AWS securityhub medium security documentation change
Summary
Removed multiple security controls from 'not supported' lists across various AWS regions, indicating these controls are now supported in those regions. Affected controls include IMDSv2 enforcement, backup plan requirements, encryption configurations, logging controls, and resource tagging requirements.
Security assessment
The changes enable security controls in additional regions for features like IMDSv2 (protects against SSRF), backup plans (data resilience), WAF logging (threat monitoring), and encryption requirements. While not fixing existing vulnerabilities, expanding control availability directly improves security posture.
Diff
diff --git a/securityhub/latest/userguide/regions-controls.md b/securityhub/latest/userguide/regions-controls.md index 333661d58..2ff19a78d 100644 --- a//securityhub/latest/userguide/regions-controls.md +++ b//securityhub/latest/userguide/regions-controls.md @@ -468,2 +467,0 @@ The following controls are not supported in the Africa (Cape Town) Region. - * [[EC2.8] EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)](./ec2-controls.html#ec2-8) - @@ -864,2 +861,0 @@ The following controls are not supported in the Asia Pacific (Hyderabad) Region. - * [[DynamoDB.4] DynamoDB tables should be present in a backup plan](./dynamodb-controls.html#dynamodb-4) - @@ -876,2 +871,0 @@ The following controls are not supported in the Asia Pacific (Hyderabad) Region. - * [[EC2.28] EBS volumes should be covered by a backup plan](./ec2-controls.html#ec2-28) - @@ -1100,4 +1093,0 @@ The following controls are not supported in the Asia Pacific (Hyderabad) Region. - * [[RDS.15] RDS DB clusters should be configured for multiple Availability Zones](./rds-controls.html#rds-15) - - * [[RDS.26] RDS DB instances should be protected by a backup plan](./rds-controls.html#rds-26) - @@ -1182,2 +1171,0 @@ The following controls are not supported in the Asia Pacific (Hyderabad) Region. - * [[WAF.11] AWS WAF web ACL logging should be enabled](./waf-controls.html#waf-11) - @@ -1303,2 +1290,0 @@ The following controls are not supported in the Asia Pacific (Jakarta) Region. - * [[DynamoDB.4] DynamoDB tables should be present in a backup plan](./dynamodb-controls.html#dynamodb-4) - @@ -1313,2 +1298,0 @@ The following controls are not supported in the Asia Pacific (Jakarta) Region. - * [[EC2.28] EBS volumes should be covered by a backup plan](./ec2-controls.html#ec2-28) - @@ -1449,2 +1432,0 @@ The following controls are not supported in the Asia Pacific (Jakarta) Region. - * [[RDS.26] RDS DB instances should be protected by a backup plan](./rds-controls.html#rds-26) - @@ -2148,2 +2129,0 @@ The following controls are not supported in the Asia Pacific (Malaysia) Region. - * [[Redshift.2] Connections to Amazon Redshift clusters should be encrypted in transit](./redshift-controls.html#redshift-2) - @@ -2152,2 +2131,0 @@ The following controls are not supported in the Asia Pacific (Malaysia) Region. - * [[Redshift.4] Amazon Redshift clusters should have audit logging enabled](./redshift-controls.html#redshift-4) - @@ -2156,2 +2133,0 @@ The following controls are not supported in the Asia Pacific (Malaysia) Region. - * [[Redshift.7] Redshift clusters should use enhanced VPC routing](./redshift-controls.html#redshift-7) - @@ -2411,2 +2386,0 @@ The following controls are not supported in the Asia Pacific (Melbourne) Region. - * [[DynamoDB.4] DynamoDB tables should be present in a backup plan](./dynamodb-controls.html#dynamodb-4) - @@ -2415,2 +2388,0 @@ The following controls are not supported in the Asia Pacific (Melbourne) Region. - * [[EC2.1] Amazon EBS snapshots should not be publicly restorable](./ec2-controls.html#ec2-1) - @@ -2419,2 +2390,0 @@ The following controls are not supported in the Asia Pacific (Melbourne) Region. - * [[EC2.8] EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)](./ec2-controls.html#ec2-8) - @@ -2433,2 +2402,0 @@ The following controls are not supported in the Asia Pacific (Melbourne) Region. - * [[EC2.28] EBS volumes should be covered by a backup