AWS securityhub high security documentation change
Summary
Added new control EC2.182 to enforce that Amazon EBS snapshots are not publicly accessible. Updated references from 'Security Hub' to 'Security Hub CSPM' across the document and adjusted parameter table headers.
Security assessment
The addition of control EC2.182 introduces documentation for a security feature that prevents public exposure of EBS snapshots, mitigating risks of unauthorized data access. This directly addresses a security vulnerability where publicly accessible snapshots could lead to data breaches. Other changes are administrative rebranding to 'CSPM' and do not relate to security.
Diff
diff --git a/securityhub/latest/userguide/ec2-controls.md b/securityhub/latest/userguide/ec2-controls.md index c166d783b..0f21c4267 100644 --- a//securityhub/latest/userguide/ec2-controls.md +++ b//securityhub/latest/userguide/ec2-controls.md @@ -5 +5 @@ -[EC2.1] Amazon EBS snapshots should not be publicly restorable[EC2.2] VPC default security groups should not allow inbound or outbound traffic[EC2.3] Attached Amazon EBS volumes should be encrypted at-rest[EC2.4] Stopped EC2 instances should be removed after a specified time period[EC2.6] VPC flow logging should be enabled in all VPCs[EC2.7] EBS default encryption should be enabled[EC2.8] EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)[EC2.9] Amazon EC2 instances should not have a public IPv4 address[EC2.10] Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service[EC2.12] Unused Amazon EC2 EIPs should be removed[EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389[EC2.15] Amazon EC2 subnets should not automatically assign public IP addresses[EC2.16] Unused Network Access Control Lists should be removed[EC2.17] Amazon EC2 instances should not use multiple ENIs[EC2.18] Security groups should only allow unrestricted incoming traffic for authorized ports[EC2.19] Security groups should not allow unrestricted access to ports with high risk[EC2.20] Both VPN tunnels for an AWS Site-to-Site VPN connection should be up[EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389[EC2.22] Unused Amazon EC2 security groups should be removed[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests[EC2.24] Amazon EC2 paravirtual instance types should not be used[EC2.25] Amazon EC2 launch templates should not assign public IPs to network interfaces[EC2.28] EBS volumes should be covered by a backup plan[EC2.33] EC2 transit gateway attachments should be tagged[EC2.34] EC2 transit gateway route tables should be tagged[EC2.35] EC2 network interfaces should be tagged[EC2.36] EC2 customer gateways should be tagged[EC2.37] EC2 Elastic IP addresses should be tagged[EC2.38] EC2 instances should be tagged[EC2.39] EC2 internet gateways should be tagged[EC2.40] EC2 NAT gateways should be tagged[EC2.41] EC2 network ACLs should be tagged[EC2.42] EC2 route tables should be tagged[EC2.43] EC2 security groups should be tagged[EC2.44] EC2 subnets should be tagged[EC2.45] EC2 volumes should be tagged[EC2.46] Amazon VPCs should be tagged[EC2.47] Amazon VPC endpoint services should be tagged[EC2.48] Amazon VPC flow logs should be tagged[EC2.49] Amazon VPC peering connections should be tagged[EC2.50] EC2 VPN gateways should be tagged[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled[EC2.52] EC2 transit gateways should be tagged[EC2.53] EC2 security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports[EC2.54] EC2 security groups should not allow ingress from ::/0 to remote server administration ports[EC2.55] VPCs should be configured with an interface endpoint for ECR API[EC2.56] VPCs should be configured with an interface endpoint for Docker Registry[EC2.57] VPCs should be configured with an interface endpoint for Systems Manager[EC2.58] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts[EC2.60] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager[EC2.170] EC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2)[EC2.171] EC2 VPN connections should have logging enabled[EC2.172] EC2 VPC Block Public Access settings should block internet gateway traffic[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes[EC2.174] EC2 DHCP option sets should be tagged[EC2.175] EC2 launch templates should be tagged[EC2.176] EC2 prefix lists should be tagged[EC2.177] EC2 traffic mirror sessions should be tagged[EC2.178] EC2 traffic mirror filters should be tagged[EC2.179] EC2 traffic mirror targets should be tagged[EC2.180] EC2 network interfaces should have source/destination checking enabled[EC2.181] EC2 launch templates should enable encryption for attached EBS volumes +[EC2.1] Amazon EBS snapshots should not be publicly restorable[EC2.2] VPC default security groups should not allow inbound or outbound