AWS solutions documentation change
Summary
Added deployment instructions for China and GovCloud regions with region-specific launch buttons, and an important note about Security Hub CSPM/non-CSPM account onboarding requirements.
Security assessment
The change adds documentation about ensuring proper Security Hub configuration (CSPM/non-CSPM alignment) to maintain security monitoring coverage. While this prevents misconfiguration gaps, there is no evidence of addressing a specific security vulnerability. The regional deployment instructions ensure compliance with geographic requirements but do not directly mitigate security flaws.
Diff
diff --git a/solutions/latest/automated-security-response-on-aws/deciding-where-to-deploy-each-stack.md b/solutions/latest/automated-security-response-on-aws/deciding-where-to-deploy-each-stack.md index becbf9784..582c15f3e 100644 --- a//solutions/latest/automated-security-response-on-aws/deciding-where-to-deploy-each-stack.md +++ b//solutions/latest/automated-security-response-on-aws/deciding-where-to-deploy-each-stack.md @@ -5 +5 @@ -Deciding how to deploy each stackConsolidated control findings +Deciding how to deploy each stackConsolidated control findingsChina DeploymentGovCloud (US) Deployment @@ -23,0 +24,4 @@ The solution operates on Security Hub findings, so it will not be able to operat +###### Important + +If you are using [AWS Security Hub (non-CSPM)](https://aws.amazon.com/security-hub/) then you are responsible for ensuring your member accounts onboarded with [AWS Security Hub CSPM](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html) are also onboarded with AWS Security Hub (non-CSPM). Regions aggregated in AWS Security Hub CSPM should also match regions aggregated in AWS Security Hub (non-CSPM). + @@ -66,0 +71,50 @@ If enabled, you must use v2.0.0 of the solution or later. In addition, you must +## China Deployment + +The solution does support deployment in China regions, however **you must use the following Launch buttons for one-click deployment in China regions, rather than the Launch buttons provided in other sections of this guide.** Using the "Launch Solution" buttons provided in upcoming sections in this guide will not work if you are deploying in China regions. You can still download the templates from any S3 bucket link and deploy the stacks by uploading the template file. + + * **automated-security-response-admin.template** : + + + + +[  ](https://cn-north-1.console.amazonaws.cn/cloudformation/home?region=cn-north-1#/stacks/new?stackName=automated-security-response-on-aws-admin&templateURL=https:%2F%2Fs3.cn-north-1.amazonaws.com.cn%2Fsolutions-reference-cn%2Fautomated-security-response-on-aws%2Flatest%2Fautomated-security-response-admin.template&redirectId=ImplementationGuide) + + * **automated-security-response-member-roles.template** : + + + + +[  ](https://cn-north-1.console.amazonaws.cn/cloudformation/home?region=cn-north-1#/stacks/new?stackName=automated-security-response-on-aws-member-roles&templateURL=https:%2F%2Fs3.cn-north-1.amazonaws.com.cn%2Fsolutions-reference-cn%2Fautomated-security-response-on-aws%2Flatest%2Fautomated-security-response-member-roles.template&redirectId=ImplementationGuide) + + * **automated-security-response-member.template** : + + + + +[  ](https://cn-north-1.console.amazonaws.cn/cloudformation/home?region=cn-north-1#/stacks/new?stackName=automated-security-response-on-aws-member&templateURL=https:%2F%2Fs3.cn-north-1.amazonaws.com.cn%2Fsolutions-reference-cn%2Fautomated-security-response-on-aws%2Flatest%2Fautomated-security-response-member.template&redirectId=ImplementationGuide) + +## GovCloud (US) Deployment + +The solution does support deployment in GovCloud (US) regions, however **you must use the following Launch buttons for one-click deployment in GovCloud (US) regions, rather than the Launch buttons provided in other sections of this guide.** Using the "Launch Solution" buttons provided in upcoming sections in this guide will not work if you are deploying in GovCloud (US) regions. You can still download the templates from any S3 bucket link and deploy the stacks by uploading the template file. + + * **automated-security-response-admin.template** : + + + + +[  ](https://console.amazonaws-us-gov.com/cloudformation/home?region=us-gov-west-1#/stacks/new?stackName=automated-security-response-on-aws-admin&templateURL=https:%2F%2Fs3.us-gov-west-1.amazonaws.com%2Fsolutions-reference-us-gov%2Fautomated-security-response-on-aws%2Flatest%2Fautomated-security-response-admin.template&redirectId=ImplementationGuide) + + * **automated-security-response-member-roles.template** : + + + + +[  ](https://console.amazonaws-us-gov.com/cloudformation/home?region=us-gov-west-1#/stacks/new?stackName=automated-security-response-on-aws-member-roles&templateURL=https:%2F%2Fs3.us-gov-west-1.amazonaws.com%2Fsolutions-reference-us-gov%2Fautomated-security-response-on-aws%2Flatest%2Fautomated-security-response-member-roles.template&redirectId=ImplementationGuide) + + * **automated-security-response-member.template** : + + + + +[  ](https://console.amazonaws-us-gov.com/cloudformation/home?region=us-gov-west-1#/stacks/new?stackName=automated-security-response-on-aws-member&templateURL=https:%2F%2Fs3.us-gov-west-1.amazonaws.com%2Fsolutions-reference-us-gov%2Fautomated-security-response-on-aws%2Flatest%2Fautomated-security-response-member.template&redirectId=ImplementationGuide) +