AWS securityhub documentation change
Summary
Updated terminology from 'Security Hub controls' to 'Security Hub CSPM controls' throughout the document, including control names, default value references, and rule descriptions.
Security assessment
The changes are purely terminological updates (adding 'CSPM' to control names and references). There's no evidence of addressing vulnerabilities, configuration weaknesses, or incident response. The security controls themselves remain unchanged; only their naming convention was updated to reflect product positioning.
Diff
diff --git a/securityhub/latest/userguide/rds-controls.md b/securityhub/latest/userguide/rds-controls.md index 8f6d31864..e2d17509d 100644 --- a//securityhub/latest/userguide/rds-controls.md +++ b//securityhub/latest/userguide/rds-controls.md @@ -7 +7 @@ -# Security Hub controls for Amazon RDS +# Security Hub CSPM controls for Amazon RDS @@ -9 +9 @@ -These AWS Security Hub controls evaluate the Amazon Relational Database Service (Amazon RDS) and Amazon RDS resources. The controls might not be available in all AWS Regions. For more information, see [Availability of controls by Region](./securityhub-regions.html#securityhub-regions-control-support). +These AWS Security Hub CSPM controls evaluate the Amazon Relational Database Service (Amazon RDS) and Amazon RDS resources. The controls might not be available in all AWS Regions. For more information, see [Availability of controls by Region](./securityhub-regions.html#securityhub-regions-control-support). @@ -167 +167 @@ To deploy your DB instances in multiple AZs, [Modifying a DB instance to be a Mu -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -323 +323 @@ To activate IAM database authentication on an RDS DB instance, see [Enabling and -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -328 +328 @@ Parameter | Description | Type | Allowed custom values | Security Hub default va -This control checks whether an Amazon Relational Database Service instance has automated backups enabled, and a backup retention period greater than or equal to the specified time frame. Read replicas are excluded from evaluation. The control fails if backups aren't enabled for the instance, or if the retention period is less than the specified time frame. Unless you provide a custom parameter value for the backup retention period, Security Hub uses a default value of 7 days. +This control checks whether an Amazon Relational Database Service instance has automated backups enabled, and a backup retention period greater than or equal to the specified time frame. Read replicas are excluded from evaluation. The control fails if backups aren't enabled for the instance, or if the retention period is less than the specified time frame. Unless you provide a custom parameter value for the backup retention period, Security Hub CSPM uses a default value of 7 days. @@ -415 +415 @@ To enable automatic minor version upgrades for an existing DB instance, see [Mod -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -465 +465 @@ Remediation steps differ for Aurora global databases. To configure multiple Avai -**AWS Config rule:** `rds-cluster-copy-tags-to-snapshots-enabled` (custom Security Hub rule) +**AWS Config rule:** `rds-cluster-copy-tags-to-snapshots-enabled` (custom Security Hub CSPM rule) @@ -489 +489 @@ For information about configuring an Amazon Aurora DB cluster to automatically c -**AWS Config rule:** `rds-instance-copy-tags-to-snapshots-enabled` (custom Security Hub rule) +**AWS Config rule:** `rds-instance-copy-tags-to-snapshots-enabled` (custom Security Hub CSPM rule) @@ -511 +511 @@ To automatically copy tags to snapshots for an RDS DB instance, see [Modifying a -**AWS Config rule:** `rds-deployed-in-vpc` (custom Security Hub rule) +**AWS Config rule:** `rds-deployed-in-vpc` (custom Security Hub CSPM rule) @@ -535 +535 @@ For instructions on moving RDS instances to a VPC, see [Updating the VPC for a D -**AWS Config rule:** `rds-cluster-event-notifications-configured` (custom Security Hub rule) +**AWS Config rule:** `rds-cluster-event-notifications-configured` (custom Security Hub CSPM rule) @@ -570 +570 @@ Event categories to include | Select specific event categories or All event cat -**AWS Config rule:** `rds-instance-event-notifications-configured` (custom Security Hub rule) +**AWS Config rule:** `rds-instance-event-notifications-configured` (custom Security Hub CSPM rule) @@ -605 +605 @@ Event categories to include | Select specific event categories or All event cat -**AWS Config rule:** `rds-pg-event-notifications-configured` (custom Security Hub rule) +**AWS Config rule:** `rds-pg-event-notifications-configured` (custom Security Hub CSPM rule) @@ -638 +638 @@ Event categories to include | Select specific event categories or All event cat -**AWS Config rule:** `rds-sg-event-notifications-configured` (custom Security Hub rule) +**AWS Config rule:** `rds-sg-event-notifications-configured` (custom Security Hub CSPM rule) @@ -671 +671 @@ Event categories to include | Select specific event categories or All event cat -**AWS Config rule:** `rds-no-default-ports` (custom Security Hub rule) +**AWS Config rule:** `rds-no-default-ports` (custom Security Hub CSPM rule) @@ -751 +751 @@ To change the administrative username associated with an RDS database instance, -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -799 +799 @@ You can enable encryption at rest when you create an RDS DB cluster. You can't c -**AWS Config rule:**`tagged-rds-dbcluster` (custom Security Hub rule) +**AWS Config rule:**`tagged-rds-dbcluster` (custom Security Hub CSPM rule) @@ -805 +805 @@ You can enable encryption at rest when you create an RDS DB cluster. You can't c -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -829 +829 @@ To add tags to an RDS DB cluster, see [Tagging Amazon RDS resources](https://doc -**AWS Config rule:**`tagged-rds-dbclustersnapshot` (custom Security Hub rule) +**AWS Config rule:**`tagged-rds-dbclustersnapshot` (custom Security Hub CSPM rule) @@ -835 +835 @@ To add tags to an RDS DB cluster, see [Tagging Amazon RDS resources](https://doc -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -859 +859 @@ To add tags to an RDS DB cluster snapshot, see [Tagging Amazon RDS resources](ht -**AWS Config rule:**`tagged-rds-dbinstance` (custom Security Hub rule) +**AWS Config rule:**`tagged-rds-dbinstance` (custom Security Hub CSPM rule) @@ -865 +865 @@ To add tags to an RDS DB cluster snapshot, see [Tagging Amazon RDS resources](ht -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -889 +889 @@ To add tags to an RDS DB instance, see [Tagging Amazon RDS resources](https://do -**AWS Config rule:**`tagged-rds-dbsecuritygroup` (custom Security Hub rule) +**AWS Config rule:**`tagged-rds-dbsecuritygroup` (custom Security Hub CSPM rule) @@ -895 +895 @@ To add tags to an RDS DB instance, see [Tagging Amazon RDS resources](https://do -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -919 +919 @@ To add tags to an RDS DB security group, see [Tagging Amazon RDS resources](http -**AWS Config rule:**`tagged-rds-dbsnapshot` (custom Security Hub rule) +**AWS Config rule:**`tagged-rds-dbsnapshot` (custom Security Hub CSPM rule) @@ -925 +925 @@ To add tags to an RDS DB security group, see [Tagging Amazon RDS resources](http -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -949 +949 @@ To add tags to an RDS DB snapshot, see [Tagging Amazon RDS resources](https://do -**AWS Config rule:**`tagged-rds-dbsubnetgroups` (custom Security Hub rule) +**AWS Config rule:**`tagged-rds-dbsubnetgroups` (custom Security Hub CSPM rule) @@ -955 +955 @@ To add tags to an RDS DB snapshot, see [Tagging Amazon RDS resources](https://do -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1039 +1039 @@ To enable automatic minor version upgrade on Multi-AZ DB clusters, see [Modifyin -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1135 +1135 @@ To require all connections to your RDS for MySQL DB instance to use SSL, see [SS -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value @@ -1185 +1185 @@ For information about enabling SSL/TLS for connections to Amazon RDS DB instance -Parameter | Description | Type | Allowed custom values | Security Hub default value +Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value