AWS controltower documentation change
Summary
Updated documentation to replace references to 'Security Hub' with 'Security Hub CSPM', clarifying the integration with CSPM (Cloud Security Posture Management) features.
Security assessment
The changes emphasize the use of CSPM, which is a security-focused service for posture management. However, there is no evidence of addressing a specific security vulnerability or incident; this appears to be nomenclature updates to align with product branding or feature naming conventions.
Diff
diff --git a/controltower/latest/controlreference/security-hub-controls.md b/controltower/latest/controlreference/security-hub-controls.md index 157956e78..64858d10f 100644 --- a//controltower/latest/controlreference/security-hub-controls.md +++ b//controltower/latest/controlreference/security-hub-controls.md @@ -5 +5 @@ -Enable or remove controls for the Service-Managed StandardSecurity Hub score and findingsSecurity Hub control drift reportingUnsupported Regions +Enable or remove controls for the Service-Managed StandardSecurity Hub CSPM score and findingsSecurity Hub CSPM control drift reportingUnsupported Regions @@ -7 +7 @@ Enable or remove controls for the Service-Managed StandardSecurity Hub score and -# The Security Hub standard +# The Security Hub CSPM standard @@ -9 +9 @@ Enable or remove controls for the Service-Managed StandardSecurity Hub score and -AWS Control Tower is integrated with AWS Security Hub to provide detective controls that help you monitor your AWS environment. The integration is accomplished with a Security Hub standard, called the **Service-Managed Standard: AWS Control Tower**. +AWS Control Tower is integrated with AWS Security Hub CSPM to provide detective controls that help you monitor your AWS environment. The integration is accomplished with a Security Hub CSPM standard, called the **Service-Managed Standard: AWS Control Tower**. @@ -11 +11 @@ AWS Control Tower is integrated with AWS Security Hub to provide detective contr -The **Service-Managed Standard: AWS Control Tower** supports a subset of controls in the **AWS Foundational Security Best Practices (FSBP)** standard. To learn more about this standard and to view the available controls, see [Service-Managed Standard: AWS Control Tower](https://docs.aws.amazon.com//securityhub/latest/userguide/service-managed-standard-aws-control-tower.html#aws-control-tower-standard-controls). For more general information about Security Hub standards, see [Security standards and controls in Security Hub](https://docs.aws.amazon.com//securityhub/latest/userguide/securityhub-standards.html), in the _AWS Security Hub User Guide_. +The **Service-Managed Standard: AWS Control Tower** supports a subset of controls in the **AWS Foundational Security Best Practices (FSBP)** standard. To learn more about this standard and to view the available controls, see [Service-Managed Standard: AWS Control Tower](https://docs.aws.amazon.com//securityhub/latest/userguide/service-managed-standard-aws-control-tower.html#aws-control-tower-standard-controls). For more general information about Security Hub CSPM standards, see [Security standards and controls in Security Hub CSPM](https://docs.aws.amazon.com//securityhub/latest/userguide/securityhub-standards.html), in the _AWS Security Hub User Guide_. @@ -13 +13 @@ The **Service-Managed Standard: AWS Control Tower** supports a subset of control -This standard is available only for AWS Control Tower customers who have created the standard in the AWS Control Tower console. AWS Control Tower creates the standard for you when you enable the first Security Hub control in the AWS Control Tower console. When you enable the first control, if you haven’t already enabled Security Hub, AWS Control Tower also enables Security Hub for you. +This standard is available only for AWS Control Tower customers who have created the standard in the AWS Control Tower console. AWS Control Tower creates the standard for you when you enable the first Security Hub CSPM control in the AWS Control Tower console. When you enable the first control, if you haven’t already enabled Security Hub CSPM, AWS Control Tower also enables Security Hub CSPM for you. @@ -15 +15 @@ This standard is available only for AWS Control Tower customers who have created -After you create this standard, you can view the Security Hub detective controls alongside other AWS Control Tower controls, in the AWS Control Tower console and in Security Hub. +After you create this standard, you can view the Security Hub CSPM detective controls alongside other AWS Control Tower controls, in the AWS Control Tower console and in Security Hub CSPM. @@ -21 +21 @@ After you create this standard, you can view the Security Hub detective controls - * The Security Hub controls are active at the OU level only, not for all AWS Control Tower OUs (if not enabled for all), and not for individual accounts. + * The Security Hub CSPM controls are active at the OU level only, not for all AWS Control Tower OUs (if not enabled for all), and not for individual accounts. @@ -23 +23 @@ After you create this standard, you can view the Security Hub detective controls - * When Security Hub adds new controls, the new controls are not added to the **Security Hub Service-Managed Standard: AWS Control Tower** automatically. + * When Security Hub CSPM adds new controls, the new controls are not added to the **Security Hub CSPM Service-Managed Standard: AWS Control Tower** automatically. @@ -32 +32 @@ After you create this standard, you can view the Security Hub detective controls -To avoid drift, always enable and remove controls for the Service-Managed Standard by means of the AWS Control Tower service, either in the console or by calling the AWS Control Tower APIs, `EnableControl` and `DisableControl`. When you change the enablement status of a control in AWS Control Tower, the change also is reflected in Security Hub. +To avoid drift, always enable and remove controls for the Service-Managed Standard by means of the AWS Control Tower service, either in the console or by calling the AWS Control Tower APIs, `EnableControl` and `DisableControl`. When you change the enablement status of a control in AWS Control Tower, the change also is reflected in Security Hub CSPM. @@ -34 +34 @@ To avoid drift, always enable and remove controls for the Service-Managed Standa -If you deactivate a Service-Managed Standard control by means of the Security Hub console, the AWS Control Tower member account enters a state of control drift. In this situation, AWS Control Tower is not receiving the Security Hub findings for the control that you deactivated. You must resolve this drift before AWS Control Tower can apply the control successfully to your registered organizational units and member accounts. +If you deactivate a Service-Managed Standard control by means of the Security Hub CSPM console, the AWS Control Tower member account enters a state of control drift. In this situation, AWS Control Tower is not receiving the Security Hub CSPM findings for the control that you deactivated. You must resolve this drift before AWS Control Tower can apply the control successfully to your registered organizational units and member accounts. @@ -36 +36 @@ If you deactivate a Service-Managed Standard control by means of the Security Hu -You can delete this standard in the AWS Control Tower console by deactivating all controls in the standard. This deletes the standard for all managed accounts and governed Regions in AWS Control Tower. Deleting the standard does not deactivate Security Hub for your account. +You can delete this standard in the AWS Control Tower console by deactivating all controls in the standard. This deletes the standard for all managed accounts and governed Regions in AWS Control Tower. Deleting the standard does not deactivate Security Hub CSPM for your account. @@ -42 +42 @@ The control named **[SH.RDS.18] RDS instances should be deployed in a VPC** is d -## Security Hub score and findings +## Security Hub CSPM score and findings @@ -44 +44 @@ The control named **[SH.RDS.18] RDS instances should be deployed in a VPC** is d -Based on control status, Security Hub calculates a security score for the **Service-Managed Standard: AWS Control Tower**. This security score and the control findings are available only in Security Hub. These items aren't available in AWS Control Tower. +Based on control status, Security Hub CSPM calculates a security score for the **Service-Managed Standard: AWS Control Tower**. This security score and the control findings are available only in Security Hub CSPM. These items aren't available in AWS Control Tower. @@ -48 +48 @@ Based on control status, Security Hub calculates a security score for the **Serv -When you create **Service-Managed Standard: AWS Control Tower** and enable controls for it, Security Hub may take up to 18 hours to generate findings for controls that use the same underlying AWS Config service-linked rule as controls from other enabled Security Hub standards. For more information, see [Schedule for running security checks](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-schedule.html) in the AWS Security Hub User Guide. +When you create **Service-Managed Standard: AWS Control Tower** and enable controls for it, Security Hub CSPM may take up to 18 hours to generate findings for controls that use the same underlying AWS Config service-linked rule as controls from other enabled Security Hub CSPM standards. For more