traffic[EC2.3] Attached Amazon EBS volumes should be encrypted at-rest[EC2.4] Stopped EC2 instances should be removed after a specified time period[EC2.6] VPC flow logging should be enabled in all VPCs[EC2.7] EBS default encryption should be enabled[EC2.8] EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)[EC2.9] Amazon EC2 instances should not have a public IPv4 address[EC2.10] Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service[EC2.12] Unused Amazon EC2 EIPs should be removed[EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389[EC2.15] Amazon EC2 subnets should not automatically assign public IP addresses[EC2.16] Unused Network Access Control Lists should be removed[EC2.17] Amazon EC2 instances should not use multiple ENIs[EC2.18] Security groups should only allow unrestricted incoming traffic for authorized ports[EC2.19] Security groups should not allow unrestricted access to ports with high risk[EC2.20] Both VPN tunnels for an AWS Site-to-Site VPN connection should be up[EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389[EC2.22] Unused Amazon EC2 security groups should be removed[EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests[EC2.24] Amazon EC2 paravirtual instance types should not be used[EC2.25] Amazon EC2 launch templates should not assign public IPs to network interfaces[EC2.28] EBS volumes should be covered by a backup plan[EC2.33] EC2 transit gateway attachments should be tagged[EC2.34] EC2 transit gateway route tables should be tagged[EC2.35] EC2 network interfaces should be tagged[EC2.36] EC2 customer gateways should be tagged[EC2.37] EC2 Elastic IP addresses should be tagged[EC2.38] EC2 instances should be tagged[EC2.39] EC2 internet gateways should be tagged[EC2.40] EC2 NAT gateways should be tagged[EC2.41] EC2 network ACLs should be tagged[EC2.42] EC2 route tables should be tagged[EC2.43] EC2 security groups should be tagged[EC2.44] EC2 subnets should be tagged[EC2.45] EC2 volumes should be tagged[EC2.46] Amazon VPCs should be tagged[EC2.47] Amazon VPC endpoint services should be tagged[EC2.48] Amazon VPC flow logs should be tagged[EC2.49] Amazon VPC peering connections should be tagged[EC2.50] EC2 VPN gateways should be tagged[EC2.51] EC2 Client VPN endpoints should have client connection logging enabled[EC2.52] EC2 transit gateways should be tagged[EC2.53] EC2 security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports[EC2.54] EC2 security groups should not allow ingress from ::/0 to remote server administration ports[EC2.55] VPCs should be configured with an interface endpoint for ECR API[EC2.56] VPCs should be configured with an interface endpoint for Docker Registry[EC2.57] VPCs should be configured with an interface endpoint for Systems Manager[EC2.58] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts[EC2.60] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager[EC2.170] EC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2)[EC2.171] EC2 VPN connections should have logging enabled[EC2.172] EC2 VPC Block Public Access settings should block internet gateway traffic[EC2.173] EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes[EC2.174] EC2 DHCP option sets should be tagged[EC2.175] EC2 launch templates should be tagged[EC2.176] EC2 prefix lists should be tagged[EC2.177] EC2 traffic mirror sessions should be tagged[EC2.178] EC2 traffic mirror filters should be tagged[EC2.179] EC2 traffic mirror targets should be tagged[EC2.180] EC2 network interfaces should have source/destination checking enabled[EC2.181] EC2 launch templates should enable encryption for attached EBS volumes[EC2.182] Amazon EBS Snapshots should not be publicly accessible @@ -7 +7 @@ -# Security Hub controls for Amazon EC2 +# Security Hub CSPM controls for Amazon EC2 @@ -9 +9 @@ -These AWS Security Hub controls evaluate the Amazon Elastic Compute Cloud (Amazon EC2) service and resources. The controls might not be available in all AWS Regions. For more information, see [Availability of controls by Region](./securityhub-regions.html#securityhub-regions-control-support). +These AWS Security Hub CSPM controls evaluate the Amazon Elastic Compute Cloud (Amazon EC2) service and resources. The controls might not be available in all AWS Regions. For more information, see [Availability of controls by Region](./securityhub-regions.html#securityhub-regions-control-support). @@ -107 +107 @@ For more information, see [Creating an Amazon EBS volume](https://docs.aws.amazo -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -111 +111 @@ Parameter | Description | Type | Allowed custom values | Security Hub default va -This control checks whether an Amazon EC2 instance has been stopped for longer than the allowed number of days. The control fails if an EC2 instance