plan](./ec2-controls.html#ec2-28) - @@ -2671,2 +2638,0 @@ The following controls are not supported in the Asia Pacific (Melbourne) Region. - * [[RDS.26] RDS DB instances should be protected by a backup plan](./rds-controls.html#rds-26) - @@ -2745,2 +2710,0 @@ The following controls are not supported in the Asia Pacific (Melbourne) Region. - * [[WAF.11] AWS WAF web ACL logging should be enabled](./waf-controls.html#waf-11) - @@ -2925,2 +2888,0 @@ The following controls are not supported in the Asia Pacific (Osaka) Region. - * [[EC2.8] EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)](./ec2-controls.html#ec2-8) - @@ -3087,2 +3048,0 @@ The following controls are not supported in the Asia Pacific (Osaka) Region. - * [[WAF.11] AWS WAF web ACL logging should be enabled](./waf-controls.html#waf-11) - @@ -4318,2 +4277,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[ACM.3] ACM certificates should be tagged](./acm-controls.html#acm-3) - @@ -4324,4 +4281,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[APIGateway.1] API Gateway REST and WebSocket API execution logging should be enabled](./apigateway-controls.html#apigateway-1) - - * [[APIGateway.5] API Gateway REST API cache data should be encrypted at rest](./apigateway-controls.html#apigateway-5) - @@ -4374,2 +4327,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[AutoScaling.10] EC2 Auto Scaling groups should be tagged](./autoscaling-controls.html#autoscaling-10) - @@ -4426,2 +4377,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[CloudTrail.9] CloudTrail trails should be tagged](./cloudtrail-controls.html#cloudtrail-9) - @@ -4504,2 +4453,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[DynamoDB.5] DynamoDB tables should be tagged](./dynamodb-controls.html#dynamodb-5) - @@ -4528,10 +4475,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[EC2.35] EC2 network interfaces should be tagged](./ec2-controls.html#ec2-35) - - * [[EC2.36] EC2 customer gateways should be tagged](./ec2-controls.html#ec2-36) - - * [[EC2.37] EC2 Elastic IP addresses should be tagged](./ec2-controls.html#ec2-37) - - * [[EC2.38] EC2 instances should be tagged](./ec2-controls.html#ec2-38) - - * [[EC2.39] EC2 internet gateways should be tagged](./ec2-controls.html#ec2-39) - @@ -4540,14 +4477,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[EC2.41] EC2 network ACLs should be tagged](./ec2-controls.html#ec2-41) - - * [[EC2.42] EC2 route tables should be tagged](./ec2-controls.html#ec2-42) - - * [[EC2.43] EC2 security groups should be tagged](./ec2-controls.html#ec2-43) - - * [[EC2.44] EC2 subnets should be tagged](./ec2-controls.html#ec2-44) - - * [[EC2.45] EC2 volumes should be tagged](./ec2-controls.html#ec2-45) - - * [[EC2.46] Amazon VPCs should be tagged](./ec2-controls.html#ec2-46) - - * [[EC2.47] Amazon VPC endpoint services should be tagged](./ec2-controls.html#ec2-47) - @@ -4556,4 +4479,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[EC2.49] Amazon VPC peering connections should be tagged](./ec2-controls.html#ec2-49) - - * [[EC2.50] EC2 VPN gateways should be tagged](./ec2-controls.html#ec2-50) - @@ -4610,2 +4529,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[ECS.2] ECS services should not have public IP addresses assigned to them automatically](./ecs-controls.html#ecs-2) - @@ -4626,6 +4543,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[ECS.13] ECS services should be tagged](./ecs-controls.html#ecs-13) - - * [[ECS.14] ECS clusters should be tagged](./ecs-controls.html#ecs-14) - - * [[ECS.15] ECS task definitions should be tagged](./ecs-controls.html#ecs-15) - @@ -4662,2 +4573,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[ELB.7] Classic Load Balancers should have connection draining enabled](./elb-controls.html#elb-7) - @@ -4704,2 +4613,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[ES.3] Elasticsearch domains should encrypt data sent between nodes](./es-controls.html#es-3) - @@ -4708,8 +4615,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[ES.5] Elasticsearch domains should have audit logging enabled](./es-controls.html#es-5) - - * [[ES.6] Elasticsearch