AWS controltower high security documentation change
Summary
Updated control descriptions to focus on disallowing modifications rather than enabling features (S3 encryption, logging, policy changes, cross-region replication)
Security assessment
Changes strengthen security posture by explicitly preventing configuration modifications that could weaken security controls. The controls now enforce immutable encryption (AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED), logging (AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED), and policies (AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED) - critical for maintaining audit integrity and data protection. Preventing cross-region replication (AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION) helps contain data sovereignty risks.
Diff
diff --git a/controltower/latest/controlreference/elective-preventive-controls.md b/controltower/latest/controlreference/elective-preventive-controls.md index 175468c68..2b4e24b8b 100644 --- a//controltower/latest/controlreference/elective-preventive-controls.md +++ b//controltower/latest/controlreference/elective-preventive-controls.md @@ -15 +15 @@ The elective controls with preventive behavior are configurable. For more inform - * [AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED] Enable encryption at rest for log archive + * [AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED] Disallow modification of Amazon S3 bucket encryption @@ -17 +17 @@ The elective controls with preventive behavior are configurable. For more inform - * [AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED] Enable access logging for log archive + * [AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED] Disallow modification of server access logging for an Amazon S3 bucket @@ -19 +19 @@ The elective controls with preventive behavior are configurable. For more inform - * [AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED] Disallow policy changes to log archive + * [AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED] Disallow policy changes to an Amazon S3 bucket @@ -33 +33 @@ The elective controls with preventive behavior are configurable. For more inform - * [AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION] Disallow cross region replication for S3 buckets + * [AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION] Disallow cross region replication for Amazon S3 buckets @@ -42 +42 @@ The elective controls with preventive behavior are configurable. For more inform -## [AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED] Enable encryption at rest for log archive +## [AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED] Disallow modification of Amazon S3 bucket encryption @@ -44 +44 @@ The elective controls with preventive behavior are configurable. For more inform -Protect the integrity of your log archive through encryption at rest using server side encryption (SSE) with KMS customer-created master keys (CMK). +This control disallows modification of Amazon S3 bucket encryption configuration. @@ -99 +99 @@ The artifact for this control is the following service control policy (SCP). -## [AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED] Enable access logging for log archive +## [AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED] Disallow modification of server access logging for an Amazon S3 bucket @@ -101 +101 @@ The artifact for this control is the following service control policy (SCP). -Track log archive access requests using S3 bucket access logging. +This control disallows modification of server access logging for an Amazon S3 bucket. @@ -154 +154 @@ The artifact for this control is the following service control policy (SCP). -## [AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED] Disallow policy changes to log archive +## [AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED] Disallow policy changes to an Amazon S3 bucket @@ -156 +156 @@ The artifact for this control is the following service control policy (SCP). -Protect the integrity of your log archive by ensuring no policy changes happen to the S3 bucket by any user. +This control disallows modification of an Amazon S3 bucket policy. @@ -566 +566 @@ The artifact for this control is the following service control policy (SCP). -## [AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION] Disallow cross region replication for S3 buckets +## [AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION] Disallow cross region replication for Amazon S3 buckets @@ -568 +568 @@ The artifact for this control is the following service control policy (SCP). -Contain the location of your S3 data to a single region by disabling any automatic, asynchronous copying of objects across buckets to other AWS Regions. +Contain the location of your Amazon S3 data to a single region by disabling any automatic, asynchronous copying of objects across buckets to other AWS Regions.