AWS securityhub documentation change
Summary
Added documentation for new 'AWSServiceRoleForSecurityHubV2' service-linked role including permissions, creation, editing, and deletion procedures
Security assessment
The change introduces documentation for a new service-linked role with specific permissions for Security Hub V2 operations. While this relates to security controls and access management, there is no evidence of addressing a specific vulnerability or security incident. The documentation explains security-related features (IAM role permissions) but doesn't fix existing security issues.
Diff
diff --git a/securityhub/latest/userguide/using-service-linked-roles.md b/securityhub/latest/userguide/using-service-linked-roles.md index 458a173c1..916302428 100644 --- a//securityhub/latest/userguide/using-service-linked-roles.md +++ b//securityhub/latest/userguide/using-service-linked-roles.md @@ -5 +5 @@ -Service-linked role permissions for Security HubCreating a service-linked role for Security HubEditing a service-linked role for Security HubDeleting a service-linked role for Security Hub +Service-linked role permissions for Security HubCreating a service-linked role for Security HubEditing a service-linked role for Security HubDeleting a service-linked role for Security HubService-linked role for AWS Security Hub V2 @@ -28,0 +29,2 @@ For information about other services that support service-linked roles, see [AWS + * Service-linked role for AWS Security Hub V2 + @@ -91,0 +94,88 @@ To delete the `AWSServiceRoleForSecurityHub` service-linked role, you can use th + +## Service-linked role for AWS Security Hub V2 + +###### Note + +is in preview release and subject to change. + +uses the service-linked role named `AWSServiceRoleForSecurityHubV2`. This service-linked role allows to manage AWS Config rules and resources for your organization and on your behalf. The `AWSServiceRoleForSecurityHubV2` service-linked role trusts the `securityhub.amazonaws.com` service to assume the role. + +The `AWSServiceRoleForSecurityHubV2` service-linked role uses the managed policy [AWSSecurityHubV2ServiceRolePolicy](./security-iam-awsmanpol.html#security-iam-awsmanpol-awssecurityhubv2servicerolepolicy). + +###### Permissions details + +This policy includes the following permissions: + + * `cloudwatch` – Allows the role to retrieve metrics data to support metering capabilities for resources. + + * `config` – Allows the role to manage service-linked configuration recorders for resources, including support for global AWS Config recorders. + + * `ecr` – Allows the role to retrieve information about Amazon Elastic Container Registry images and repositories to support metering capabilities. + + * `iam` – Allows the role to create the service-linked role for AWS Config and retrieve account information to support metering capabilities. + + * `lambda` – Allows the role to retrieve AWS Lambda function information to support metering capabilities. + + * `organizations` – Allows the role to retrieve account and organizational unit (OU) information for an organization. + + * `securityhub` – Allows the role to manage the configuration. + + * `tag` – Allows the role to retrieve information about resource tags. + + + + +You must grant permissions to allow an IAM identity (such as a role, group, or user) to create, edit, or delete a service-linked role. For the `AWSServiceRoleForSecurityHubV2` service-linked role to be successfully created, the IAM identity that you use to access must have the required permissions. To grant the required permissions, attach the following policy to the IAM identity. + +JSON + + +**** + + + + { + "Version":"2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "securityhub:*", + "Resource": "*" + }, + { + "Effect": "Allow", + "Action": "iam:CreateServiceLinkedRole", + "Resource": "*", + "Condition": { + "StringLike": { + "iam:AWSServiceName": "securityhub.amazonaws.com" + } + } + } + ] + } + + +### Creating a service-linked role for AWS Security Hub V2 + +The `AWSServiceRoleForSecurityHubV2` service-linked role is created automatically when you enable for the first time or you enable in a Region where you didn't previously enable it. You can also create the `AWSServiceRoleForSecurityHubV2` service-linked role manually by using the IAM console, the IAM CLI, or the IAM API. For more information about creating the role manually, see [Creating a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role) in the _IAM User Guide_. + +###### Important + +The service-linked role that's created for a administrator account doesn't apply to associated member accounts. + +### Editing a service-linked role for AWS Security Hub V2 + +doesn't allow you to edit the `AWSServiceRoleForSecurityHubV2` service-linked role. After you create a service-linked role, you can't change the name of the role because various entities might reference the role. However, you can edit the description of the role by using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the _IAM User Guide_. + +### Deleting a service-linked role for AWS Security Hub V2 + +If you no longer need to use a feature or service that requires a service-linked role, we recommend that you delete the role. That way, you don't have an unused entity that isn't actively monitored or maintained. + +When you disable , doesn't automatically delete the `AWSServiceRoleForSecurityHubV2` service-linked role for you. If you enable again, the service can then start using the existing service-linked role again. If you no longer need to use , you can manually delete the service-linked role. + +###### Important + +Before you delete the `AWSServiceRoleForSecurityHubV2` service-linked role, you must first disable in all the Regions where it's enabled. For more information, see [Disabling Security Hub CSPM](./securityhub-disable.html). If isn't disabled when you try to delete the service-linked role, the deletion fails. + +To delete the `AWSServiceRoleForSecurityHubV2` service-linked role, you can use the IAM console, the IAM CLI, or the IAM API. For more information, see [Deleting a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the _IAM User Guide_.