domains should have at least three data nodes](./es-controls.html#es-6) - - * [[ES.7] Elasticsearch domains should be configured with at least three dedicated master nodes](./es-controls.html#es-7) - - * [[ES.8] Connections to Elasticsearch domains should be encrypted using the latest TLS security policy](./es-controls.html#es-8) - @@ -4898,2 +4797,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[KMS.3] AWS KMS keys should not be deleted unintentionally](./kms-controls.html#kms-3) - @@ -4904,2 +4801,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[Lambda.6] Lambda functions should be tagged](./lambda-controls.html#lambda-6) - @@ -4964,4 +4859,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[NetworkFirewall.7] Network Firewall firewalls should be tagged](./networkfirewall-controls.html#networkfirewall-7) - - * [[NetworkFirewall.8] Network Firewall firewall policies should be tagged](./networkfirewall-controls.html#networkfirewall-8) - @@ -5000,4 +4891,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[RDS.16] Aurora DB clusters should be configured to copy tags to DB snapshots](./rds-controls.html#rds-16) - - * [[RDS.17] RDS DB instances should be configured to copy tags to snapshots](./rds-controls.html#rds-17) - @@ -5006,10 +4893,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[RDS.19] Existing RDS event notification subscriptions should be configured for critical cluster events](./rds-controls.html#rds-19) - - * [[RDS.20] Existing RDS event notification subscriptions should be configured for critical database instance events](./rds-controls.html#rds-20) - - * [[RDS.21] An RDS event notifications subscription should be configured for critical database parameter group events](./rds-controls.html#rds-21) - - * [[RDS.22] An RDS event notifications subscription should be configured for critical database security group events](./rds-controls.html#rds-22) - - * [[RDS.23] RDS instances should not use a database engine default port](./rds-controls.html#rds-23) - @@ -5024,6 +4901,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[RDS.28] RDS DB clusters should be tagged](./rds-controls.html#rds-28) - - * [[RDS.29] RDS DB cluster snapshots should be tagged](./rds-controls.html#rds-29) - - * [[RDS.30] RDS DB instances should be tagged](./rds-controls.html#rds-30) - @@ -5032,4 +4903,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[RDS.32] RDS DB snapshots should be tagged](./rds-controls.html#rds-32) - - * [[RDS.33] RDS DB subnet groups should be tagged](./rds-controls.html#rds-33) - @@ -5064,2 +4931,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[Redshift.4] Amazon Redshift clusters should have audit logging enabled](./redshift-controls.html#redshift-4) - @@ -5152,2 +5017,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[SecretsManager.5] Secrets Manager secrets should be tagged](./secretsmanager-controls.html#secretsmanager-5) - @@ -5156,2 +5019,0 @@ The following controls are not supported in the Asia Pacific (Thailand) Region. - * [[SNS.3] SNS topics should be tagged](./sns-controls.html#sns-3) - @@ -5713,4 +5574,0 @@ The following controls are not supported in the Canada West (Calgary) Region. - * [[EMR.3] Amazon EMR security configurations should be encrypted at rest](./emr-controls.html#emr-3) - - * [[ES.3] Elasticsearch domains should encrypt data sent between nodes](./es-controls.html#es-3) - @@ -6019,2 +5876,0 @@ The following controls are not supported in the Canada West (Calgary) Region. - * [[Redshift.7] Redshift clusters should use enhanced VPC routing](./redshift-controls.html#redshift-7) - @@ -6137,2 +5992,0 @@ The following controls are not supported in the Canada West (Calgary) Region. - * [[WAF.11] AWS WAF web ACL logging should be enabled](./waf-controls.html#waf-11) - @@ -6268,4 +6121,0 @@ The following controls are not supported in the China (Beijing) Region. - * [[EC2.15] Amazon EC2 subnets should not automatically assign public IP addresses](./ec2-controls.html#ec2-15) - - * [[EC2.16] Unused Network Access Control Lists should be removed](./ec2-controls.html#ec2-16) -