AWS securityhub low security documentation change
Summary
Updated policy change log with new dates and capabilities for organizational security management
Security assessment
The change log entries explicitly state policy updates to support security features including GuardDuty/Inspector integration and global Config recorders. These reflect ongoing enhancements to security posture management capabilities.
Diff
diff --git a/securityhub/latest/userguide/security-iam-awsmanpol.md b/securityhub/latest/userguide/security-iam-awsmanpol.md index c947ed20b..129440b61 100644 --- a//securityhub/latest/userguide/security-iam-awsmanpol.md +++ b//securityhub/latest/userguide/security-iam-awsmanpol.md @@ -29 +29 @@ This policy includes the following permissions: - * `guardduty` – Allows principals to get information about account status in Amazon GuardDuty. + * `guardduty` – Allows principals perform full lifecycle management of a detector, organization admin management, member account mnagement, and organiation-wide configuration in Amazon GuardDuty. This includes API actions: GetDetector, ListDetector, CreateDetector, UpdateDetector, DeleteDetector, EnableOrganizationAdminAccount, ListOrganizationAdminAccounts, CreateMembers, UpdateOrganizationConfiguration, DescribeOrganizationConfiguration. @@ -31 +31 @@ This policy includes the following permissions: - * `iam` – Allows principals to create a service-linked role for Security Hub CSPM and Security Hub. + * `iam` – Allows principals to create a service-linked role for Security Hub CSPM and Security Hub and to get roles, policies, and policy versions. @@ -33 +33 @@ This policy includes the following permissions: - * `inspector` – Allows principals to get information about account status in Amazon Inspector. + * `inspector` – Allows principals to get information about account status, enable or disable, delegate admin management, and perform organization configuration management in Amazon Inspector. This includes API actions: BatchGetAccountStatus, Enable, Disable, EnableDelegatedAdminAccount, DisableDelegatedAdminAccount, ListDelegatedAdminAccounts, UpdateOrganizationConfiguration, DescribeOrganizationConfiguration. @@ -36,0 +37,2 @@ This policy includes the following permissions: + * `account` – Allows principals to get information about account Regions to support Region management in Security Hub. + @@ -63 +65 @@ You can attach the `AWSSecurityHubOrganizationsAccess` policy to your IAM identi -This policy grants administrative permissions to enable and manage Security Hub and Security Hub CSPM for an organization in AWS Organizations. The permissions for this policy allow the organization management account to designate the delegated administrator account for Security Hub and Security Hub CSPM. They also allow the delegated administrator account to enable organization accounts as member accounts. +This policy grants administrative permissions to enable and manage Security Hub, Security Hub CSPM, Amazon GuardDuty and Amazon Inspector for an organization in AWS Organizations. The permissions for this policy allow the organization management account to designate the delegated administrator account for Security Hub, Security Hub CSPM, Amazon GuardDuty and Amazon Inspector. They also allow the delegated administrator account to enable organization accounts as member accounts. @@ -66,0 +69,2 @@ This policy only provides permissions for AWS Organizations. The organization ma +Creating or updating a delegated administrator policy in a management account requires additional permissions that are not provided in this policy. To perform these actions is is recommended to add permissions for `organizations:PutResourcePolicy` or attach the AWSOrganizationsFullAccess policy. + @@ -126,0 +131,2 @@ This policy includes the following permissions: + * `organizations:DescribeResourcePolicy` – Retrieves information about a resource policy. + @@ -177 +183,7 @@ This policy includes the following permissions: - * `config` – Manage service-linked configuration recorders for Security Hub resources. + * `cloudwatch` – Retrieve metrics data to support metering capabilities for Security Hub resources. + + * `config` – Manage service-linked configuration recorders for Security Hub resources, including support for global Config recorders. + + * `ecr` – Retrieve information about Amazon Elastic Container Registry images and repositories to support metering capabilities. + + * `iam` – Create the service-linked role for AWS Config and retrieve account information to support metering capabilities. @@ -179 +191 @@ This policy includes the following permissions: - * `iam` – Create the service-linked role for AWS Config. + * `lambda` – Retrieve AWS Lambda function information to support metering capabilities. @@ -197,0 +210,3 @@ Change | Description | Date +AWSSecurityHubOrganizationsAccess – Updated policy | Security Hub updated the policy to add permissions to describe resource policies to support Security Hub features. Security Hub is in preview release and subject to change. | November 12, 2025 +AWSSecurityHubFullAccess – Updated policy | Security Hub updated the policy to add capabilities around managing GuardDuty, Inspector, and account management to support Security Hub features. Security Hub is in preview release and subject to change. | November 17, 2025 +AWSSecurityHubV2ServiceRolePolicy – Updated policy | Security Hub updated the policy to add metering capabilities for Amazon Elastic Container Registry, AWS Lambda, Amazon CloudWatch, and AWS Identity and Access Management to support Security Hub (features. The update also added support for global AWS Config recorders. Security Hub is in preview release and subject to change. | November 5, 2025 @@ -200 +214,0 @@ AWSSecurityHubFullAccess – Update to an existing policy | Security Hub CSPM a -AWSSecurityHubV2ServiceRolePolicy – New policy | Security Hub added a new policy to allow Security Hub to manage AWS Config rules and Security Hub resources for a customer's organization and on the customer's behalf. Security Hub is in preview release and subject to change. | June 17, 2025