AWS securityhub documentation change
Summary
Updated all references from 'Security Hub' to 'Security Hub CSPM' throughout the document, including section titles and content. The service-linked role name (AWSServiceRoleForSecurityHub) and permissions remain unchanged.
Security assessment
The changes are purely branding updates (Security Hub → Security Hub CSPM) with no modifications to permissions, trust relationships, or security policies. The service-linked role functionality remains identical. No security vulnerabilities or weaknesses are addressed, and no new security features are documented.
Diff
diff --git a/securityhub/latest/userguide/using-service-linked-roles.md b/securityhub/latest/userguide/using-service-linked-roles.md index 4b71df2f1..3009bc380 100644 --- a//securityhub/latest/userguide/using-service-linked-roles.md +++ b//securityhub/latest/userguide/using-service-linked-roles.md @@ -5 +5 @@ -Service-linked role permissions for Security HubCreating a service-linked role for Security HubEditing a service-linked role for Security HubDeleting a service-linked role for Security HubService-linked role for AWS Security Hub V2 +Service-linked role permissions for Security Hub CSPMCreating a service-linked role for Security Hub CSPMEditing a service-linked role for Security Hub CSPMDeleting a service-linked role for Security Hub CSPMService-linked role for AWS Security Hub V2 @@ -7 +7 @@ Service-linked role permissions for Security HubCreating a service-linked role f -# Service-linked roles for AWS Security Hub +# Service-linked roles for AWS Security Hub CSPM @@ -9 +9 @@ Service-linked role permissions for Security HubCreating a service-linked role f -AWS Security Hub uses an AWS Identity and Access Management (IAM) [service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role) named `AWSServiceRoleForSecurityHub`. This service-linked role is an IAM role that's linked directly to Security Hub. It's predefined by Security Hub, and it includes all the permissions that Security Hub requires to call other AWS services and monitor AWS resources on your behalf. Security Hub uses this service-linked role in all the AWS Regions where Security Hub is available. +AWS Security Hub CSPM uses an AWS Identity and Access Management (IAM) [service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role) named `AWSServiceRoleForSecurityHub`. This service-linked role is an IAM role that's linked directly to Security Hub CSPM. It's predefined by Security Hub CSPM, and it includes all the permissions that Security Hub CSPM requires to call other AWS services and monitor AWS resources on your behalf. Security Hub CSPM uses this service-linked role in all the AWS Regions where Security Hub CSPM is available. @@ -11 +11 @@ AWS Security Hub uses an AWS Identity and Access Management (IAM) [service-linke -A service-linked role makes setting up Security Hub easier because you don't have to manually add the necessary permissions. Security Hub defines the permissions of its service-linked role, and unless defined otherwise, only Security Hub can assume the role. The defined permissions include the trust policy and the permissions policy, and you can't attach that permissions policy to any other IAM entity. +A service-linked role makes setting up Security Hub CSPM easier because you don't have to manually add the necessary permissions. Security Hub CSPM defines the permissions of its service-linked role, and unless defined otherwise, only Security Hub CSPM can assume the role. The defined permissions include the trust policy and the permissions policy, and you can't attach that permissions policy to any other IAM entity. @@ -13 +13 @@ A service-linked role makes setting up Security Hub easier because you don't hav -To review the details of the service-linked role, you can use the Security Hub console. In the navigation pane, choose **General** under **Settings**. Then, in the **Service permissions** section, choose **View service permissions**. +To review the details of the service-linked role, you can use the Security Hub CSPM console. In the navigation pane, choose **General** under **Settings**. Then, in the **Service permissions** section, choose **View service permissions**. @@ -15 +15 @@ To review the details of the service-linked role, you can use the Security Hub c -You can delete the Security Hub service-linked role only after you disable Security Hub in all the Regions where it's enabled. This protects your Security Hub resources because you can't inadvertently remove permissions to access them. +You can delete the Security Hub CSPM service-linked role only after you disable Security Hub CSPM in all the Regions where it's enabled. This protects your Security Hub CSPM resources because you can't inadvertently remove permissions to access them. @@ -21 +21 @@ For information about other services that support service-linked roles, see [AWS - * Service-linked role permissions for Security Hub + * Service-linked role permissions for Security Hub CSPM @@ -23 +23 @@ For information about other services that support service-linked roles, see [AWS - * Creating a service-linked role for Security Hub + * Creating a service-linked role for Security Hub CSPM @@ -25 +25 @@ For information about other services that support service-linked roles, see [AWS - * Editing a service-linked role for Security Hub + * Editing a service-linked role for Security Hub CSPM @@ -27 +27 @@ For information about other services that support service-linked roles, see [AWS - * Deleting a service-linked role for Security Hub + * Deleting a service-linked role for Security Hub CSPM @@ -34 +34 @@ For information about other services that support service-linked roles, see [AWS -## Service-linked role permissions for Security Hub +## Service-linked role permissions for Security Hub CSPM @@ -36 +36 @@ For information about other services that support service-linked roles, see [AWS -Security Hub uses the service-linked role named `AWSServiceRoleForSecurityHub`. It's a service-linked role required for AWS Security