is stopped for longer than the maximum allowed time period. Unless you provide a custom parameter value for the maximum allowed time period, Security Hub uses a default value of 30 days. +This control checks whether an Amazon EC2 instance has been stopped for longer than the allowed number of days. The control fails if an EC2 instance is stopped for longer than the maximum allowed time period. Unless you provide a custom parameter value for the maximum allowed time period, Security Hub CSPM uses a default value of 30 days. @@ -148 +148 @@ With the VPC Flow Logs feature, you can capture information about the IP address -Security Hub recommends that you enable flow logging for packet rejects for VPCs. Flow logs provide visibility into network traffic that traverses the VPC and can detect anomalous traffic or provide insight during security workflows. +Security Hub CSPM recommends that you enable flow logging for packet rejects for VPCs. Flow logs provide visibility into network traffic that traverses the VPC and can detect anomalous traffic or provide insight during security workflows. @@ -213 +213 @@ Version 2 of the IMDS adds new protections for the following types of vulnerabil -Security Hub recommends that you configure your EC2 instances with IMDSv2. +Security Hub CSPM recommends that you configure your EC2 instances with IMDSv2. @@ -274 +274 @@ This control checks whether a service endpoint for Amazon EC2 is created for eac -This control evaluates resources in single account. It cannot describe resources that are outside of the account. Because AWS Config and Security Hub do not conduct cross-account checks, you will see `FAILED` findings for VPCs that are shared across accounts. Security Hub recommends that you suppress these `FAILED` findings. +This control evaluates resources in single account. It cannot describe resources that are outside of the account. Because AWS Config and Security Hub CSPM do not conduct cross-account checks, you will see `FAILED` findings for VPCs that are shared across accounts. Security Hub CSPM recommends that you suppress these `FAILED` findings. @@ -452 +452 @@ To detach a network interface from an EC2 instance, see [Detach a network interf -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -607 +607 @@ This control checks whether security groups are attached to Amazon Elastic Compu -On September 20, 2023, Security Hub removed this control from the AWS Foundational Security Best Practices and NIST SP 800-53 Revision 5 standards. This control continues to be part of the AWS Control Tower service-managed standard. This control produces a passed finding if security groups are attached to EC2 instances or an elastic network interface. However, for certain use cases, unattached security groups don't pose a security risk. You can use other EC2 controls—such as EC2.2, EC2.13, EC2.14, EC2.18, and EC2.19—to monitor your security groups. +On September 20, 2023, Security Hub CSPM removed this control from the AWS Foundational Security Best Practices and NIST SP 800-53 Revision 5 standards. This control continues to be part of the AWS Control Tower service-managed standard. This control produces a passed finding if security groups are attached to EC2 instances or an elastic network interface. However, for certain use cases, unattached security groups don't pose a security risk. You can use other EC2 controls—such as EC2.2, EC2.13, EC2.14, EC2.18, and EC2.19—to monitor your security groups. @@ -703 +703 @@ To update an EC2 launch template, see [Change the default network interface sett -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -723 +723 @@ To add an Amazon EBS volume to an AWS Backup backup plan, see [Assigning resourc -**AWS Config rule:** `tagged-ec2-transitgatewayattachment` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-transitgatewayattachment` (custom Security Hub CSPM rule) @@ -729 +729 @@ To add an Amazon EBS volume to an AWS Backup backup plan, see [Assigning resourc -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -753 +753 @@ To add tags to an EC2 transit gateway attachment, see [Tag your Amazon EC2 resou -**AWS Config rule:** `tagged-ec2-transitgatewayroutetable` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-transitgatewayroutetable` (custom Security Hub CSPM rule) @@ -759 +759 @@ To add tags to an EC2 transit gateway attachment, see [Tag your Amazon EC2 resou -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -783 +783 @@ To add tags to an EC2 transit gateway route table, see [Tag your Amazon EC2 reso -**AWS Config rule:** `tagged-ec2-networkinterface` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-networkinterface` (custom Security Hub CSPM rule) @@ -789 +789 @@ To add tags to an EC2 transit gateway route table, see [Tag your Amazon EC2 reso -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -813 +813 @@ To add tags to an EC2 network interface, see [Tag your Amazon EC2 resources](htt -**AWS Config rule:** `tagged-ec2-customergateway` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-customergateway` (custom Security Hub CSPM rule) @@ -819 +819 @@ To add tags to an EC2 network interface, see [Tag your Amazon EC2 resources](htt -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -843 +843 @@ To add tags to an EC2 customer gateway, see [Tag your Amazon EC2 resources](http -**AWS Config rule:** `tagged-ec2-eip` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-eip` (custom Security Hub CSPM rule) @@ -849 +849 @@ To add tags to an EC2 customer gateway, see [Tag your Amazon EC2 resources](http -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -873 +873 @@ To add tags to an EC2 Elastic IP address, see [Tag your Amazon EC2 resources](ht -**AWS Config rule:** `tagged-ec2-instance` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-instance` (custom Security Hub CSPM rule) @@ -879 +879 @@ To add tags to an EC2 Elastic IP address, see [Tag your Amazon EC2 resources](ht -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -903 +903 @@ To add tags to an EC2 instance, see [Tag your Amazon EC2 resources](https://docs -**AWS Config rule:** `tagged-ec2-internetgateway` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-internetgateway` (custom Security Hub CSPM rule) @@ -909 +909 @@ To add tags to an EC2 instance, see [Tag your Amazon EC2 resources](https://docs -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -933 +933 @@ To add tags to an EC2 internet gateway, see [Tag your Amazon EC2 resources](http -**AWS Config rule:** `tagged-ec2-natgateway` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-natgateway` (custom Security Hub CSPM rule) @@ -939 +939 @@ To add tags to an EC2 internet gateway, see [Tag your Amazon EC2 resources](http -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -963 +963 @@ To add tags to an EC2 NAT gateway, see [Tag your Amazon EC2 resources](https://d -**AWS Config rule:** `tagged-ec2-networkacl` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-networkacl` (custom Security Hub CSPM rule) @@ -969 +969 @@ To add tags to an EC2 NAT gateway, see [Tag your Amazon EC2 resources](https://d -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -993 +993 @@ To add tags to an EC2 network ACL, see [Tag your Amazon EC2 resources](https://d -**AWS Config rule:** `tagged-ec2-routetable` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-routetable` (custom Security Hub CSPM rule) @@ -999 +999 @@ To add tags to an EC2 network ACL, see [Tag your Amazon EC2 resources](https://d -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1023 +1023 @@ To add tags to an EC2 route table, see [Tag your Amazon EC2 resources](https://d -**AWS Config rule:** `tagged-ec2-securitygroup` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-securitygroup` (custom Security Hub CSPM rule) @@ -1029 +1029 @@ To add tags to an EC2 route table, see [Tag your Amazon EC2 resources](https://d -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1053 +1053 @@ To add tags to an EC2 security group, see [Tag your Amazon EC2 resources](https: -**AWS Config rule:** `tagged-ec2-subnet` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-subnet` (custom Security Hub CSPM rule) @@ -1059 +1059 @@ To add tags to an EC2 security group, see [Tag your Amazon EC2 resources](https: -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1083 +1083 @@ To add tags to an EC2 subnet, see [Tag your Amazon EC2 resources](https://docs.a -**AWS Config rule:** `tagged-ec2-volume` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-volume` (custom Security Hub CSPM rule) @@ -1089 +1089 @@ To add tags to an EC2 subnet, see [Tag your Amazon EC2 resources](https://docs.a -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1113 +1113 @@ To add tags to an EC2 volume, see [Tag your Amazon EC2 resources](https://docs.a -**AWS Config rule:** `tagged-ec2-vpc` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-vpc` (custom Security Hub CSPM rule) @@ -1119 +1119 @@ To add tags to an EC2 volume, see [Tag your Amazon EC2 resources](https://docs.a -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1143 +1143 @@ To add tags to a VPC, see [Tag your Amazon EC2 resources](https://docs.aws.amazo -**AWS Config rule:** `tagged-ec2-vpcendpointservice` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-vpcendpointservice` (custom Security Hub CSPM rule) @@ -1149 +1149 @@ To add tags to a VPC, see [Tag your Amazon EC2 resources](https://docs.aws.amazo -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1173 +1173 @@ To add tags to