AWS securityhub medium security documentation change

Service: securityhub · 2025-12-10 · Security-related medium

File: securityhub/latest/userguide/ses-controls.md

Summary

Added new SES.3 control requiring TLS for configuration sets, updated titles to 'CSPM', and modified parameter references

Security assessment

The new SES.3 control explicitly addresses encryption of data-in-transit by mandating TLS for email transmission. This prevents potential exposure of sensitive information through unencrypted emails, with concrete security guidance about TLS enforcement requirements.

Diff

diff --git a/securityhub/latest/userguide/ses-controls.md b/securityhub/latest/userguide/ses-controls.md
index 7699ad351..d2b1b8700 100644
--- a//securityhub/latest/userguide/ses-controls.md
+++ b//securityhub/latest/userguide/ses-controls.md
@@ -5 +5 @@
-[SES.1] SES contact lists should be tagged[SES.2] SES configuration sets should be tagged
+[SES.1] SES contact lists should be tagged[SES.2] SES configuration sets should be tagged[SES.3] SES configuration sets should have TLS enabled for sending emails
@@ -7 +7 @@
-# Security Hub controls for Amazon SES
+# Security Hub CSPM controls for Amazon SES
@@ -9 +9 @@
-These AWS Security Hub controls evaluate the Amazon Simple Email Service (Amazon SES) service and resources.
+These AWS Security Hub CSPM controls evaluate the Amazon Simple Email Service (Amazon SES) service and resources.
@@ -21 +21 @@ These controls may not be available in all AWS Regions. For more information, se
-**AWS Configrule:** `tagged-ses-contactlist` (custom Security Hub rule)
+**AWS Configrule:** `tagged-ses-contactlist` (custom Security Hub CSPM rule)
@@ -27 +27 @@ These controls may not be available in all AWS Regions. For more information, se
-Parameter | Description | Type | Allowed custom values | Security Hub default value  
+Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value  
@@ -51 +51 @@ To add tags to an Amazon SES contact list, see [TagResource](https://docs.aws.am
-**AWS Configrule:** `tagged-ses-configurationset` (custom Security Hub rule)
+**AWS Configrule:** `tagged-ses-configurationset` (custom Security Hub CSPM rule)
@@ -57 +57 @@ To add tags to an Amazon SES contact list, see [TagResource](https://docs.aws.am
-Parameter | Description | Type | Allowed custom values | Security Hub default value  
+Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value  
@@ -72,0 +73,26 @@ To add tags to an Amazon SES configuration set, see [TagResource](https://docs.a
+## [SES.3] SES configuration sets should have TLS enabled for sending emails
+
+**Category:** Protect > Data Protection > Encryption of data-in-transit 
+
+**Severity:** Medium
+
+**Resource type:** `AWS::SES::ConfigurationSet`
+
+**AWS Configrule:** `ses-sending-tls-required`
+
+**Schedule type:** Change triggered
+
+**Parameters:** None
+
+This control checks whether an Amazon SES configuration set requires TLS connections. The control fails if the TLS Policy is not set to `'REQUIRE'` for a configuration set.
+
+By default, Amazon SES uses opportunistic TLS, which means emails can be sent unencrypted if a TLS connection cannot be established with the receiving mail server. Enforcing TLS for email sending ensures that messages are only delivered when a secure encrypted connection can be established. This helps protect the confidentiality and integrity of email content during transmission between Amazon SES and the recipient's mail server. If a secure TLS connection cannot be established, the message will not be delivered, preventing potential exposure of sensitive information.
+
+###### Note
+
+While TLS 1.3 is the default delivery method for Amazon SES, without enforcing TLS requirement through configuration sets, messages could potentially be delivered in plaintext if a TLS connection fails. To pass this control, you must configure the TLS Policy to `'REQUIRE'` in your SES configuration set's delivery options. When TLS is required, messages are only delivered if a TLS connection can be established with the receiving mail server.
+
+### Remediation
+
+To configure Amazon SES to require TLS connections for a configuration set, see [Amazon SES and security protocols](https://docs.aws.amazon.com/ses/latest/dg/security-protocols.html#security-ses-to-receiver) in the _Amazon SES Developer Guide_.
+