AWS securityhub medium security documentation change
Summary
Added new control [CloudFormation.3] for termination protection, rebranded controls as 'CSPM', updated retired control references, and modified default value terminology
Security assessment
New termination protection control (CloudFormation.3) directly addresses accidental resource deletion risks. Control is categorized under 'Data deletion protection' with medium severity, providing explicit security guidance to prevent unintended stack deletions.
Diff
diff --git a/securityhub/latest/userguide/cloudformation-controls.md b/securityhub/latest/userguide/cloudformation-controls.md index 9c19b79a0..a3a848062 100644 --- a//securityhub/latest/userguide/cloudformation-controls.md +++ b//securityhub/latest/userguide/cloudformation-controls.md @@ -5 +5 @@ -[CloudFormation.1] CloudFormation stacks should be integrated with Simple Notification Service (SNS)[CloudFormation.2] CloudFormation stacks should be tagged +[CloudFormation.1] CloudFormation stacks should be integrated with Simple Notification Service (SNS)[CloudFormation.2] CloudFormation stacks should be tagged[CloudFormation.3] CloudFormation stacks should have termination protection enabled @@ -7 +7 @@ -# Security Hub controls for CloudFormation +# Security Hub CSPM controls for CloudFormation @@ -9 +9 @@ -These Security Hub controls evaluate the AWS CloudFormation service and resources. +These Security Hub CSPM controls evaluate the AWS CloudFormation service and resources. @@ -17 +17 @@ These controls may not be available in all AWS Regions. For more information, se -Security Hub retired this control in April 2024. For more information, see [Change log for Security Hub CSPM controls](./controls-change-log.html). +Security Hub CSPM retired this control in April 2024. For more information, see [Change log for Security Hub CSPM controls](./controls-change-log.html). @@ -49 +49 @@ To integrate a CloudFormation stack and an SNS topic, see [Updating stacks direc -**AWS Config rule:** `tagged-cloudformation-stack` (custom Security Hub rule) +**AWS Config rule:** `tagged-cloudformation-stack` (custom Security Hub CSPM rule) @@ -55 +55 @@ To integrate a CloudFormation stack and an SNS topic, see [Updating stacks direc -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -70,0 +71,26 @@ To add tags to a CloudFormation stack, see [CreateStack](https://docs.aws.amazon +## [CloudFormation.3] CloudFormation stacks should have termination protection enabled + +**Category:** Protect > Data Protection > Data deletion protection + +**Severity:** Medium + +**Resource type:** `AWS::CloudFormation::Stack` + +**AWS Config rule:** `cloudformation-termination-protection-check` + +**Schedule type:** Change triggered + +**Parameters:** None + +This control checks whether an AWS CloudFormation stack has termination protection enabled. The control fails if termination protection is not enabled on a CloudFormation stack. + +CloudFormation helps to manage related resources as a single unit called a Stack. You can prevent a stack from being accidentally deleted by enabling termination protection on the stack. If a user attempts to delete a stack with termination protection enabled, the deletion fails and the stack, including its status, remains unchanged. You can set termination protection on a stack with any status except `DELETE_IN_PROGRESS` or `DELETE_COMPLETE`. + +###### Note + +Enabling or disabling termination protection on a stack passes the same choice on to any nested stacks belonging to that stack as well. You can't enable or disable termination protection directly on a nested stack. You can't directly delete a nested stack belonging with a stack that has termination protection enabled. If NESTED is displayed next to the stack name, the stack is a nested stack. You can only change termination protection on the root stack to which the nested stack belongs. + +### Remediation + +To enable termination protection on a CloudFormation stack, see [Protect CloudFormation stacks from being deleted](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-protect-stacks.html) in the _AWS CloudFormation User Guide_. +