AWS detective documentation change
Summary
Updated IAM policy documentation to specify access to 'Security Hub CSPM findings' rather than general Security Hub findings
Security assessment
Changes clarify the scope of Security Hub integration to CSPM findings but do not indicate remediation of security flaws. Policy updates appear to be documentation accuracy improvements rather than security fixes.
Diff
diff --git a/detective/latest/userguide/security-iam-awsmanpol.md b/detective/latest/userguide/security-iam-awsmanpol.md index 6a3602073..765606602 100644 --- a//detective/latest/userguide/security-iam-awsmanpol.md +++ b//detective/latest/userguide/security-iam-awsmanpol.md @@ -35 +35 @@ This policy includes the following permissions: - * `securityhub` – Allows principals to get Security Hub findings from within Detective. + * `securityhub` – Allows principals to get Security Hub CSPM findings from within Detective. @@ -157 +157 @@ This policy includes the following permissions: - * `securityhub` – Allows principals to get Security Hub findings from within Detective. + * `securityhub` – Allows principals to get Security Hub CSPM findings from within Detective. @@ -249 +249 @@ This policy includes the following permissions: - * `organizations` – Allows principals to retrieve information about the accounts in an organization from AWS Organizations. If an account belongs to an organization, then these permissions allow the Detective console to display account names in addition to account numbers. Enables the integration of an AWS service, allows register and deregister of the specified member account as a Delegated administrator, and allows principals to retrieve Delegated administrator accounts in other security services like Amazon Detective, Amazon GuardDuty, Amazon Macie, and AWS Security Hub. + * `organizations` – Allows principals to retrieve information about the accounts in an organization from AWS Organizations. If an account belongs to an organization, then these permissions allow the Detective console to display account names in addition to account numbers. Enables the integration of an AWS service, allows register and deregister of the specified member account as a Delegated administrator, and allows principals to retrieve Delegated administrator accounts in other security services like Amazon Detective, Amazon GuardDuty, Amazon Macie, and AWS Security Hub CSPM. @@ -376 +376 @@ AmazonDetectiveInvestigatorAccess – Updates to existing policies | Added Dete -AmazonDetectiveFullAccess and AmazonDetectiveInvestigatorAccess – Updates to existing policies | Detective added Security Hub `GetFindings` actions to the `AmazonDetectiveFullAccess` and `AmazonDetectiveInvestigatorAccess` policies. These actions allow getting Security Hub findings from within Detective. | May 16, 2023 +AmazonDetectiveFullAccess and AmazonDetectiveInvestigatorAccess – Updates to existing policies | Detective added Security Hub CSPM `GetFindings` actions to the `AmazonDetectiveFullAccess` and `AmazonDetectiveInvestigatorAccess` policies. These actions allow getting Security Hub CSPM findings from within Detective. | May 16, 2023