Hub to access your resources. This service-linked role allows Security Hub to perform tasks such as receive findings from other AWS services and configure the requisite AWS Config infrastructure to run security checks for controls. The `AWSServiceRoleForSecurityHub` service-linked role trusts the `securityhub.amazonaws.com` service to assume the role. +Security Hub CSPM uses the service-linked role named `AWSServiceRoleForSecurityHub`. It's a service-linked role required for AWS Security Hub CSPM to access your resources. This service-linked role allows Security Hub CSPM to perform tasks such as receive findings from other AWS services and configure the requisite AWS Config infrastructure to run security checks for controls. The `AWSServiceRoleForSecurityHub` service-linked role trusts the `securityhub.amazonaws.com` service to assume the role. @@ -40 +40 @@ The `AWSServiceRoleForSecurityHub` service-linked role uses the managed policy [ -You must grant permissions to allow an IAM identity (such as a role, group, or user) to create, edit, or delete a service-linked role. For the `AWSServiceRoleForSecurityHub` service-linked role to be successfully created, the IAM identity that you use to access Security Hub must have the required permissions. To grant the required permissions, attach the following policy to the IAM identity. +You must grant permissions to allow an IAM identity (such as a role, group, or user) to create, edit, or delete a service-linked role. For the `AWSServiceRoleForSecurityHub` service-linked role to be successfully created, the IAM identity that you use to access Security Hub CSPM must have the required permissions. To grant the required permissions, attach the following policy to the IAM identity. @@ -71 +71 @@ JSON -## Creating a service-linked role for Security Hub +## Creating a service-linked role for Security Hub CSPM @@ -73 +73 @@ JSON -The `AWSServiceRoleForSecurityHub` service-linked role is created automatically when you enable Security Hub for the first time or you enable Security Hub in a Region where you didn't previously enable it. You can also create the `AWSServiceRoleForSecurityHub` service-linked role manually by using the IAM console, the IAM CLI, or the IAM API. For more information about creating the role manually, see [Creating a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role) in the _IAM User Guide_. +The `AWSServiceRoleForSecurityHub` service-linked role is created automatically when you enable Security Hub CSPM for the first time or you enable Security Hub CSPM in a Region where you didn't previously enable it. You can also create the `AWSServiceRoleForSecurityHub` service-linked role manually by using the IAM console, the IAM CLI, or the IAM API. For more information about creating the role manually, see [Creating a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role) in the _IAM User Guide_. @@ -77 +77 @@ The `AWSServiceRoleForSecurityHub` service-linked role is created automatically -The service-linked role that's created for a Security Hub administrator account doesn't apply to associated Security Hub member accounts. +The service-linked role that's created for a Security Hub CSPM administrator account doesn't apply to associated Security Hub CSPM member accounts. @@ -79 +79 @@ The service-linked role that's created for a Security Hub administrator account -## Editing a service-linked role for Security Hub +## Editing a service-linked role for Security Hub CSPM @@ -81 +81 @@ The service-linked role that's created for a Security Hub administrator account -Security Hub doesn't allow you to edit the `AWSServiceRoleForSecurityHub` service-linked role. After you create a service-linked role, you can't change the name of the role because various entities might reference the role. However, you can edit the description of the role by using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the _IAM User Guide_. +Security Hub CSPM doesn't allow you to edit the `AWSServiceRoleForSecurityHub` service-linked role. After you create a service-linked role, you can't change the name of the role because various entities might reference the role. However, you can edit the description of the role by using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the _IAM User Guide_. @@ -83 +83 @@ Security Hub doesn't allow you to edit the `AWSServiceRoleForSecurityHub` servic -## Deleting a service-linked role for Security Hub +## Deleting a service-linked role for Security Hub CSPM @@ -87 +87 @@ If you no longer need to use a feature or service that requires a service-linked -When you disable Security Hub, Security Hub doesn't automatically delete the `AWSServiceRoleForSecurityHub` service-linked role for you. If you enable Security Hub again, the service can then start using the existing service-linked role again. If you no longer need to use Security Hub, you can manually delete the service-linked role. +When you disable Security Hub CSPM, Security Hub CSPM doesn't automatically delete the `AWSServiceRoleForSecurityHub` service-linked role for you. If you enable Security Hub CSPM again, the service can then start using the existing service-linked role again. If you no longer need to use Security Hub CSPM, you can manually delete the service-linked role. @@ -91 +91 @@ When you disable Security Hub, Security Hub doesn't automatically delete the `AW -Before you delete the `AWSServiceRoleForSecurityHub` service-linked role, you must first disable Security Hub in all the Regions where it's enabled. For more information, see [Disabling Security Hub CSPM](./securityhub-disable.html). If Security Hub isn't disabled when you try to delete the service-linked role, the deletion fails. +Before you delete the `AWSServiceRoleForSecurityHub` service-linked role, you must first disable Security Hub CSPM in all the Regions where it's enabled. For more information, see [Disabling Security Hub CSPM](./securityhub-disable.html). If Security Hub CSPM isn't disabled when you try to delete the service-linked role, the deletion fails.