012 R2 MS STIG Version 3 Release 5 + + * Microsoft .NET Framework 4.0 STIG Version 2 Release 6 + + * Windows Firewall STIG Version 2 Release 2 + + * Internet Explorer 11 STIG Version 2 Release 5 + + * Microsoft Edge STIG Version 2 Release 2 (Windows Server 2022 only) + + * Defender STIG Version 2 Release 4 + + + + +###### Windows STIG High (Category I) + + * Windows Server 2022 STIG Version 2 Release 4 + + * Windows Server 2019 STIG Version 3 Release 4 + + * Windows Server 2016 STIG Version 2 Release 10 + + * Windows Server 2012 R2 MS STIG Version 3 Release 5 + + * Microsoft .NET Framework 4.0 STIG Version 2 Release 6 + + * Windows Firewall STIG Version 2 Release 2 + + * Internet Explorer 11 STIG Version 2 Release 5 + + * Microsoft Edge STIG Version 2 Release 2 (Windows Server 2022 only) + + * Defender STIG Version 2 Release 4 + + + + +Updated STIGS for Internet Explorer 11 STIG Version 2 Release 5 for all STIG components for the 2025 first quarter release. @@ -307 +357 @@ Updated STIG versions and applied STIGS for the 2024 Q4 release as follows: -###### STIG-Build-Windows-Low version 2024.4.0 +###### Windows STIG Low (Category III) @@ -328 +378 @@ Updated STIG versions and applied STIGS for the 2024 Q4 release as follows: -###### STIG-Build-Windows-Medium version 2024.4.0 +###### Windows STIG Medium (Category II) @@ -351 +401 @@ Updated STIG versions and applied STIGS for the 2024 Q4 release as follows: -###### STIG-Build-Windows-High version 2024.4.0 +###### Windows STIG High (Category I) @@ -390 +440 @@ Updated STIG versions and applied STIGS for the 2022 Q4 release as follows: -###### STIG-Build-Windows-Low version 2022.4.0 +###### Windows STIG Low (Category III) @@ -411 +461 @@ Updated STIG versions and applied STIGS for the 2022 Q4 release as follows: -###### STIG-Build-Windows-Medium version 2022.4.0 +###### Windows STIG Medium (Category II) @@ -434 +484 @@ Updated STIG versions and applied STIGS for the 2022 Q4 release as follows: -###### STIG-Build-Windows-High version 2022.4.0 +###### Windows STIG High (Category I) @@ -461 +511 @@ Updated STIG versions and applied STIGS for the 2022 Q2 release. -###### STIG-Build-Windows-Low version 1.5.0 +###### Windows STIG Low (Category III)