information, see [Schedule for running security checks](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-schedule.html) in the AWS Security Hub CSPM User Guide. @@ -50 +50 @@ When you create **Service-Managed Standard: AWS Control Tower** and enable contr -## Security Hub control drift reporting +## Security Hub CSPM control drift reporting @@ -52 +52 @@ When you create **Service-Managed Standard: AWS Control Tower** and enable contr -When reporting drift for controls that are part of the AWS Security Hub Service-Managed Standard, AWS Control Tower receives a daily status update from Security Hub. If no update is received, AWS Control Tower verifies whether drift has occurred. If so, AWS Control Tower reports drift. If a control shows drift, AWS Control Tower sends an Amazon SNS notification to the AWS Control Tower `security-aggregate-notification` channel. You must subscribe to this SNS notification to receive information about which specific account is affected by Security Hub control drift. For more information about Security Hub control drift in AWS Control Tower, see [Security Hub control drift](https://docs.aws.amazon.com/controltower/latest/userguide/governance-drift.html#sh-control-drift). +When reporting drift for controls that are part of the AWS Security Hub CSPM Service-Managed Standard, AWS Control Tower receives a daily status update from Security Hub CSPM. If no update is received, AWS Control Tower verifies whether drift has occurred. If so, AWS Control Tower reports drift. If a control shows drift, AWS Control Tower sends an Amazon SNS notification to the AWS Control Tower `security-aggregate-notification` channel. You must subscribe to this SNS notification to receive information about which specific account is affected by Security Hub CSPM control drift. For more information about Security Hub CSPM control drift in AWS Control Tower, see [Security Hub control drift](https://docs.aws.amazon.com/controltower/latest/userguide/governance-drift.html#sh-control-drift). @@ -54 +54 @@ When reporting drift for controls that are part of the AWS Security Hub Service- -Although controls are active in every governed Region, AWS Control Tower sends the AWS Security Hub **Finding** events to the AWS Control Tower home Region only. +Although controls are active in every governed Region, AWS Control Tower sends the AWS Security Hub CSPM **Finding** events to the AWS Control Tower home Region only. @@ -60 +60 @@ When drift is reported, you can remediate the situation by choosing **Re-registe -You can enable and manage some Security Hub controls from AWS Control Tower, with the [Security Hub Service-managed Standard: AWS Control Tower](https://docs.aws.amazon.com//controltower/latest/userguide/security-hub-controls.html). +You can enable and manage some Security Hub CSPM controls from AWS Control Tower, with the [Security Hub CSPM Service-managed Standard: AWS Control Tower](https://docs.aws.amazon.com//controltower/latest/userguide/security-hub-controls.html). @@ -64 +64 @@ You can enable and manage some Security Hub controls from AWS Control Tower, wit -It is important to know that some Security Hub controls do not operate in certain AWS Regions where AWS Control Tower is available, because those Regions do not support the required underlying functionality. As a result, when you deploy an Security Hub control through AWS Control Tower, the control may not be operating in all Regions that you govern with AWS Control Tower. For more information about the Security Hub controls that cannot be deployed in certain Regions, see the [Security Hub controls reference documentation](https://docs.aws.amazon.com//securityhub/latest/userguide/securityhub-controls-reference.html). +It is important to know that some Security Hub CSPM controls do not operate in certain AWS Regions where AWS Control Tower is available, because those Regions do not support the required underlying functionality. As a result, when you deploy an Security Hub CSPM control through AWS Control Tower, the control may not be operating in all Regions that you govern with AWS Control Tower. For more information about the Security Hub CSPM controls that cannot be deployed in certain Regions, see the [Security Hub CSPM controls reference documentation](https://docs.aws.amazon.com//securityhub/latest/userguide/securityhub-controls-reference.html). @@ -68 +68 @@ You can view the most updated list of the Regions for each control in the AWS Co -Certain**AWS Security Hub Service-Managed Standard: AWS Control Tower** controls have specific, unsupported Regions, as shown in the following table. +Certain**AWS Security Hub CSPM Service-Managed Standard: AWS Control Tower** controls have specific, unsupported Regions, as shown in the following table.