an Amazon VPC endpoint service, see [Manage Tags](https://docs.aw -**AWS Config rule:** `tagged-ec2-flowlog` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-flowlog` (custom Security Hub CSPM rule) @@ -1179 +1179 @@ To add tags to an Amazon VPC endpoint service, see [Manage Tags](https://docs.aw -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1203 +1203 @@ To add tags to an Amazon VPC flow log, see [Tag a flow log](https://docs.aws.ama -**AWS Config rule:** `tagged-ec2-vpcpeeringconnection` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-vpcpeeringconnection` (custom Security Hub CSPM rule) @@ -1209 +1209 @@ To add tags to an Amazon VPC flow log, see [Tag a flow log](https://docs.aws.ama -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1233 +1233 @@ To add tags to an Amazon VPC peering connection, see [Tag your Amazon EC2 resour -**AWS Config rule:** `tagged-ec2-vpngateway` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-vpngateway` (custom Security Hub CSPM rule) @@ -1239 +1239 @@ To add tags to an Amazon VPC peering connection, see [Tag your Amazon EC2 resour -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1287 +1287 @@ To enable connection logging, see [Enable connection logging for an existing Cli -**AWS Config rule:** `tagged-ec2-transitgateway` (custom Security Hub rule) +**AWS Config rule:** `tagged-ec2-transitgateway` (custom Security Hub CSPM rule) @@ -1293 +1293 @@ To enable connection logging, see [Enable connection logging for an existing Cli -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1325 +1325 @@ To add tags to an EC2 transit gateway, see [Tag your Amazon EC2 resources](https -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1354 +1354 @@ To update an EC2 security group rule to prohibit ingress traffic to the specifie -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1383 +1383 @@ To update an EC2 security group rule to prohibit ingress traffic to the specifie -Parameter | Required | Description | Type | Allowed custom values | Security Hub default value +Parameter | Required | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1412 +1412 @@ To configure a VPC endpoint, see [Access an AWS service using an interface VPC e -Parameter | Required | Description | Type | Allowed custom values | Security Hub default value +Parameter | Required | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1441 +1441 @@ To configure a VPC endpoint, see [Access an AWS service using an interface VPC e -Parameter | Required | Description | Type | Allowed custom values | Security Hub default value +Parameter | Required | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1470 +1470 @@ To configure a VPC endpoint, see [Access an AWS service using an interface VPC e -Parameter | Required | Description | Type | Allowed custom values | Security Hub default value +Parameter | Required | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1499 +1499 @@ To configure a VPC endpoint, see [Access an AWS service using an interface VPC e -Parameter | Required | Description | Type | Allowed custom values | Security Hub default value +Parameter | Required | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1568 +1568 @@ To enable tunnel logging on an EC2 VPN connection, see [AWS Site-to-Site VPN log -**AWS Config rule:** `ec2-vpc-bpa-internet-gateway-blocked` (custom Security Hub rule) +**AWS Config rule:** `ec2-vpc-bpa-internet-gateway-blocked` (custom Security Hub CSPM rule) @@ -1574 +1574 @@ To enable tunnel logging on an EC2 VPN connection, see [AWS Site-to-Site VPN log -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1630 +1630 @@ For information about creating an Amazon EC2 Spot Fleet request, see [Create a S -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1660 +1660 @@ For information about adding tags to an Amazon EC2 DHCP option set, see [Tag you -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1690 +1690 @@ For information about adding tags to an Amazon EC2 launch template, see [Tag you -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1720 +1720 @@ For information about adding tags to an Amazon EC2 prefix list, see [Tag your Am -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1750 +1750 @@ For information about adding tags to an Amazon EC2 traffic mirror session, see [ -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1780 +1780 @@ For information about adding tags to an Amazon EC2 traffic mirror filter, see [T -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1849,0 +1850,22 @@ After you create an Amazon EC2 launch template, you can't modify it. However, yo +## [EC2.182] Amazon EBS Snapshots should not be publicly accessible + +**Category:** Protect > Secure network configuration > Resources not publicly accessible