AWS securityhub documentation change
Summary
Updated ElastiCache controls to include Valkey clusters, modified AWS Config rule references, and added notes about control changes.
Security assessment
The changes expand security controls documentation by including Valkey clusters, updating Config rules for backup checks, and clarifying encryption requirements. While these updates enhance security best practices documentation, there is no explicit mention of addressing a specific security vulnerability.
Diff
diff --git a/securityhub/latest/userguide/elasticache-controls.md b/securityhub/latest/userguide/elasticache-controls.md index ac9cc0aa4..ab043cdb3 100644 --- a//securityhub/latest/userguide/elasticache-controls.md +++ b//securityhub/latest/userguide/elasticache-controls.md @@ -5 +5 @@ -[ElastiCache.1] ElastiCache (Redis OSS) clusters should have automatic backups enabled[ElastiCache.2] ElastiCache clusters should have automatic minor version upgrades enabled[ElastiCache.3] ElastiCache replication groups should have automatic failover enabled[ElastiCache.4] ElastiCache replication groups should be encrypted at rest[ElastiCache.5] ElastiCache replication groups should be encrypted in transit[ElastiCache.6] ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled[ElastiCache.7] ElastiCache clusters should not use the default subnet group +[ElastiCache.1] ElastiCache (Valkey and Redis OSS) clusters should have automatic backups enabled[ElastiCache.2] ElastiCache clusters should have automatic minor version upgrades enabled[ElastiCache.3] ElastiCache replication groups should have automatic failover enabled[ElastiCache.4] ElastiCache replication groups should be encrypted at rest[ElastiCache.5] ElastiCache replication groups should be encrypted in transit[ElastiCache.6] ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled[ElastiCache.7] ElastiCache clusters should not use the default subnet group @@ -9 +9 @@ -These AWS Security Hub controls evaluate the Amazon ElastiCache service and resources. +These AWS Security Hub controls evaluate the Amazon ElastiCache service and resources. The controls might not be available in all AWS Regions. For more information, see [Availability of controls by Region](./securityhub-regions.html#securityhub-regions-control-support). @@ -11,3 +11 @@ These AWS Security Hub controls evaluate the Amazon ElastiCache service and reso -These controls may not be available in all AWS Regions. For more information, see [Availability of controls by Region](./securityhub-regions.html#securityhub-regions-control-support). - -## [ElastiCache.1] ElastiCache (Redis OSS) clusters should have automatic backups enabled +## [ElastiCache.1] ElastiCache (Valkey and Redis OSS) clusters should have automatic backups enabled @@ -23 +21 @@ These controls may not be available in all AWS Regions. For more information, se -**AWS Config rule:** [elasticache-redis-cluster-automatic-backup-check](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-redis-cluster-automatic-backup-check.html) +**AWS Config rule:** [elasticache-automatic-backup-check-enabled](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-automatic-backup-check-enabled.html) @@ -33 +31,7 @@ Parameter | Description | Type | Allowed custom values | Security Hub default va -This control evaluates whether an Amazon ElastiCache (Redis OSS) cluster has automatic backups scheduled. The control fails if the `SnapshotRetentionLimit` for the Redis cluster is less than the specified time period. Unless you provide a custom parameter value for the snapshot retention period, Security Hub uses a default value of 1 day. +This control checks whether an Amazon ElastiCache (Valkey or Redis OSS) cluster has automatic backups enabled. The control fails if the `SnapshotRetentionLimit` for the cluster is less than the specified time period. Unless you provide a custom parameter value for the snapshot retention period, Security Hub uses a default value of 1 day. + +ElastiCache (Valkey and Redis OSS) clusters can back up their data. You can use the backup to restore a cluster or seed a new cluster. The backup consists of the cluster's metadata, along with all the data in the cluster. All backups are written to Amazon S3, which provides durable storage. You can restore your data by creating a new ElastiCache cluster and populating it with data from a backup. You can manage backups using the AWS Management Console, the AWS CLI, and the ElastiCache API. + +###### Note + +On October 14, 2025, Security Hub changed the title, description, and rule for this control. Previously, the control checked Redis OSS clusters and all replication groups, using the [elasticache-redis-cluster-automatic-backup-check](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-redis-cluster-automatic-backup-check.html) rule. The title of the control was: _ElastiCache (Redis OSS) clusters should have automatic backups enabled_. @@ -35 +39 @@ This control evaluates whether an Amazon ElastiCache (Redis OSS) cluster has aut -Amazon ElastiCache (Redis OSS) clusters can back up their data. You can use the backup to restore a cluster or seed a new cluster. The backup consists of the cluster's metadata, along with all of the data in the cluster. All backups are written to Amazon Simple Storage Service (Amazon S3), which provides durable storage. You can restore your data by creating a new Redis cluster and populating it with data from a backup. You can manage backups using the AWS Management Console, the AWS Command Line Interface (AWS CLI), and the ElastiCache API. +This control now checks Valkey clusters in addition to Redis OSS clusters and all replication groups. The new title and description reflect that the control checks both types of clusters. @@ -39 +43 @@ Amazon ElastiCache (Redis OSS) clusters can back up their data. You can use the -To schedule automatic backups on an ElastiCache (Redis OSS) cluster, see [Scheduling automatic backups](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/backups-automatic.html) in the _Amazon ElastiCache User Guide_. +For information about scheduling automatic backups for an ElastiCache cluster, see [Scheduling automatic backups](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/backups-automatic.html) in the _Amazon ElastiCache User Guide_. @@ -51 +55 @@ To schedule automatic backups on an ElastiCache (Redis OSS) cluster, see [Schedu -**AWS Config rule:** [`elasticache-auto-minor-version-upgrade-check`](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-auto-minor-version-upgrade-check.html) +**AWS Config rule:** [elasticache-auto-minor-version-upgrade-check](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-auto-minor-version-upgrade-check.html) @@ -79 +83 @@ To automatically apply minor version upgrades to an existing ElastiCache cache c -**AWS Config rule:** [`elasticache-repl-grp-auto-failover-enabled`](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-repl-grp-auto-failover-enabled.html) +**AWS Config rule:** [elasticache-repl-grp-auto-failover-enabled](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-repl-grp-auto-failover-enabled.html) @@ -103 +107 @@ To enable automatic failover for an existing ElastiCache replication group,, see -**AWS Config rule:** [`elasticache-repl-grp-encrypted-at-rest`](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-repl-grp-encrypted-at-rest.html) +**AWS Config rule:** [elasticache-repl-grp-encrypted-at-rest](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-repl-grp-encrypted-at-rest.html) @@ -127 +131 @@ To configure at-rest encryption on an ElastiCache replication group, see [Enabli -**AWS Config rule:** [`elasticache-repl-grp-encrypted-in-transit`](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-repl-grp-encrypted-in-transit.html) +**AWS Config rule:** [elasticache-repl-grp-encrypted-in-transit](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-repl-grp-encrypted-in-transit.html) @@ -151 +155 @@ To configure in-transit encryption on an ElastiCache replication group, see [Ena -**AWS Config rule:** [`elasticache-repl-grp-redis-auth-enabled`](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-repl-grp-redis-auth-enabled.html) +**AWS Config rule:** [elasticache-repl-grp-redis-auth-enabled](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-repl-grp-redis-auth-enabled.html) @@ -175 +179 @@ To use Redis AUTH on an ElastiCache (Redis OSS) replication group, see [Modifyin -**AWS Config rule:** [`elasticache-subnet-group-check`](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-subnet-group-check.html) +**AWS Config rule:** [elasticache-subnet-group-check](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-subnet-group-check.html)